Skip to content

Technical Architecture Overview

Applies to: All subscriptions

Purpose

Give the customer's architects and security reviewers enough of Complifly's internal shape to make hosting, network, security and integration decisions independently — without needing a Complifly engineer on the call, and without needing access to the source.

Audience

Solution architects, infrastructure leads, network engineers, security reviewers. Not end users; not finance teams.

Prerequisites

Steps

Read in this order. Each page answers a distinct question a reviewer will ask.

Page The question it answers
System Architecture What are the components, what runs where, what talks to what?
Data Flow What happens to a document, stage by stage, and where can it stop?
Multi-Tenancy and Row-Level Security How is one customer's data kept from another, and how do I evidence that?
GSP Abstraction Why is the government provider replaceable, and what follows a document when it changes?
Deployment Topologies What deployment shapes are supported, and what does each imply?

The shape in one picture

                  Browser (React single-page application)
                                |
                                | HTTPS
                                v
                   +-------------------------+
                   |     Reverse proxy       |  TLS termination
                   |   (IIS / nginx / ALB)   |  security headers
                   +-------------------------+
                        |               |
            static assets|               | /api/*
                        v               v
                +-------------+   +--------------------+
                | Web front   |   |  Application API   |  Node.js / Express
                | end (built  |   |  (default port     |  stateless
                | bundle)     |   |   5003)            |
                +-------------+   +--------------------+
                                     |     |        |
                   +-----------------+     |        +------------------+
                   |                       |                           |
                   v                       v                           v
         +------------------+    +------------------+     +----------------------+
         |   SQL Server     |    |  Background      |     |  Outbound HTTPS      |
         |                  |    |  worker          |     |                      |
         | Row-Level        |    |  (uploads,       |     |  GSP to NIC / GSTN   |
         | Security         |    |   write-back,    |     |  SMTP / Azure email  |
         | policies         |    |   alerts)        |     |  Microsoft Entra ID  |
         +------------------+    +------------------+     +----------------------+
                                         |
                                         v
                                 +----------------+
                                 | Redis (queue)  |  when queue-backed
                                 +----------------+  jobs are enabled

What an architect most needs to take away

The API tier is stateless. Session state lives in the token, not in the process. Scaling out is therefore a load-balancer decision rather than an application redesign. The constraint on scaling out is the background worker, not the API — see Deployment Topologies.

The database is not a passive store. Tenant isolation is enforced inside SQL Server by Row-Level Security policies, not only by application code. That is a strength for an auditor and a trap for an administrator: a query run without the correct session scope returns zero rows and reports success. It does not raise an error. Any operational or reporting script written against this database must set scope deliberately. See Multi-Tenancy and Row-Level Security.

The schema and the code are versioned together but applied separately. The application checks a manifest of required database objects at startup and refuses to serve if one is missing, naming the migration that creates it. This converts a class of failure that used to surface as a broken button hours after deployment into a startup failure at deployment time. Plan upgrades accordingly — see Upgrade Procedure.

Outbound network access is mandatory; inbound from the internet is not. Complifly must reach the GSP, the mail transport and — where Entra ID authentication is used — Microsoft's identity endpoints. ERP systems may push into Complifly, but nothing in the government direction requires an inbound path from the public internet.

Downloads are cross-origin by design. Generated PDFs and export files are served from a separate download domain, not from the application origin. Session cookies are deliberately not sent there, so download links are signed and time-limited. This is a decision, not an accident, and any customer proxy or content-security policy must accommodate it. See Domains and URLs.

Validation

An architecture review is complete when the reviewer can produce all of the following without asking Complifly:

Deliverable Source
A component diagram of the intended deployment System Architecture
A list of every outbound destination, port and protocol, ready for a firewall change request Network and Firewall
A written statement of how tenant isolation is enforced and how it is evidenced Multi-Tenancy and Row-Level Security
The failure behaviour when the GSP is unreachable, and which screens keep working GSP Abstraction
The chosen topology, with its scaling and availability implications stated Deployment Topologies

Troubleshooting

Symptom Cause Action
Security review stalls on data isolation Reviewer expects application-only isolation and finds database policies as well Provide Multi-Tenancy and Row-Level Security; the database-enforced model is usually stronger than what was expected
A reporting script returns no rows against a database known to hold data Query run without tenant scope; RLS filtered every row silently Set session scope, or use the storage-metadata cross-check described in the RLS page
Application starts, then refuses to serve, naming a missing object The startup schema guard found a required object absent Run the named migration. This is working as intended, not a fault. See Migrations
PDF links fail behind the customer's proxy Downloads are served from a different origin Allow the download domain in the proxy and the content-security policy. See Domains and URLs