Solution Architect
Architecture that survives.
You design systems that last. Primebrick gives you a layered, modular architecture with clear boundaries, multi-cloud deployment, and compliance built into the build pipeline. No rewrites when you scale, no re-platforming when you change clouds, no audit panic when the regulator calls.
What changes for you
Layered architecture with clear boundaries
Presentation, API, Domain, Data, Infrastructure — each layer has a clear contract. Dependencies point inward. You can swap any layer without rewriting the others. The architecture is documented, enforced by the framework, and visible in the code structure.
Multi-cloud, multi-region, no rewrites
Deploy to Docker, Kubernetes, AWS (ECS/EKS), Azure Container Apps, GCP Cloud Run, or Alibaba Cloud ACK. The same codebase runs on a laptop, a single VPS, or a multi-region Kubernetes cluster. Move clouds without rewriting application code — change the deployment config, not the architecture.
Compliance from code to auditor
ISO 27001, NIS2, OWASP mappings are generated from scan data on every build. The reports include file:line evidence — not self-assessment. Hand the PDF to the auditor, point to the source. Reproducible, verifiable, always current.
Multi-tenancy without re-platforming
Logical and physical tenant isolation built into the data layer. Go from single-tenant to multi-tenant by changing a config, not by rewriting your entities. Per-tenant settings via ConfigTable. Data residency per tenant for multi-region deployments.
AI-native architecture
Private LLM container, pgvector for embeddings, agentic development GUI. The AI stack is part of the architecture, not a bolt-on. Your AI features run on your infrastructure, with no data sent to third-party APIs. Design for AI from day one.
Open architecture, open source
MIT-licensed, public ADRs, public code. Every architectural decision is documented and reversible. No black-box framework, no "trust us." You can read, modify, and fork every layer. The architecture is transparent by design.
Observability built in
OpenTelemetry traces, structured logs, health checks — all wired into the framework. A single trace ID follows a request from the browser through the API, the domain logic, and the database. No log stitching, no timestamp correlation across servers.
No vendor lock-in
MIT license, self-hostable, multi-cloud. You own the architecture, the code, and the deployment. No vendor can change pricing, deprecate a feature, or cut off access. Your architecture decisions are yours, not your vendor's.
Deployment matrix
Compliance from code to auditor
ISO 27001 · Annex A.5.15 — Access control Status: PASS Evidence: src/modules/customers/customer.entity.ts:14 @RBAC({ read: ['admin', 'sales'], write: ['admin'] }) NIS2 · Art. 21(2)(d) — Access control & management Status: PASS Evidence: src/modules/auth/rbac.guard.ts:8 MFA enforced on privileged roles OWASP · A01:2021 — Broken Access Control Status: PASS Evidence: src/sdk/permissions.check.ts:22 Every route guarded by RBAC decorator
Capabilities you'll use
We moved from a single VPS to multi-region Kubernetes without changing a line of application code. The compliance reports are a build artifact now — I forward them to the auditor without reading them.
Solution Architect FAQ
Can I customize the layer boundaries for my domain?
Yes. The framework's layer boundaries are the default, not a constraint. You can add layers (e.g., a dedicated integration layer for external APIs), split the domain layer into bounded contexts, or merge layers for simpler projects. The decorators and generators work regardless of how you organize the code.
How does multi-tenancy work at the data layer?
Primebrick supports both logical (shared database, tenant_id column) and physical (separate schema or database per tenant) isolation. The DAL handles tenant context automatically — you don't write tenant_id filters by hand. Per-tenant settings are stored in config_entries and rendered by ConfigTable.
How do I handle data residency requirements?
For multi-region deployments, Primebrick supports per-tenant region pinning. Each tenant's data stays in the region you specify (e.g., EU tenants in EU regions, US tenants in US regions). The Terraform templates include multi-region configurations with data residency rules.
What's the observability story?
OpenTelemetry is wired into every layer. Traces, metrics, and structured logs are emitted automatically. A single trace ID follows a request from the browser through the API, domain logic, and database. You can export to any OTLP-compatible backend (Jaeger, Tempo, Datadog, Honeycomb). Health checks are exposed on a standard endpoint.
How extensible is the compliance scanner?
The scanner ships with ISO 27001, NIS2, and OWASP mappings. You can add custom control catalogs — internal policies, industry-specific regulations, customer-specific requirements. Each control maps to file:line evidence in the source. The report format is extensible and can be customized for specific auditors.
Ready to design architecture that survives?
Read the architecture docs or get in touch — we'll walk you through the layers.