ARCHITECTURE & INTEGRATION MODEL
Their data plane and our analysis plane both run in France, on separate hardware, joined only by a federated message link. PROPOSED
PROPOSED | AUGUST 2026
PRIVATE LINK mTLS federation WireGuard or IPsec
Gateway, 40+ frontends, ~30 data services, MySQL, object store and their own broker. Every finding, screenshot, document, PII analysis and user account lives here. PRIVATE LINK mTLS federation WireGuard or IPsec
Broker, crawler fleet, engine-service, ai-facade and Redis. It holds the tests and prompts and nothing else — no findings, no accounts, no documents.
Traefik gateway accounts-api 40+ frontends
~30 data services MySQL 8.4 object store their broker
DETAIL ON PAGE 2
← verdicts crawl jobs
our broker crawler-manager crawler × 10
crawler-manager | crawler x10 | engine-service
ai-facade Redis
DETAIL ON PAGE 3
| WHERE THE LINE FALLS | ANALYSIS PLANE - OURS | DATA PLANE - THEIRS |
|---|---|---|
| Holds | Tests, crawler, AI prompts | Every result, document, screenshot, account |
| State | None that survives a restart | All of it |
| Reachable by | Their broker, over the private link | Their browsers, directly |
| If they leave | We keep the IP | They keep their data |
BLUE = THEIR HARDWARE, THEIR DPA · AMBER = OUR HARDWARE, OUR IP