Reference architecture

How we fit inside the stack you already paid for

A serious platform earns its place by being explicit about what it replaces, what it augments, and what it leaves alone. This is our reference architecture for an enterprise deployment.

Edge & ingress

All traffic terminates on a managed edge with mTLS, WAF, and per-tenant rate limits. Customer-private endpoints available on Enterprise.

Cloudflare WAF + DDoS L7
Per-tenant rate limit & quota
mTLS for partner callbacks
IP allowlist on admin surfaces

Identity & access

Customer IdP is the source of truth. SCIM provisions, OIDC authenticates, and a deny-by-default RBAC model wraps every action.

SAML 2.0 / OIDC SSO
SCIM 2.0 provisioning
Step-up MFA for payouts
Just-in-time role elevation

Application services

Pacer, Sentinel, Ledger and Treasury run as independent services, each with its own data plane, secrets, and on-call rotation.

Pacer (forecast + control)
Sentinel (anomaly + dispute)
Ledger (immutable journal)
Treasury (payouts + FX)

Data & storage

Customer data is regionally isolated. Append-only ledgers commit to a Merkle root published daily. Backups are encrypted, tested weekly.

EU & HK residency options
Per-tenant KMS keys (BYOK on Enterprise)
Append-only Merkle ledger
Restore tested ≥ weekly

Replace, augment, or leave alone

Function	Incumbent	Position
Pacing & budget control	Manual spreadsheets, vendor scripts	Replace
Platform reconciliation	ERP + ad platform exports	Augment
Bid management	Smart bidding inside platforms	Leave alone
MMM / attribution	Customer’s incumbent	Leave alone
Treasury controls	Bank portals + email approvals	Replace
Audit evidence assembly	Manual PDF collection at year end	Replace

Deployment shapes

Shared multi-tenant. Default. Region-isolated. Suitable for most agencies and mid-market brands.
Dedicated tenancy. Per-customer database, KMS keys and ingress. Enterprise tier.
Private cloud connect. AWS PrivateLink / Azure Private Endpoint. No traffic over the public internet for customer-facing APIs.
Air-gapped evidence. Daily ledger commits delivered to a customer-controlled object store for independent verification.