Platform/Architecture

Boring infrastructure. By design.

Web and worker communicate only through Postgres, Redis, and SQS — no direct HTTP. The execution engine is a portable TypeScript package with zero cloud dependencies.

The stack

Four layers. Every service AWS-managed.

Internet
CloudFront CDN · WAF
Web Service
Next.js 15 · ECS Fargate
Worker Service
Node.js · ECS Fargate
Aurora Postgres
Serverless v2
ElastiCache Redis
Locks · SSE Pub/Sub
SQS + DLQ
Step dispatch · retry
S3
Exports · attachments
Cognito
Auth · JWT
@nexus/engine
Pure TS · zero AWS deps
Principles

Three decisions worth defending.

01 · Single-tenant by default

Your data, your VPC.

Each customer gets isolated Aurora, Redis, and SQS. No noisy neighbors. No shared blast radius. Multi-tenant available on request, with strict per-row policies.

02 · No direct service-to-service HTTP

Web and worker never talk.

Web writes to Postgres and SQS. Worker reads from SQS and writes to Postgres. Redis pub/sub broadcasts state changes. Failures are localized; retries are durable.

03 · Portable engine

Cloud-agnostic core.

@nexus/engine is a pure TypeScript package — no AWS imports. Run it on Lambda, on Kubernetes, on bare metal. The cloud-specific bits live in adapters.

Security & compliance

Built for regulated environments.

Auth

Cognito + SAML/OIDC

SSO across the board. Short-lived JWTs. Per-tenant identity pools. SCIM provisioning for enterprise plans.

RBAC

Roles down to the node

Workspace, workflow, and node-level permissions. Approval-required tools. Time-bound elevation. Every state change audited.

Encryption

KMS at rest + TLS everywhere

Customer-managed keys optional. mTLS for in-house MCP servers. Secrets in AWS Secrets Manager with automated rotation.

Audit

Immutable trail

Every workflow run, every approval, every config change — appended to an immutable log. SIEM-ready exports.

Compliance

SOC 2 Type II · HIPAA · GDPR

Annual audits. Data residency in 6 regions. BAAs and DPAs available with the enterprise plan.

Observability

OTel native

Traces, metrics, logs — emitted as OpenTelemetry. Drop into Datadog, Honeycomb, Grafana, or your own collector.

Architecture review

We'll bring the diagrams. You bring the questions.

30 minutes with our engineering team. We walk through the stack, show you a live worker, and answer security/compliance questions.