Build credibility

A transparent view of what is built, protected, and still planned.

This architecture note gives reviewers a concise technical explanation of the MVP without exposing secrets or internal credentials.

Security note: This page intentionally describes architecture at a high level. It does not publish secret values, admin keys, database keys, or private infrastructure details.

Current stack

  • Frontend: Next.js app deployed on Vercel with public review pages, checker UI, report preview, dashboard, and evidence pages.
  • Backend: Flask API service for reports, waitlist, profile, beta feedback, document metadata, and authentication workflows.
  • Database: Supabase-backed storage for waitlist entries, generated reports, user profiles, feedback, and metadata.
  • Report flow: checker answers are transformed into a structured report object, stored in browser session for guest preview, and can be saved through backend endpoints where configured.
  • Security boundary: backend service-role keys and admin keys are not exposed to frontend pages; protected admin workflows remain behind key/session checks.

Product flow

  • Reviewer opens Product Readiness Pack or Reviewer Demo.
  • Reviewer opens Sample Report for immediate no-login output review.
  • User or reviewer runs Checker with sample/general information.
  • Browser-session report is generated and can be opened in Report Preview.
  • PDF export can be generated from the report preview.
  • Document-readiness and beta-feedback workflows support validation and adviser handoff.

Security and privacy controls

  • Public review pages avoid requiring secrets or private credentials.
  • Sensitive document uploads are intentionally not enabled in the early MVP.
  • Production auth has been tested so development login codes are not exposed publicly.
  • Admin routes and report ownership are treated separately from public reviewer flows.
  • Future secure storage should add encryption-at-rest controls, deletion/export workflows, audit logs, and stricter role-based access.

Engineering roadmap

  • Transactional email provider for reliable OTP and notification delivery.
  • Secure document vault with retention, deletion, export, access logs, and role-based adviser access.
  • Monitoring and error logging for backend/API flows.
  • Automated test coverage for checker, report preview, PDF generation, and protected routes.
  • Adviser collaboration layer for notes, status updates, and controlled report review.