Docs
Architecture
Tech stack, real-time data, security, hosting, and scalability.
This page is for technical evaluators who want to understand what the product is built on and how it handles data, security, and scale.
Tech Stack#
| Layer | Technology |
|---|---|
| Backend and Database | A serverless backend with a built-in database, real-time subscriptions, file storage, search indexes, and scheduled functions |
| Frontend | Next.js (App Router) with React and TypeScript |
| UI Framework | shadcn/ui + Radix Primitives + Tailwind CSS |
| Authentication | Built-in (OAuth2, JWT, session management) |
| Permissions | Role-based access control with frontend and backend enforcement |
| Email Templates | React Email |
| Frontend Hosting | Your host of choice |
| CI/CD | GitHub Actions |
| Testing | Vitest (unit) + Playwright (E2E) |
Real-Time Architecture#
Acme Toolkit is real-time by default. Every data query in the application is a live subscription. When data changes on the backend, every connected client viewing that data receives the update automatically.
This is not achieved through manual polling or cache invalidation. The backend provides automatic reactivity at the database layer: when a write happens, any query that reads the affected data re-executes and pushes the new result to all subscribed clients. There is no refresh button and no stale data.
Security#
Authentication#
- Built-in authentication with OAuth2 sign-in and signed session tokens
- Session management with token refresh and revocation
- Optional two-factor authentication that can be enforced as a site-wide policy
Authorization#
- Role-based access control with system roles and support for custom roles
- A permission matrix with per-action scope control (view, create, update, delete)
- Backend enforcement on every write - all operations are permission-checked before execution
- Frontend enforcement for UI visibility, so users only see what they can act on
Data Security#
- Industry-standard encryption (AES-256) for tokens and sensitive credentials stored in the database
- Runtime schema validation on every backend operation
- HTML sanitization on all user-generated content to prevent XSS
Webhook Security#
- Cryptographic signature verification on inbound webhooks from third-party providers
- Signed payloads for outbound custom webhooks
Audit Logging#
- Significant actions are recorded in an audit trail with action type, entity, user, timestamp, and a diff of changes
- A filterable audit log UI and export capability for compliance
Rate Limiting#
- Per-token rate limiting on public mutations
- Configurable send caps and webhook deduplication to prevent double-processing on provider retries
Scalability#
The product is built on a serverless platform that handles scaling automatically. There are no servers to provision and no database connections to pool.
- Compute scales automatically based on load
- Database scales with usage, with no connection limits or manual sharding
- File storage is built in, with no separate object storage to manage
- Scheduled functions run reliably without a separate job queue
- Real-time subscriptions scale with the number of connected clients
Hosting and Deployment#
| Component | Host | Details |
|---|---|---|
| Frontend | Your host of choice | Automatic deployments from GitHub, edge CDN, preview deployments for branches |
| Backend | Managed platform | Automatic deployments, zero-downtime migrations, built-in monitoring |
| CI/CD | GitHub Actions | Automated testing, type checking, and deployment pipelines |
The managed path is the default and the fastest way to go live, but it is not a lock-in. Because you receive the source, advanced users can self-host every layer on their own servers. You own and control the source for both halves of the stack.
Data Retention#
The product enforces automatic data retention policies to keep storage clean and support compliance:
- Deleted records (trash) are held for a recovery window, then permanently removed
- Audit logs are retained for a fixed compliance window
- Webhook delivery and event-processing records are cleaned up automatically on a rolling schedule
Active data is kept indefinitely. Per-record data erasure is available on demand for compliance with data protection requests.