Rebuilt HTML — PaddleOCR-VL (Baidu)
Semantic HTML reconstructed from the OCR item tree (headings, text, lists, tables, form fields). overlay · view JSON
ARCHITECTURE & INTEGRATION MODEL
Split Deployment — France
Their data plane and our analysis plane both run in France, on separate hardware, joined only by a federated message link. PROPOSED
Their infrastructure DATA PLANE · FRANCE · THEIR HARDWARE · THEIR DPA · STATEFUL
PROPOSED | AUGUST 2026
Our infrastructure ANALYSIS PLANE · FRANCE · OUR HARDWARE · OUR IP · STATELESS
PRIVATE LINK mTLS federation WireGuard or IPsec
Gateway, 40+ frontends, ~30 data services, MySQL, object store and their own broker. Every finding, screenshot, document, PII analysis and user account lives here. PRIVATE LINK mTLS federation WireGuard or IPsec
Broker, crawler fleet, engine-service, ai-facade and Redis. It holds the tests and prompts and nothing else — no findings, no accounts, no documents.
Traefik gateway accounts-api 40+ frontends
~30 data services MySQL 8.4 object store their broker
DETAIL ON PAGE 2
← verdicts crawl jobs
our broker crawler-manager crawler × 10
crawler-manager | crawler x10 | engine-service
ai-facade Redis
DETAIL ON PAGE 3
| WHERE THE LINE FALLS | ANALYSIS PLANE - OURS | DATA PLANE - THEIRS |
|---|---|---|
| Holds | Tests, crawler, AI prompts | Every result, document, screenshot, account |
| State | None that survives a restart | All of it |
| Reachable by | Their broker, over the private link | Their browsers, directly |
| If they leave | We keep the IP | They keep their data |
BLUE = THEIR HARDWARE, THEIR DPA · AMBER = OUR HARDWARE, OUR IP
Their infrastructure — what runs on their server
DATA PLANE · FRANCE · THEIR HARDWARE · THEIR DPA
EVERYTHING STORED HERE
Findings, screenshots, documents, PII analysis, remediation tracking and every user account — on infrastructure they own, under their own DPA.
What they control
Database backups, access controls and disaster recovery.
No analytics and no telemetry leave this estate — we cannot read their results.
Single-jurisdiction infrastructure: no multi-region replication to reason about.
HOW THEY REACH US
They never call us over HTTP. Their frontends and services talk only to their own broker; the broker federates across the private link.
Our infrastructure — what runs on our server
STATELESS
ANALYSIS PLANE · FRANCE · OUR HARDWARE · OUR IP
Our RabbitMQ broker
FEDERATED
publishes results out · never stores them
NOTHING STORED HERE
No findings, no accounts, no documents. Their data never travels to or resides on our infrastructure — which is why no code disclosure is needed.
crawler × 10
assigns crawl slots renders pages · runs 6 passes
OUTBOUND HTTPS
engine-service
ai-facade
single-URL scans holds the prompt set
Redis
frontier · seen-set · slot queue — nothing survives a restart
Their public websites
the pages under test, fetched by the crawlers
OUTBOUND HTTPS ▲
OpenAI
Calls may include page content. Their DPO should review OpenAI's DPA, or AI features can be disabled.
★ NEVER LEAVES THIS BOX
content analyzer SEO / GEO analyzers
86 WCAG SC test files
PDF remediation engine
web security analyzer data privacy analyzer
AI prompt set
Not compiled into their binaries, not shipped as an image they can inspect, not present in their database. They receive verdicts only.
One crawl, end to end
every step stays in France; the only crossing is the federated queue
01
THEIRS
02
THEIRS
03
04
OURS
Scan requested
Job onto their queue
Federated across
Slots assigned
A user in their UI asks for a crawl; the data service records the job. The request is published to their broker — no HTTP call to us.
The job crosses the mTLS private link to our broker.
crawler-manager claims a slot in Redis and dispatches crawlers.
05
06
07
NET EFFECT
THEIRS
Six passes run
Verdicts published
Stored and shown
Crawlers fetch their public pages and run WCAG, Content, SEO, GEO, Security and Privacy.
Structured results — not rules — federate back to their broker.
Their data services write to MySQL and the object store; the UI updates.
Verdicts move, data doesn't
They hold every byte of customer data; we hold every line of analysis IP.
Why this holds up
If they leave
No shared secrets — the link authenticates with mTLS certificates, not API keys.
They export findings, evidence and remediation tracking from their own data services.
No API exposure — our analysis services answer no HTTP; the queue is the only door.
We stop publishing to their queue and the private link is decommissioned.
Outage resilient — if the link drops, both queues buffer until it recovers.
They keep every finding, screenshot, document and account – no data escrow needed.
Independent audit — both brokers log federation, reviewable on either side.
One exception — ai-facade calls OpenAI and may include page content; their DPO decides.
We retain the full analysis IP; no code was ever disclosed, so none is recovered.