1
Web application
Next.js 16 + TypeScript
Server-rendered interfaces and dashboards for operators, responders and administrators. Type safety end-to-end.
Technology
A serious platform, built incrementally.
ArchGuard is not built as a demonstration. It is built as infrastructure — with clear boundaries between the interface, the API and the data layer, and security controls designed in from the start.
This page describes the approach at a high level. Detailed infrastructure, network topology and integration specifications are shared with prospective customers and partners under appropriate agreements.
Stack
Four layers with clear responsibilities.
Each layer has a defined role. The frontend renders. The backend decides. The database persists. Integrations communicate — only through the API.
2
Backend API
Yii2 REST
Business logic, authentication, authorisation and permission enforcement. Chosen for its maturity and clarity.
3
Database
PostgreSQL
Relational storage for organisational records, incidents, users and audit logs. Supports row-level access policies.
4
Integration layer
Controlled connections
Authenticated, audited communication with approved external systems and device integrations. Nothing bypasses the API.
Engineering principles
How we build.
These are the rules we hold ourselves to as the platform grows. They are not aspirational — they are the standard we test against.
API-first, not UI-first
Every capability is designed as a backend concern first. The interface consumes the API. Hiding a button is never treated as a security control.
Explicit incident states
Incidents move through defined states with defined transitions. The backend enforces what is permitted at each stage and records who did what.
Tenant isolation at the data layer
Multi-organisation records are isolated in the backend — not just in the interface. Every request is validated against the authenticated user’s permitted scope.
Audit by default
Security-relevant actions are logged with actor, action, resource and timestamp. Sensitive data is excluded from logs.
Secrets are server-side, always
No credentials, tokens or keys ship to the browser. Public forms are validated, rate-limited, and spam-controlled on the server.
Honest status
Features are labelled as implemented, in development, planned or exploratory. The platform tells the truth about what it can do today.
Security posture
Security is a product requirement, not a feature.
The platform may hold residential information, incident reports, camera events and responder records. Security failures are not acceptable in this category of software.
The specific controls in any deployment are documented with the customer. Our work is designed in alignment with Uganda’s Data Protection and Privacy Act, 2019 framework and relevant international practice.
- HTTPS enforced in production, with strict TLS configuration
- Token-based authentication with short-lived access tokens
- Role-based access control enforced at the API, not just the UI
- Multi-tenant data isolation validated through cross-tenant testing
- Rate limiting on authentication, forms, public endpoints and expensive queries
- Server-side input validation on every request
- Audit logging for security and operational actions
- Encryption in transit and at rest, with controlled key management
- Backup, restore testing and disaster recovery procedures
- Dependency scanning and pre-release penetration testing
What we're exploring
What comes next — and what does not.
We are deliberate about which capabilities we explore. Some of these will become features. Others will not. Every one of them is subject to legal, operational and ethical review before deployment.
AI-assisted event classification
PlannedAssist operators by classifying incoming events from cameras and sensors — with human review retained for anything consequential. We are not building autonomous decision-making.
Drone-assisted assessment
ExploratoryRemote visual assessment of incidents before ground personnel arrive, where it is safe, lawful and operationally useful. Subject to Ugandan aviation rules and approvals.
Medical and ambulance coordination
PlannedStructured workflows connecting authorised emergency requests to licensed medical and ambulance providers, under service agreements. Not a replacement for emergency services.
Advanced analytics
ExploratoryCross-site operational reporting, incident pattern detection and resource optimisation — after the core workflows are proven with real customers.
Technical review?
If you are assessing ArchGuard for procurement, integration or partnership, we can arrange a technical discussion under appropriate confidentiality.