# Alegor Platform (alegor.io)

> A modular application platform used as the technical foundation for custom business systems and tailored software solutions. Build what makes the business unique. Reuse what shouldn't be rebuilt.

## Brand Architecture
- **Alegor Platform (alegor.io)**: The technology and architecture. Modular platform foundation used for custom business systems.
- **Alegor App (alegor.app)**: The ready-to-use SaaS product.
- **AlegorTech (alegor.tech)**: The company that builds custom software and tailored implementations.

## Delivery Model
Alegor currently serves as the technical foundation for custom software development and tailored implementations delivered by AlegorTech. A public developer ecosystem including public APIs, documentation, SDKs, and module tooling is planned as a roadmap direction for 2027.

## Core Platform Concepts
A modular application platform provides pre-built, composable technical infrastructure (identity, permissions, workflows, audit logs, documents, APIs, integrations) so engineering teams building serious business systems start at the domain layer rather than reinventing commodity infrastructure.

## Platform Modules
### Identity & Tenancy (https://alegor.io/modules/identity)
- Tagline: Multi-tenant identity boundaries, user lifecycle, and authentication.
- Summary: Provides unified authentication, user and organization hierarchy, session handling, MFA support, and token management designed for isolated multi-tenant and single-tenant environments.
- Capabilities: Multi-tenant and organization workspace isolation, Passwordless, email magic link, and credential authentication, OAuth2 / OIDC and enterprise SSO federation hooks, Multi-Factor Authentication (TOTP / Hardware WebAuthn), API Token issuance with granular scope and IP restrictions, Session revocation and cross-device session tracking
- Interfaces: IdentityManagerInterface, TenantResolverInterface, TokenIssuerInterface, OrganizationRepositoryInterface
- Emitted Events: TenantCreated, UserAuthenticated, UserPasswordResetRequested, SessionTerminated, OrganizationMemberInvited

### Permissions & Authorization (https://alegor.io/modules/permissions)
- Tagline: Hierarchical RBAC, contextual ABAC, and explicit resource policies.
- Summary: Fine-grained, audit-ready authorization engine combining role-based access control with attribute-based dynamic policy evaluation across tenants and resources.
- Capabilities: Role-Based Access Control (RBAC) with customizable tenant roles, Attribute-Based Access Control (ABAC) for contextual evaluations, Explicit capability matrix for UI components and API endpoints, Inherited role hierarchies (e.g. Owner > Admin > Member > Viewer), Fast in-memory and Redis permission caching with instant invalidation, Dry-run permission simulation for administrative troubleshooting
- Interfaces: AuthorizationEngineInterface, PolicyEvaluatorInterface, RoleManagerInterface, PermissionRegistrarInterface
- Emitted Events: RoleCreatedOrUpdated, PermissionGrantedToRole, UserRoleAssigned, PolicyEvaluatedWithDenial

### Documents & Storage (https://alegor.io/modules/documents)
- Tagline: S3-compatible asset pipeline, metadata indexing, and access-controlled streaming.
- Summary: Comprehensive document processing engine handling secure uploads, chunked streaming, background OCR/conversion, virus scanning pipelines, and signed URL generation.
- Capabilities: Direct-to-S3 signed URL uploads with checksum validation, Tenant-scoped storage drivers and encryption at rest, Asynchronous processing pipeline (PDF rendering, resizing, text extraction), Document versioning, soft deletion, and retention policy enforcement, Content-type verification and anti-malware scan hooks, Time-limited ephemeral download links with rate limiting
- Interfaces: DocumentStorageInterface, DocumentProcessorInterface, SignedUrlGeneratorInterface, DocumentValidatorInterface
- Emitted Events: DocumentUploaded, DocumentProcessed, DocumentVersionCreated, DocumentDeleted, MaliciousContentDetected

### Audit & Compliance Logging (https://alegor.io/modules/audit)
- Tagline: Append-only immutable event streams for compliance and forensic analysis.
- Summary: Enterprise-grade audit logger recording who changed what, when, and why, complete with before/after state diffs, user agent fingerprints, and tamper-evident signatures.
- Capabilities: Automatic Eloquent model mutation tracking (before/after diffs), Contextual metadata enrichment (IP, User Agent, Tenant ID, Request ID), Asynchronous high-throughput queue ingestion to avoid request lag, Cryptographic record hashing for tamper verification, Structured query builder for compliance exports and investigation, Configurable retention rules and automated cold storage archiving
- Interfaces: AuditLoggerInterface, AuditRecordRepositoryInterface, DiffGeneratorInterface, AuditExporterInterface
- Emitted Events: AuditEventLogged, AuditLogArchived, IntegrityVerificationFailed

### Workflows & State Machines (https://alegor.io/modules/workflows)
- Tagline: Deterministic state machine engine with visual transitions and guard conditions.
- Summary: Declarative state machine and multi-step workflow orchestrator for business processes, approvals, transitions, and automated compensation actions.
- Capabilities: Declarative state machine configurations with explicit transitions, Guards and condition predicates for authorized state changes, Multi-approver hierarchies with escalation timeouts, Saga orchestrator for distributed multi-step transactions, Scheduled execution and asynchronous step retries, State transition visualizer and audit history
- Interfaces: StateMachineFactoryInterface, TransitionGuardInterface, WorkflowEngineInterface, SagaCoordinatorInterface
- Emitted Events: StateTransitionPreChecked, StateTransitionCompleted, WorkflowStepFailed, CompensationTriggered

### Notifications & Messaging (https://alegor.io/modules/notifications)
- Tagline: Omni-channel delivery engine across Email, SMS, Webhooks, Push, and In-App.
- Summary: Unified notification dispatcher featuring tenant-configurable templates, per-user delivery preferences, batching, rate limiting, and delivery status tracking.
- Capabilities: Multi-channel routing (Transactional Email, SMS, Webhooks, Push, In-App bell), Tenant and user preference matrix (channels, quiet hours, digest frequency), Template engine supporting Markdown, HTML, and localized variables, Asynchronous queue-based sending with automatic backoff retries, Real-time In-App notification broadcast via WebSockets / SSE, Delivery status webhooks and open/click tracking infrastructure
- Interfaces: NotificationDispatcherInterface, ChannelAdapterInterface, TemplateRendererInterface, PreferenceManagerInterface
- Emitted Events: NotificationDispatched, NotificationDelivered, NotificationFailed, NotificationRead

### Integrations & Webhooks (https://alegor.io/modules/integrations)
- Tagline: Bi-directional webhook engine, REST API gateway, and external sync pipeline.
- Summary: Comprehensive integration gateway supporting signed outbound webhooks, inbound webhook verification, OAuth client credentials, rate limiting, and dead-letter queue recovery.
- Capabilities: Outbound webhook dispatch with HMAC-SHA256 signature verification, Configurable retry backoffs (exponential backoff with jitter), Inbound webhook signature validator and replay attack protection, Dead Letter Queue (DLQ) with manual inspection and replay controls, Rate limiting and token bucket throttling per external endpoint, Payload transformation and schema mapping pipelines
- Interfaces: WebhookDispatcherInterface, WebhookValidatorInterface, DeadLetterQueueManagerInterface, ExternalSyncEngineInterface
- Emitted Events: WebhookSent, WebhookDelivered, WebhookFailedPermanent, InboundWebhookReceived

### Reporting & Aggregation (https://alegor.io/modules/reporting)
- Tagline: High-performance analytical queries, export queues, and scheduled summaries.
- Summary: Analytical querying engine optimized for multi-tenant data summaries, large CSV/Excel/PDF export jobs, and recurring executive report generation.
- Capabilities: Multi-tenant analytical aggregations and metrics queries, Streaming large datasets to CSV, XLSX, and formatted PDF without memory spikes, Asynchronous export queue with downloadable signed URLs upon completion, Scheduled report generation with automated email/Slack delivery, Read replica query routing to protect primary transactional database, Configurable date dimension aggregation (hourly, daily, weekly, monthly)
- Interfaces: ReportGeneratorInterface, ExportStreamerInterface, AnalyticsQueryBuilderInterface, ScheduledReportManagerInterface
- Emitted Events: ReportRequested, ExportCompleted, ScheduledReportDispatched


## Technical Articles & Architecture Guides
### What Makes Software Business-Critical?
- URL: https://alegor.io/articles/business-critical-software
- Category: Engineering
- Summary: Defining business-critical software: high operational stakes, zero data-loss tolerance, audit compliance, and engineering resilience.

### Designing Software That Can Evolve for Ten Years
- URL: https://alegor.io/articles/software-architecture-long-term
- Category: Engineering
- Summary: Architectural disciplines for building software that survives team turnover, framework upgrades, scaling inflections, and business pivot cycles.

### Technical Debt Starts Before the First Line of Code
- URL: https://alegor.io/articles/technical-debt-system-architecture
- Category: Engineering
- Summary: How early architectural decisions—data models, coupling, unstandardized infrastructure, and missing boundaries—accumulate technical debt before implementation begins.

### Build vs Buy vs Platform: Choosing How to Build Business Software
- URL: https://alegor.io/articles/build-vs-buy-vs-platform
- Category: Engineering
- Summary: A strategic evaluation framework for CTOs and CIOs: when to purchase off-the-shelf SaaS, when to build purely custom, and when to adopt a platform foundation.

### How to Design Reliable Integrations Between Business Systems
- URL: https://alegor.io/articles/reliable-system-integrations
- Category: Integration
- Summary: A defensive engineering guide to integrating business systems: idempotency keys, circuit breakers, outbox patterns, and error recovery.

### Webhooks vs Polling vs Event-Driven Integrations
- URL: https://alegor.io/articles/webhooks-polling-events
- Category: Integration
- Summary: A comprehensive technical comparison of data synchronization patterns: HTTP polling, outbound webhooks, and real-time event streaming architectures.

### API-First Architecture for Business Systems
- URL: https://alegor.io/articles/api-first-business-systems
- Category: Integration
- Summary: Why designing clean, versioned APIs before user interfaces enables headless integrations, third-party ecosystems, and multi-client longevity.

### Why Audit Logs Matter in Business-Critical Software
- URL: https://alegor.io/articles/audit-logs-business-software
- Category: Permissions & Security
- Summary: Designing immutable, tamper-evident audit logs: data schemas, asynchronous ingestion, forensic accountability, and compliance architecture.

### RBAC vs ABAC: Which Authorization Model Should You Use?
- URL: https://alegor.io/articles/rbac-vs-abac
- Category: Permissions & Security
- Summary: A technical comparison of Role-Based Access Control and Attribute-Based Access Control, detailing when static roles fail and how hybrid architectures succeed.

### RBAC Explained: Designing Permissions for Complex Business Systems
- URL: https://alegor.io/articles/rbac-permissions-business-systems
- Category: Permissions & Security
- Summary: A definitive guide to implementing scalable Role-Based Access Control (RBAC): hierarchy trees, scoping, caching strategies, and common anti-patterns.

### Designing SaaS for Enterprise Customers
- URL: https://alegor.io/articles/enterprise-saas-architecture
- Category: SaaS Architecture
- Summary: Why enterprise SaaS buyers require advanced security, SAML SSO, granular RBAC, immutable audit logging, SIEM exports, and contractual data boundaries.

### Single-Tenant vs Multi-Tenant Architecture
- URL: https://alegor.io/articles/single-tenant-vs-multi-tenant
- Category: SaaS Architecture
- Summary: A comprehensive technical comparison between dedicated single-tenant and pooled multi-tenant deployment architectures for software platforms.

### Multi-Tenant SaaS Architecture Explained
- URL: https://alegor.io/articles/multi-tenant-saas-architecture
- Category: SaaS Architecture
- Summary: A comprehensive guide to multi-tenant software architecture: data isolation models, tenant resolution, cross-tenant leak prevention, and operational scaling.

### When Should You Split a System Into Microservices?
- URL: https://alegor.io/articles/when-to-use-microservices
- Category: Architecture
- Summary: A practical, objective decision framework for engineering managers and architects contemplating breaking apart a monolithic core.

### Modular Monolith vs Microservices
- URL: https://alegor.io/articles/modular-monolith-vs-microservices
- Category: Architecture
- Summary: A balanced, pragmatic technical evaluation of modular monolithic architecture versus distributed microservices for business software engineering.

### Architecture of a Modern Business-Critical Application
- URL: https://alegor.io/articles/business-critical-application-architecture
- Category: Architecture
- Summary: A deep dive into multi-tier software architecture for systems where downtime, data loss, or security failures carry immediate operational consequences.

### Why Business Software Shouldn't Start From Zero
- URL: https://alegor.io/articles/why-business-software-should-not-start-from-zero
- Category: Architecture
- Summary: Examining the high financial and opportunity cost of repeatedly reinventing commodity infrastructure in bespoke enterprise software projects.

### What Is a Modular Application Platform?
- URL: https://alegor.io/articles/modular-application-platform
- Category: Architecture
- Summary: A comprehensive architectural guide to modular application platforms, contrasting them with full-stack frameworks, multi-tenant SaaS products, and low-code builders.