System Architecture & Cloud Mesh

Engineered for Zero-Trust Programmable Resilience

Consolidated edge ingress, automated TLS termination, pre-warmed serverless execution, CRIU microVMs, managed PostgreSQL, and Agent MCP in a unified sovereign mesh.

System Architecture

Unified Cloud Ingress & Runtime Mesh

One sovereign wildcard endpoint serving client traffic, AI agent sessions, serverless compute, microVM containers, maps, and managed PostgreSQL.

1. Client & Agent Ingress

Unified entry points for mobile apps, web clients, AI coding agents, and external database drivers.

Web & Mobile Apps (Flutter/React)HTTPS
AI Agents (Cursor / Claude MCP)MCP
PostgreSQL Clients (Prisma / psql)TLS 5433
SDK / HTTP File ClientsStorage REST
Direct ingress over https://<project>.pgbhub.app
2. Sovereign Cloud Gateway

Internal proxy routing requests to the appropriate subsystem with zero public internet latency.

Edge TLS TerminationAuto
Automated Wildcard SSL + HSTS
Adaptive Threat Watchdog0-Trust
Brute-force & DDoS Protection
Internal service routingPrivate
Isolated internal service mesh
Zero-latency intra-cluster communication
3. Runtime & Storage Core

Dedicated compute runtimes and state engines provisioned per project.

Managed PostgreSQLJSONB + PostGIS
Serverless FunctionsPre-Warmed Runtimes
CRIU MicroVM ContainersScale-to-Zero
PGB Maps & RoutingVector Tiles
Scheduled S3 backup vault

Detailed Layer-by-Layer Architecture

Each subsystem is isolated in minimal container environments designed for high throughput, private internal routing, and a minimal attack surface.

LAYER 01Managed Ingress (*.pgbhub.app)

Global Edge Gateway & Wildcard TLS Termination

Direct entry point for web clients, mobile apps, serverless functions, and AI agent sessions. Every project receives a dedicated wildcard domain with automated TLS termination, HSTS, and CORS routing.

Guarantees & Specs
  • TLS termination with automatically issued certificates
  • Internal reverse proxy routing to compute, database, and container runtimes
  • Prevents man-in-the-middle exploits across untrusted public client networks
LAYER 02Zero-Trust Security Layer

Intrusion Defense & Adaptive Threat Watchdog

Continuous real-time analysis of connection logs. Remote IP addresses exhibiting repeated failed password attempts, anomalous query patterns, or port scanning are instantly quarantined at the kernel firewall level.

Guarantees & Specs
  • Pre-configured jail with maxretry=5 and progressive exponential ban times
  • Protects public database ports (5433), HTTP gateway, and control plane
  • Zero latency impact on legitimate verified client queries
LAYER 03Compute & Execution Engine

Serverless Compute & CRIU MicroVM Containers

Pre-warmed V8 and Python runtimes execute modular functions with fast start times, while microVM containers run full Docker OCI workloads with resource-quota isolation and memory-snapshot technology that freezes idle workloads to 0 RAM.

Guarantees & Specs
  • Fast function start times, triggered by HTTP, webhooks, or cron
  • Idle containers automatically freeze to zero RAM, with fast wake-up from snapshot
  • Configurable active schedules (e.g. business hours always-on)
LAYER 04Storage Core (TLS Port 5433 + Internal Mesh)

Managed PostgreSQL Core, PostGIS & pgvector

Managed PostgreSQL engine with GIN path indexing for schema-free JSON collections, PostGIS spatial suite, and pgvector embeddings. 100% compliant with the official PostgreSQL wire protocol.

Guarantees & Specs
  • JSONB queries backed by automated GIN path indexes
  • Built-in PostGIS for geofencing, distance sorting, and polygon spatial joins
  • Integrated pgvector extension for LLM embeddings and AI semantic search
LAYER 05Geospatial Ingress (/maps/*)

Cloud-Hosted PGB Maps & Navigation Gateway

A cloud-hosted geospatial gateway serving dark & street vector map tiles, Search Box autocomplete, reverse geocoding, and traffic-aware turn-by-turn routing at a fraction of traditional map costs.

Guarantees & Specs
  • Standard vector map tile delivery compatible with Flutter Map, Leaflet, and modern map engines
  • Tile delivery cached via edge reverse proxies
  • High-performance turn-by-turn driving and walking routing with traffic congestion annotations
LAYER 06Platform Services (/auth, /storage, /mail)

Built-In Auth, Object Storage & Transactional Mail

Complete platform services without external SaaS markups: 6-digit OTP auth with automated PostgreSQL RLS claim injection, partitioned object buckets (backed by S3-compatible storage) with 15-minute presigned upload URLs, and high-deliverability transactional mail with automated reputation tracking.

Guarantees & Specs
  • Passwordless OTP, magic links, JWTs, and automated RLS session injection
  • 15-minute presigned S3 URLs for high-speed direct client uploads
  • Automated webhook sync with bounce/complaint handling and reputation tracking
LAYER 07AI Tooling & Resilience

Agent-Native Model Context Protocol (MCP) & Durability Vault

Direct bridge connecting Cursor IDE, Claude Desktop, and autonomous AI agents to live schemas and backend APIs via MCP, backed by scheduled database snapshots stored in S3-compatible object storage.

Guarantees & Specs
  • Native MCP server exposing live schemas and safe parameterized query execution
  • Scheduled database snapshots stored in S3-compatible object storage
  • 1-click snapshot restore directly from the visual cloud console
Compliance & Hardening

PGB Hub Security Standard

PostgreSQL Core · PostgreSQL Core
Cryptographic Standards

TLS encryption in transit with industry-standard cipher suites. Internal role credentials generated with high-entropy cryptographic keys.

Access Control & Row-Level Security

Row-level security (RLS) scoping automatically injected into PostgreSQL connection sessions. No customer-facing superuser access.

Backups & Restore

Scheduled compressed SQL dumps, uploaded to S3-compatible object storage, with restore from any saved snapshot.

Build AI-Native Applications Today

Ready to build on a truly programmable cloud?

Provision databases, serverless compute, microVM containers, realtime channels, auth, storage, and agent MCP tooling under one unified sovereign endpoint.

No Credit Card Required
Sovereign Cloud Services
Managed Edge Ingress