Infrastructure
Infrastructure that stays up
A repository is not a product. We take a build from the first commit to the thing your customers load, then keep it up: hosting, databases, releases, domains, mail, and the alert that reaches a person at 2am.
-
The app
Browser, mobile, or another service
01 · Client
- TLS 1.3 in transit
- No API keys on device
-
The front door
Managed CDN
02 · Edge
- Rate limited per user
- Static assets, nothing to exploit
-
The logic
Server-side functions
03 · Service
- Token checked every request
- Secrets never leave the server
-
The records
Managed Postgres
04 · Data
- Row-level security
- Encrypted at rest, restore tested
- Versioned migrations
- Private admin network
- Least-privilege access
- Authenticated mail
| Stage | What happens | Stack |
|---|---|---|
| Build | Every change moves through its own branch and gets a preview deploy with a real URL, so you review the running thing. | Git branches · Preview deploys · TypeScript |
| Data | Postgres with row-level security, so an account only reads its own rows. Schema changes are migrations in version control. | Postgres · Row-level security · Versioned migrations |
| Secrets | API keys stay server-side behind a rate-limited proxy. Nothing that costs money per call is reachable from a client. | Server-side proxy · Rate limiting · No keys on device |
| Release | Atomic and versioned, so rolling back is picking the previous build. Web ships on merge, mobile takes the same pipeline. | Atomic deploys · Instant rollback · Staged rollout |
| Domains and mail | DNS, automatic TLS, and business mail that authenticates on SPF, DKIM, and DMARC, so invoices reach an inbox. | DNS · Automatic TLS · SPF, DKIM, DMARC |
| Run | Health checks, alerting, and backups you have restored at least once. Admin surfaces sit on a private network. | Monitoring · Tested backups · Private networking |
Where it runs
- web
- Static and server-rendered apps on a managed edge platform
- data
- Managed Postgres · row-level security · versioned migrations
- apps
- Web, internal tools, and mobile, released the same way
- mail_dns
- Managed DNS · automatic TLS · authenticated business mail
- always_on
- Dedicated hardware running scheduled and long-lived services
- private_net
- Mesh VPN between machines · no public admin ports
- desktops
- GPU-backed cloud desktops for software that needs a workstation
- models
- Model endpoints · versioned prompts · evaluation runs before release
Whoever writes the code carries the pager for it. Being woken up is expensive, so it gets built not to happen — which is why the alerts are rare.