The post-quantum, zero-static-secret platform for regulated multi-vertical software — one identity plane, live authorization, mandatory tenant isolation.
Every platform service, one plane each: certificates, identity, domain truth, durable change signals.
The identity plane: OAuth 2.1/OIDC/FAPI issuer, JWKS authority, token families, SCIM, wallet credentials, lockout & bot protection.
The internal ACME certificate authority: PQ server/client leaf minting, the root CA, enrollment claims, revocation.
The single ingress: L4 SNI router + L7 bridge; every connection PQ-TLS-terminated and round-robined across healthy instances.
The durable event backbone: local outbox + produce API, Valkey Streams, consumer groups, DLQ, SSE consume.
SQL execution & data service over Sentin8-authorized queries — no direct database access from apps.
Object storage: S3-compatible buckets, presigned upload/download, tenant-scoped prefixes.
Multi-channel message delivery: email, SMS, push, webhooks — templated, idempotent, retry-scheduled.
Secret reference store & resolver — plaintext never lands in application tables; every credential is a pointer.
Metrics & analytics: MemBus telemetry ingest, aggregation, dashboards for the platform's operational truth.
Standalone WASM execution: tenant-authored functions, idempotent by key, proxy-back for domain data.
Durable workflow engine: multi-step sagas with compensation, declarative triggers, workflow state machines.
Distributed scheduler: declarative schedule enrollment, one-shot deferrals, proxy-back execution.
The AI capability layer: embeddings, chat, completions, document ingestion — behind the same authorization pipeline as everything else.
The control plane: orgs, environments, vertical enrollment, service enablement, audit ingestion, branding.
Third-party app store & instance management: listings, installs, runtime context bootstrap for every app shell.
Backend-for-frontend & delegation gateway: OAuth tokens held server-side, session cookies to clients, scope downscoping.
The single Flutter web static host: runtime app discovery, same-origin bootstrap proxy, SPA fallback, COOP/COEP.
User- and staff-facing applications, thin by design — tokens never reach the client.
Typed facades over every service API — the only supported integration surface.
The two binaries that bring a fleet to life: bootstrap + supervision.
Every service — platform or vertical — inherits the five pillars by construction, not configuration.
Every TLS connection negotiates X25519MLKEM768 with ML-DSA-65 certificate signatures, anchored by an SLH-DSA-SHA2-128s root CA. No classical fallback exists.
Sentin8:Auth is the only token issuer, JWKS authority, and authentication authority. No service mints its own credentials — no second issuer to compromise.
RBAC + ABAC + ReBAC decided per request. Roles are never embedded in tokens: a demoted administrator loses access on the next request.
Every tenant table FORCE-RLS'd; no role carries BYPASSRLS. PostgreSQL runs the same certificate identity as the service plane — no database passwords exist.
A workload's only identity is its Acme-issued client certificate. No client secrets, no static API keys, no password files anywhere.
Seven verticals, one platform: every domain composes the same services with zero platform changes.
Banking, payments & open banking — core ledger, ISO 20022 orchestration, FDX v6.5.
Hospitality — PMS, POS, distribution, loyalty, upsell across properties.
Capital markets — matching engine, OMS, SOR, clearing, surveillance.
Trading — desk, router, risk, market data, bars, P&L.
Billing & payments — merchants, checkout, subscriptions, webhooks.
Email — MTA, store, access, gate, webmail on the platform's security model.
Health — in design; the eighth vertical of the platform.