How VAP ERP Works
Built with embedded systems discipline. Tested quarterly. Concrete architectural controls, zero hype, and verifiable operational benchmarks.
System Architecture
Requests flow through hardened layers of isolation and protection. Each layer is decoupled; if one fails, the others independently protect customer data.
Data Isolation: Three Hardened Layers
We safeguard customer records through multiple architectural barriers, not relying solely on application-level filtering.
Schema Isolation
Database-level tenant boundaries prevent cross-tenant data leaks by construction.
Row-Level Security
PostgreSQL RLS policies strictly enforce row access even during bulk reporting jobs.
Application Context
Cryptographically signed JWT sessions resolve verified tenant context on every call.
Request Lifecycle: Verified Benchmarks
Transparent response budgets measured under active production workloads.
| Component | Time (Warm) | Operational Responsibility |
|---|---|---|
| Cloudflare Edge | ~5ms | TLS 1.3 decrypt, rate limit enforcement, DDoS defense |
| Gateway & Auth | ~10ms | Cryptographic JWT verification, tenant context injection |
| Redis Session Cache | ~2ms | In-memory tenant configuration and entitlement lookup |
| Database Execution | ~20–50ms | Postgres query execution with isolated schema & RLS |
| Total Roundtrip (Warm) | 45–80ms (P95) | Complete client response budget delivered |
Container pool active, pre-warmed connection pools, 95% of everyday requests.
Occurs only when a microservice scales from zero after prolonged off-hours inactivity.
Reliability: Routine Verification
Disaster recovery and backup integrity are verified quarterly under real restore drills.
Operational Disciplines
- Daily automated transactional snapshots
- AES-256 encrypted cold storage archives
- Multi-region redundant snapshot mirroring
- Weekly automated hash and integrity verification
- Quarterly full disaster recovery drills
Measured Recovery Drill
Security: Four Pillars
Cryptographic security and supply chain controls protecting operations around the clock.
In Transit
- TLS 1.3 cryptographic cipher suites
- Cloudflare edge DDoS mitigation
- HSTS enforced across all tenant subdomains
- Authenticated internal mesh communication
At Rest
- AES-256 database-level encryption
- Encrypted cold storage backups
- GCP Secret Manager zero plaintext secrets
- Isolated filesystem partitions
Access Control
- Cryptographic JWT validation
- Mandatory MFA on privileged actions
- Granular Role-Based Access Control (RBAC)
- Immutable transaction audit logs
SOC 2 & Compliance
- SOC 2 Type II aligned controls
- 0 High-severity supply chain CVEs (SCA audited)
- Durable outbox event sourcing logs
- Quarterly third-party recovery validation
Ready to verify our architecture?
Explore our engineering documentation or discuss custom deployment requirements with our technical team.
Vaptechs Team · 14+ Years Systems Engineering · Built on embedded systems discipline.