_private/qwestly-private-docs/SOC2/network/Network Architecture Diagram.md

Table of Contents

Qwestly Network Architecture Diagram

Document Version: 1.2
Date: July 20, 2026
Owner: Dominick Pham, CTO
Classification: Internal Use - SOC2 Compliance

Executive Summary

This document provides comprehensive network diagrams for Qwestly's infrastructure to satisfy SOC 2 Type II audit requirements. Our cloud-native architecture leverages multiple managed services across different providers to ensure security, availability, and scalability while maintaining clear security boundaries and controls. Since the prior review (July 2025), the architecture has evolved to a multi-product marketplace with dedicated employer-facing and agentic AI orchestration services, shifted to an OpenAI-first AI strategy with DeepSeek and Anthropic fallbacks, and consolidated primary data storage onto MongoDB Atlas with Vector Search capabilities.

1. High-Level System Architecture

graph TB
    subgraph "External Users"
        EU[End Users/Candidates]
        HM[Hiring Managers]
        DEV[Developers]
    end

    subgraph "Internet Boundary"
        DNS[DNS Resolution]
        INTERNET[Internet Gateway]
    end

    subgraph "Vercel Edge Network (Global)"
        subgraph "Edge Infrastructure"
            EDGE[Vercel Edge Network]
            LB[Load Balancer]
            CDN[Built-in CDN]
        end
        
        subgraph "Frontend Applications"
            MW[Marketing Website
qwestly.com]
            CA[Candidate Portal
app.qwestly.com]
            HMP[Hiring Manager Portal
hire.qwestly.com]
            MON[Monitoring Dashboard
status.qwestly.com]
        end
        
        subgraph "API Layer"
            PYAPI[Python API
api.qwestly.com]
            NJS[Next.js API Routes
Candidate & Hire Apps]
        end
        
        subgraph "Agent Orchestration"
            AGENT[Qwestly Agent
Agentic AI Orchestrator]
        end
    end

    subgraph "AWS CloudFront + S3 (US-West-1)"
        CF[CloudFront Distribution]
        S3UPLOAD[S3 User Uploads]
        S3EXT[Chrome Extension Assets]
    end

    subgraph "Authentication & Identity - Auth0 (US)"
        AUTH[Auth0 Identity Provider]
        MFA[Multi-Factor Authentication]
        SSO[Google Workspace SSO]
    end

    subgraph "Data Layer - MongoDB Atlas (US-West-1)"
        subgraph "Operational Databases"
            CANDIDB[(Candidate Portal DB
candidate_portal)]
            HIREDB[(Hire Platform DB
qwestly_hire)]
            INTERNALDB[(Internal Services DB
qwestly_internal)]
            MEMDB[(Agent Memory DB
user_memories)]
        end
        
        subgraph "Atlas Capabilities"
            VECTOR[Atlas Vector Search
RAG + Memory]
            BACKUPS[Automated Backups
Point-in-Time Recovery]
        end
    end

    subgraph "Supporting Infrastructure"
        SUPDB[(Supabase
Auth Logs & API Logs)]
        S3LOG[S3 Log Archive
90-day Retention]
        S3BACKUP[S3 Backup Storage]
        S3DOC[S3 Document Storage]
    end

    subgraph "External AI Services"
        OPENAI[OpenAI
gpt-5.4 Primary]
        DEEPSEEK[DeepSeek
v4-pro Secondary]
        ANTHROPIC[Anthropic Claude
Fallback]
    end

    subgraph "Monitoring, Email & LLM Ops"
        subgraph "GitHub (Security)"
            GH[GitHub Repositories]
            GHACT[GitHub Actions CI/CD]
            GHSEC[Security Scanning
Trivy + TruffleHog]
        end
        
        LSMITH[LangSmith
Prompt Mgmt & Traces]
        POSTHOG[PostHog Analytics
400+ Event Types]
        SENDGRID[SendGrid Email
via api-python Gateway]
        VERMON[Vercel Analytics]
    end

    %% User flows
    EU --> DNS
    HM --> DNS
    DEV --> GH
    
    %% DNS and edge routing
    DNS --> EDGE
    EDGE --> LB
    LB --> CDN
    
    %% CDN to applications
    CDN --> MW
    CDN --> CA
    CDN --> HMP
    CDN --> MON
    
    %% Static asset flows
    EU --> CF
    HM --> CF
    CF --> S3UPLOAD
    CF --> S3EXT
    
    %% Application interconnections
    MW --> PYAPI
    CA --> PYAPI
    CA --> NJS
    HMP --> PYAPI
    HMP --> NJS
    MON --> PYAPI
    
    %% Agent orchestration
    CA --> AGENT
    AGENT --> PYAPI
    AGENT --> CANDIDB
    AGENT --> MEMDB
    
    %% Authentication flows
    CA --> AUTH
    HMP --> AUTH
    AUTH --> MFA
    AUTH --> SSO
    
    %% Data flows - MongoDB Atlas
    PYAPI --> CANDIDB
    PYAPI --> HIREDB
    PYAPI --> INTERNALDB
    NJS --> CANDIDB
    NJS --> HIREDB
    CANDIDB --> VECTOR
    MEMDB --> VECTOR
    CANDIDB --> BACKUPS
    HIREDB --> BACKUPS
    
    %% Supporting infrastructure
    PYAPI --> S3DOC
    PYAPI --> S3UPLOAD
    PYAPI --> S3LOG
    NJS --> S3LOG
    AUTH --> SUPDB
    
    %% AI service connections
    PYAPI --> OPENAI
    PYAPI --> DEEPSEEK
    PYAPI --> ANTHROPIC
    AGENT --> OPENAI
    AGENT --> DEEPSEEK
    
    %% LLM observability
    PYAPI --> LSMITH
    AGENT --> LSMITH
    
    %% Logging and monitoring
    MW --> VERMON
    CA --> VERMON
    HMP --> VERMON
    CA --> POSTHOG
    HMP --> POSTHOG
    MW --> POSTHOG
    
    %% Email services
    PYAPI --> SENDGRID
    HMP --> SENDGRID
    
    %% Webhook delivery
    PYAPI --> |"Webhook Delivery"|HM[Hiring Managers]
    
    %% CI/CD flows
    DEV --> GHACT
    GHACT --> GHSEC
    GHACT --> MW
    GHACT --> CA
    GHACT --> HMP
    GHACT --> PYAPI
    GHACT --> AGENT
    GHACT --> MON

    %% Styling
    classDef frontend fill:#e1f5fe
    classDef backend fill:#f3e5f5
    classDef database fill:#e8f5e8
    classDef external fill:#fff3e0
    classDef security fill:#ffebee
    classDef aws fill:#ff9800
    classDef agent fill:#fce4ec
    
    class MW,CA,HMP,MON frontend
    class PYAPI,NJS backend
    class AGENT agent
    class CANDIDB,HIREDB,INTERNALDB,MEMDB,SUPDB,S3LOG,S3DOC,S3BACKUP database
    class OPENAI,DEEPSEEK,ANTHROPIC external
    class AUTH,MFA,SSO,GHSEC security
    class CF,S3UPLOAD,S3EXT aws

2. Network Security Zones and Data Flow

graph TB
    subgraph "Internet Zone (Public)"
        USERS[Users/Candidates/HMs]
        BOTS[Search Engine Bots]
        THREAT[Potential Threats]
    end

    subgraph "Edge/CDN Zone (Vercel + AWS)"
        subgraph "Vercel Edge Network"
            VEDGE[Vercel Edge Locations]
            VLB[Vercel Load Balancer]
            VCDN[Vercel CDN Cache]
            VSSL[SSL/TLS Termination]
        end
        
        subgraph "AWS CloudFront"
            CFEDGE[CloudFront Edge Locations]
            CFCACHE[CloudFront Cache]
            CFSSL[CloudFront SSL/TLS]
        end
    end

    subgraph "Application DMZ (Vercel Infrastructure)"
        subgraph "Compute Environment"
            LAMBDA[Serverless Functions]
            CONTAINER[Container Runtime]
            STATIC[Static File Serving]
        end
        
        subgraph "Network Security"
            NETFW[Network Firewall Rules]
            NACL[Network ACLs]
            HEADERS[Security Headers]
        end
    end

    subgraph "Application Zone (Internal)"
        subgraph "Frontend Applications"
            FE1[Marketing Site
qwestly.com]
            FE2[Candidate Portal
app.qwestly.com]
            FE3[HM Portal
hire.qwestly.com]
            FE4[Monitoring Dashboard
status.qwestly.com]
        end
        
        subgraph "API Services"
            API1[Python FastAPI
api.qwestly.com]
            API2[Next.js API Routes
Candidate & Hire]
            API3[Qwestly Agent
Agentic Orchestrator]
        end
    end

    subgraph "Data Zone (Private)"
        subgraph "MongoDB Atlas Databases"
            DB1[(Candidate Portal DB)]
            DB2[(Hire Platform DB)]
            DB3[(Internal Services DB)]
            DB4[(Agent Memory DB)]
        end
        
        subgraph "AWS Storage Systems"
            S31[S3 Document Storage]
            S32[S3 Log Archive]
            S33[S3 User Uploads]
            S34[S3 Chrome Extension Assets]
        end
        
        subgraph "Database Security"
            DBFW[MongoDB Atlas Firewall]
            VECTOR[Atlas Vector Search]
            ENCRYPT[Encryption at Rest]
        end
    end

    subgraph "External Services Zone"
        subgraph "AI/ML Providers"
            AI1[OpenAI - Primary]
            AI2[DeepSeek - Secondary]
            AI3[Anthropic - Fallback]
        end
        
        subgraph "SaaS Services"
            SAAS1[Auth0]
            SAAS2[SendGrid]
            SAAS3[PostHog]
            SAAS4[LangSmith]
        end
    end

    subgraph "Management Zone (Restricted)"
        subgraph "CI/CD Pipeline"
            GITHUB[GitHub Actions]
            DEPLOY[Vercel Deployments]
            MONITOR[Security Scanning]
        end
        
        subgraph "Administrative Access"
            ADMIN[MongoDB Atlas Console]
            AWS_CONSOLE[AWS Console]
            AUDIT[Vanta Compliance]
        end
    end

    %% Data flow arrows with security annotations
    USERS -->|HTTPS/TLS 1.3| VEDGE
    USERS -->|Static Assets| CFEDGE
    VEDGE -->|Filtered Traffic| VCDN
    CFEDGE -->|Cached Assets| S34
    VCDN -->|Clean Traffic| VLB
    VLB -->|Internal HTTPS| LAMBDA
    LAMBDA -->|Secure API| FE1
    LAMBDA -->|Secure API| FE2
    LAMBDA -->|Secure API| FE3
    LAMBDA -->|Secure API| FE4
    
    FE2 -->|Auth Required| API1
    FE3 -->|Auth Required| API1
    FE2 -->|Auth Required| API2
    FE3 -->|Auth Required| API2
    FE2 -->|JWT Shared Secret| API3
    
    API1 -->|VPC Connection| DB1
    API1 -->|VPC Connection| DB2
    API1 -->|VPC Connection| DB3
    API3 -->|Read Connection| DB1
    API3 -->|Read/Write| DB4
    
    API1 -->|IAM Authenticated| S31
    API1 -->|Upload Handler| S33
    API1 -->|Log Shipping| S32
    
    API1 -->|API Keys| AI1
    API1 -->|API Keys| AI2
    API3 -->|API Keys| AI1
    API3 -->|API Keys| AI2
    API1 -->|OAuth 2.0| SAAS1
    API1 -->|API Keys| SAAS2
    API1 -->|API Keys| SAAS3
    API1 -->|API Keys| SAAS4
    
    GITHUB -->|Webhook| DEPLOY
    DEPLOY -->|CI/CD Pipeline| LAMBDA
    MONITOR -->|Metrics Collection| AUDIT

    %% Security annotations
    classDef publicZone fill:#ffcdd2
    classDef edgeZone fill:#fff3e0
    classDef appZone fill:#e8f5e8
    classDef dataZone fill:#e3f2fd
    classDef externalZone fill:#f3e5f5
    classDef mgmtZone fill:#fce4ec
    
    class USERS,BOTS,THREAT publicZone
    class VEDGE,VLB,VCDN,CFEDGE,CFCACHE edgeZone
    class FE1,FE2,FE3,FE4,API1,API2,API3 appZone
    class DB1,DB2,DB3,DB4,S31,S32,S33,S34 dataZone
    class AI1,AI2,AI3,SAAS1,SAAS2,SAAS3,SAAS4 externalZone
    class GITHUB,DEPLOY,MONITOR,ADMIN mgmtZone

3. Authentication and Access Control Flow

sequenceDiagram
    participant U as User (Candidate/HM)
    participant VE as Vercel Edge
    participant FE as Frontend App
    participant AUTH as Auth0
    participant API as API Services
    participant AGENT as Qwestly Agent
    participant DB as MongoDB Atlas
    participant LOG as Audit Logs

    Note over U,LOG: Multi-App Authentication Flow with Audit Trail

    U->>+VE: HTTPS Request
    VE->>VE: Edge Security Check
    VE->>+FE: Forward Request
    
    FE->>FE: Check Auth State
    alt Not Authenticated
        FE->>+AUTH: Redirect to Login
        AUTH->>AUTH: SSO/MFA Challenge
        AUTH->>-U: MFA Challenge
        U->>+AUTH: MFA Response
        AUTH->>AUTH: Validate Credentials
        AUTH->>+LOG: Log Auth Event
        AUTH->>-FE: Return JWT Token
    end
    
    FE->>+API: API Request + JWT
    API->>API: Validate JWT Signature
    API->>AUTH: Verify Token (if needed)
    AUTH->>API: Token Valid
    
    alt Candidate Agent Interaction
        FE->>+AGENT: Agent Request + JWT Shared Secret
        AGENT->>AGENT: Validate Shared Secret
        AGENT->>+DB: Read Candidate Data
        DB->>DB: Authorized Collection Access
        DB->>-AGENT: Return Data
        AGENT->>+API: Cross-Service API Call
        API->>AGENT: Response
        AGENT->>-FE: Agent Response
    end
    
    API->>+DB: Query with Context
    DB->>DB: Apply Access Controls
    DB->>-API: Return Authorized Data
    
    API->>+LOG: Log Data Access
    API->>-FE: Return Response
    FE->>-VE: Response
    VE->>-U: Final Response

    Note over U,LOG: All actions logged for audit compliance via LangSmith, PostHog, and S3 log archive

4. Data Flow and Storage Architecture

graph LR
    subgraph "Data Sources"
        USER[User Input]
        UPLOAD[File Uploads]
        FORMS[Form Data]
        API_DATA[API Responses]
        EMAIL[Email Events
SendGrid Webhook]
    end

    subgraph "Processing Layer"
        subgraph "Data Validation"
            VALIDATE[Input Validation]
            SANITIZE[Data Sanitization]
            ENCRYPT[Encryption]
        end
        
        subgraph "Business Logic"
            LOGIC[Application Logic
Next.js APIs]
            AI_PROC[AI Processing
OpenAI/DeepSeek]
            AGENT_PROC[Agent Orchestration
Pydantic AI]
            TRANSFORM[Data Transformation]
        end
    end

    subgraph "Storage Systems"
        subgraph "MongoDB Atlas (Primary - US-West-1)"
            MONGO_CAND[(Candidate Portal DB)]
            MONGO_HIRE[(Hire Platform DB)]
            MONGO_INTERNAL[(Internal Services DB)]
            MONGO_MEM[(Agent Memory DB)]
            MONGO_VECTOR[Atlas Vector Search
1536d Embeddings]
            MONGO_BACKUP[(Automated Backups
Point-in-Time Recovery)]
        end
        
        subgraph "AWS S3 (Object Storage - US-West-1)"
            S3_DOCS[S3 Document Storage]
            S3_LOGS[S3 Log Archive
90-day Retention]
            S3_BACKUP[S3 Data Backups]
            S3_UPLOADS[S3 User Uploads]
        end
        
        subgraph "AWS CloudFront"
            CF_DIST[CloudFront Distribution]
            CF_CACHE[Edge Cache]
        end
        
        subgraph "Supabase (Logging - US-West)"
            SUP_LOG[Auth & API Logs]
        end
    end

    subgraph "Data Protection Controls"
        subgraph "Encryption"
            ENC_TRANSIT[TLS 1.3 in Transit]
            ENC_REST[AES-256 at Rest]
            KEY_MGMT[Key Management]
        end
        
        subgraph "Access Controls"
            JWT[JWT Auth + Site Tokens]
            APIKEYS[Shared API Keys]
            IAM[AWS IAM Policies]
            MONGOACL[MongoDB Atlas ACLs]
        end
        
        subgraph "Compliance"
            AUDIT_TRAIL[Audit Trail]
            RETENTION[Data Retention]
            GDPR[GDPR Compliance]
            WEBSIG[Webhook HMAC Signatures]
        end
    end

    %% Data flow paths
    USER --> VALIDATE
    UPLOAD --> SANITIZE
    FORMS --> VALIDATE
    API_DATA --> ENCRYPT
    EMAIL --> VALIDATE
    
    VALIDATE --> LOGIC
    SANITIZE --> AI_PROC
    ENCRYPT --> TRANSFORM
    
    LOGIC --> MONGO_CAND
    LOGIC --> MONGO_HIRE
    AI_PROC --> MONGO_VECTOR
    AGENT_PROC --> MONGO_MEM
    AGENT_PROC --> MONGO_CAND
    TRANSFORM --> S3_DOCS
    UPLOAD --> S3_UPLOADS
    LOGIC --> SUP_LOG
    
    MONGO_CAND --> MONGO_VECTOR
    MONGO_CAND --> MONGO_BACKUP
    MONGO_HIRE --> MONGO_BACKUP
    
    S3_UPLOADS --> CF_DIST
    CF_DIST --> CF_CACHE
    
    S3_DOCS --> S3_BACKUP
    LOGIC --> S3_LOGS
    
    %% Security controls
    MONGO_CAND -.-> JWT
    MONGO_HIRE -.-> JWT
    MONGO_INTERNAL -.-> APIKEYS
    MONGO_MEM -.-> JWT
    S3_DOCS -.-> IAM
    S3_UPLOADS -.-> IAM
    
    MONGO_CAND -.-> ENC_REST
    MONGO_VECTOR -.-> MONGOACL
    S3_DOCS -.-> KEY_MGMT
    CF_DIST -.-> ENC_TRANSIT
    
    MONGO_CAND -.-> AUDIT_TRAIL
    S3_LOGS -.-> RETENTION
    S3_DOCS -.-> GDPR
    EMAIL -.-> WEBSIG

    %% Styling
    classDef dataSource fill:#e3f2fd
    classDef processing fill:#f3e5f5
    classDef storage fill:#e8f5e8
    classDef security fill:#ffebee
    classDef aws fill:#ff9800
    
    class USER,UPLOAD,FORMS,API_DATA,EMAIL dataSource
    class VALIDATE,SANITIZE,ENCRYPT,LOGIC,AI_PROC,AGENT_PROC,TRANSFORM processing
    class MONGO_CAND,MONGO_HIRE,MONGO_INTERNAL,MONGO_MEM,MONGO_VECTOR,S3_DOCS,SUP_LOG storage
    class JWT,APIKEYS,ENC_REST,ENC_TRANSIT,AUDIT_TRAIL,WEBSIG security
    class S3_UPLOADS,CF_DIST,CF_CACHE,IAM aws

5. CI/CD Security Pipeline Architecture

graph TB
    subgraph "Developer Environment"
        DEV[Developer Workstation]
        IDE[IDE/Code Editor]
        LOCAL[Local Testing]
    end

    subgraph "Source Control (GitHub)"
        REPO[Git Repositories
candidate, hire, api-python,
public-site, agent, monitoring]
        BRANCH[Feature Branch]
        PR[Pull Request]
        MAIN[Main Branch]
    end

    subgraph "CI/CD Pipeline (GitHub Actions)"
        subgraph "Security Gates"
            TRIVY[Trivy Vulnerability Scan]
            TRUFFLEHOG[TruffleHog Secret Scan]
            SARIF[SARIF Security Reports]
        end
        
        subgraph "Quality Gates"
            LINT[ESLint/Code Quality]
            TEST[Unit/Integration Tests
Vitest + Playwright]
            BUILD[Build Verification]
        end
        
        subgraph "Compliance Gates"
            SOC2[SOC2 Compliance Check]
            AUDIT[Audit Trail Generation]
            APPROVE[Required Approvals]
        end
    end

    subgraph "Deployment Environment (Vercel)"
        subgraph "Staging"
            PREVIEW[Preview Deployment
per-PR environments]
            STAGING_TEST[Staging Tests]
        end
        
        subgraph "Production"
            PROD_DEPLOY[Production Deployments
candidate, hire, api,
public-site, agent, monitoring]
            HEALTH[Health Checks]
            ROLLBACK[Rollback Capability]
        end
    end

    subgraph "Static Asset Pipeline (AWS)"
        S3_DEPLOY[S3 Asset Upload]
        CF_INVALIDATE[CloudFront Invalidation]
        ASSET_HEALTH[Asset Health Check]
    end

    subgraph "Log Shipping Pipeline (Daily)"
        LOG_COLLECT[Collect Auth/API Logs]
        LOG_TRANSFER[Transfer to S3]
        LOG_VERIFY[Verify Integrity]
    end

    subgraph "Monitoring & Security"
        MONITOR[PostHog Analytics]
        LSMITH[LangSmith Traces]
        ALERTS[Alert System]
        LOGS[S3 Log Archive]
    end

    %% Development flow
    DEV --> REPO
    IDE --> BRANCH
    LOCAL --> PR
    
    %% CI/CD triggers
    PR --> TRIVY
    PR --> TRUFFLEHOG
    PR --> LINT
    
    TRIVY --> SARIF
    TRUFFLEHOG --> SARIF
    LINT --> TEST
    TEST --> BUILD
    
    BUILD --> SOC2
    SOC2 --> AUDIT
    AUDIT --> APPROVE
    
    %% Deployment flow
    APPROVE --> PREVIEW
    PREVIEW --> STAGING_TEST
    
    MAIN --> PROD_DEPLOY
    MAIN --> S3_DEPLOY
    S3_DEPLOY --> CF_INVALIDATE
    CF_INVALIDATE --> ASSET_HEALTH
    
    PROD_DEPLOY --> HEALTH
    HEALTH --> MONITOR
    
    %% Log shipping
    PROD_DEPLOY --> LOG_COLLECT
    LOG_COLLECT --> LOG_TRANSFER
    LOG_TRANSFER --> LOG_VERIFY
    LOG_VERIFY --> LOGS
    
    %% Security monitoring
    PROD_DEPLOY --> LSMITH
    MONITOR --> ALERTS
    LSMITH --> ALERTS
    
    %% Emergency procedures
    ALERTS -.->|If Issues| ROLLBACK
    HEALTH -.->|Health Check Fail| ROLLBACK

    %% Styling
    classDef development fill:#e3f2fd
    classDef source fill:#f3e5f5
    classDef security fill:#ffebee
    classDef deployment fill:#e8f5e8
    classDef monitoring fill:#fff3e0
    classDef aws fill:#ff9800
    classDef logging fill:#e0f2f1
    
    class DEV,IDE,LOCAL development
    class REPO,BRANCH,PR,MAIN source
    class TRIVY,TRUFFLEHOG,SARIF,SOC2 security
    class PREVIEW,STAGING_TEST,PROD_DEPLOY,HEALTH deployment
    class MONITOR,LSMITH,ALERTS monitoring
    class S3_DEPLOY,CF_INVALIDATE,ASSET_HEALTH aws
    class LOG_COLLECT,LOG_TRANSFER,LOG_VERIFY,LOGS logging

Network Security Controls Summary

1. Boundary Definitions

  • Internet Boundary: Direct HTTPS connections to Vercel Edge Network and AWS CloudFront
  • Application Boundary: Vercel serverless infrastructure with built-in security; multiple isolated Next.js apps and Python services
  • Agent Boundary: Qwestly Agent orchestrator with JWT shared-secret auth from Candidate app
  • Data Boundary: Private VPC connections to MongoDB Atlas databases with encryption; multiple isolated databases per domain
  • Administrative Boundary: GitHub and CI/CD systems with MFA and RBAC
  • Asset Boundary: AWS CloudFront + S3 for user-uploaded content and browser extension assets

2. Network Devices and Security Controls

  • Vercel Edge Network: Global load balancing, DDoS protection, SSL termination, serverless compute
  • AWS CloudFront: Global CDN for static assets with edge caching and SSL/TLS
  • MongoDB Atlas: Database-level access controls, network IP allowlisting, built-in firewall, Atlas Vector Search
  • AWS S3: IAM-based access control, bucket policies, encryption at rest, signed URL access
  • GitHub Actions: Security scanning (Trivy, TruffleHog), secret detection, compliance validation

3. Network Zones

  • Public Zone: Internet-facing with direct HTTPS access
  • Edge Zone: Vercel edge infrastructure and AWS CloudFront
  • Application Zone: Serverless functions, Next.js applications, Agent orchestrator
  • Data Zone: Private MongoDB Atlas databases and AWS storage systems
  • External Service Zone: AI providers, Auth0, SendGrid, PostHog, LangSmith
  • Management Zone: CI/CD and administrative systems

4. Data Flow Security

  • Encrypted in Transit: TLS 1.3 for all external communications; TLS for internal service calls
  • Encrypted at Rest: AES-256 encryption for all stored data (MongoDB Atlas, AWS S3)
  • Authentication: Auth0 with MFA and Google Workspace SSO for user access
  • Authorization: JWT tokens with role-based access; shared API keys for cross-service auth; HMAC-signed webhook payloads
  • API Security: Rate limiting, input validation, secure headers, CORS/Referer gates

5. Critical System Inclusion

  • Primary Databases: MongoDB Atlas with multiple isolated databases (candidate_portal, qwestly_hire, qwestly_internal, user_memories)
  • Vector Search: Atlas Vector Search for RAG (knowledge base) and memory retrieval (1536d embeddings via OpenAI text-embedding-3-small)
  • Object Storage: AWS S3 with lifecycle management and CloudFront distribution
  • Agent Orchestration: Qwestly Agent (Pydantic AI) for multi-tool agentic workflows
  • AI Services: OpenAI gpt-5.4 (primary), DeepSeek v4-pro (secondary), Anthropic Claude (fallback)
  • LLM Observability: LangSmith for prompt management and trace debugging
  • Webhook Infrastructure: HMAC-signed delivery with retry and delivery history
  • Static Assets: CloudFront-distributed user uploads and application assets

6. Physical Locations

  • Primary Region: US-West-1 (N. California) for AWS services
  • Vercel Infrastructure: Global edge network with US primary
  • MongoDB Atlas: US-West-1 region deployment
  • Supabase: US-West region deployment (auth/API logs only)
  • Compliance: All data stored in US jurisdictions

7. Redundancy and Failover

  • Database Replication: MongoDB Atlas replica sets with automatic failover and point-in-time recovery
  • CDN Redundancy: Vercel global edge network and CloudFront edge locations
  • Application Redundancy: Serverless auto-scaling and load balancing via Vercel
  • Backup Systems: Automated daily MongoDB backups with point-in-time recovery; S3 log archive with 90-day retention
  • Asset Availability: CloudFront global edge caching for static content

8. Monitoring and Logging

  • Product Analytics: PostHog with 400+ event types, server-side and client-side tracking, feature flags, session recording
  • LLM Observability: LangSmith prompt management, trace debugging, versioned prompts
  • Application Monitoring: Vercel Analytics for web vitals and deployment insights
  • System Monitoring: Custom status dashboard at status.qwestly.com (CPU, memory, disk, log shipping status)
  • Audit Logging: Comprehensive audit trail for all system activities via S3 log archive
  • Log Shipping: Daily automated collection of auth/postgres/api logs via GitHub Actions to S3
  • Email Monitoring: SendGrid webhook events tracked in PostHog (delivery, opens, clicks, bounces)
  • Security Scanning: Trivy vulnerability scanning, TruffleHog secret detection in CI/CD pipeline

Compliance Alignment

This network architecture addresses the following SOC 2 Trust Service Criteria:

  • CC6.1 - Logical and physical access controls through multi-layered security
  • CC6.2 - System boundaries clearly defined with proper network segmentation
  • CC6.3 - Access control systems with Auth0, MFA, and RBAC implementation
  • CC6.7 - Data transmission security with end-to-end encryption
  • CC7.1 - System monitoring through comprehensive logging and alerting
  • CC7.2 - Security event detection via automated scanning and monitoring
  • A1.2 - Availability controls through redundancy and failover mechanisms

Document Prepared By: Dominick Pham, CTO
Review Date: July 20, 2026
Next Review: July 20, 2027
Classification: Internal Use - SOC2 Audit Evidence