Web tier
Web application served via AWS CloudFront, deployed in eu-west-2. OAuth 2.0 with PKCE for customer-user authentication.
The platform
A multi-tenant SaaS overlay, engineered for UK enterprise governance.
Web tier, API tier, data tier, integration workers — each chosen for the smallest credible blast radius and the strongest defaults the UK mid-market expects.
High-level architecture
API tier
TypeScript REST API behind AWS Application Load Balancer on a containerised cluster. Stateless servers, horizontal autoscale.
Data tier
PostgreSQL on AWS RDS, Multi-AZ. Encrypted at rest with KMS. TLS 1.2+ in transit. Read-replica for analytics workloads.
Integration tier
Background workers for SaaS-estate ingestion. Queued job processing with multi-stage integration workflows.
Observability
Metrics, distributed tracing and structured logging across all tiers with 24/7 alerting.
Identity
Standards-based identity with OAuth 2.0. SSO available on the Enterprise tier.
Shared schema. Tenant-scoped row-level security.
A single PostgreSQL schema with RLS policies enforces tenant isolation on every read and write. The model reduces operational complexity vs separate-schema or separate-database approaches while preserving strong logical isolation — and is independently audited as part of ISO 27001 alignment.
-- Every row carries tenant_id. Every read is policy-scoped.
CREATE POLICY tenant_isolation ON adoption_scores
FOR ALL
USING ( tenant_id = current_setting('app.tenant_id')::uuid );
-- Connection middleware sets app.tenant_id from the verified JWT
SET LOCAL app.tenant_id = '...'; -- per request, per tenant
Mainstream choices, deliberately picked.
Standards-based components chosen for the governance expectations of FS-adjacent customers.
| Layer | Choice |
|---|---|
| Application | TypeScript / React |
| Database | PostgreSQL with row-level security |
| Cloud | AWS London (eu-west-2) |
| Identity | OAuth 2.0 · SSO on Enterprise |
| Infrastructure | Containerised, infrastructure-as-code |