Architecture
How Brrainy works under the hood
A production stack - Postgres RLS, Neo4j graph, pgvector hybrid search, object storage, MCP agents, and five client surfaces.
The stack
Turborepo monorepo, Postgres RLS, Neo4j, pgvector, object storage, MCP, and five client surfaces - same stack in managed cloud or your VPC.
Architecture pillars
Space-scoped RLS
Space isolation at the database layer. Every query filtered by space_id with withSpaceContext and X-Space-Id.
Hybrid graph + vector
Neo4j entities plus pgvector embeddings per space. Hybrid search assembles context via memory-service and MCP assemble.
Object storage abstraction
Pluggable S3, R2, B2, or in-memory providers. Service callers never import cloud SDKs directly.
MCP / agent platform
vault_search, vault_capture_push, Cypher sandbox, and hybrid context bundles for Cursor, Claude, and partner agents.
Bundle SDK (WASM + dylib)
Desktop WASM and native dylib hosts; mobile WASM-only. Ed25519 signatures, capability gating, and idle budget enforcement.
Self-host
Self-host in one command
docker-compose.self-host.yml spins up Postgres, pgbouncer, Redis, Neo4j, and all services. Optional ntfy push profile. Storage and LLM providers are fully configurable knobs.
Run the self-host guideManaged cloud
- Instant signup - start in minutes
- We operate scaling & backups
- Premium AI briefs included
- Automatic updates
Self-hosted
- Full Docker stack on your VPC
- Air-gapped deployment supported
- Local LLM via Ollama plugin
- Same codebase as cloud
Security model
RBAC with five principal types, thirty permissions, and eight roles. Enterprise SAML, OIDC, SCIM 2.0, HRIS webhooks, and auditor access tokens. Immutable audit trails and GDPR data deletion.
- JWT + OTP + OAuth sign-in
- SAML / OIDC SSO for enterprise
- SCIM 2.0 user and group provisioning
- Auditor access tokens (read-only)
- Encryption at rest + hardening guide
- Anomaly alerts and security inbox
Deploy on your infrastructure
Full stack, your boundary - local LLM, RLS isolation, audit.