Architecture & DFD

Advanced Data Flow Diagram -- uploads, storage, underwriting, analytics, AI

System Architecture -- Layer View

Presentation Layer

Web Application

Next.js / React

SPA with SSR for SEO and performance

Dashboard

Recharts / D3

Real-time analytics and KPI visualization

AI Chat Interface

WebSocket / REST

Multi-provider AI conversation UI

API Layer

REST API Gateway

Node.js / Express

Rate-limited, authenticated endpoints

Excel Conversion API

Data Pipeline

Parse XLSX/CSV to structured JSON

AI Orchestration

Multi-Provider Router

OpenAI, Anthropic, Google routing

Data & Storage Layer

PostgreSQL

Primary Database

Deals, users, underwriting, permissions

Cloudflare R2

Object Storage

Documents, Excel files, media assets

Vector Store

Embeddings / RAG

Document embeddings for AI search

Security Layer

Auth & RBAC

JWT + Row-Level

Role-based access with row-level policies

Encryption

AES-256-GCM

At-rest and in-transit encryption

Audit Log

Event Tracking

Full audit trail for compliance

Data Flow Diagrams

Excel / PPT / PDF UploadData PipelineUser uploads financial model
1

File received via multipart upload API

2

Classification engine labels as public/private/internal

3

File encrypted with AES-256-GCM

4

Stored in Cloudflare R2 under /deals/[deal_id]/

5

Parser extracts structured data (income, expenses, debt)

6

Structured data written to PostgreSQL

7

Document embeddings generated for AI vector store

Underwriting RequestAnalysis EngineDeal underwriting calculation
1

API receives deal parameters (price, NOI, loan terms)

2

Rate-cap calculation: max(index + spread, strike + spread)

3

DSCR computed: NOI / annual debt service

4

Sensitivity matrix generated across rate/NOI scenarios

5

Exit analysis: projected NOI, exit valuation, IRR

6

Flag engine checks thresholds (DSCR < 1.2x, LTV > 75%)

7

Results cached and returned with confidence intervals

AI QueryRecommendation EngineAI-powered analysis pipeline
1

User query received with context (deal IDs, permissions)

2

Permission filter applied (only permitted data accessible)

3

Relevant documents retrieved from vector store (RAG)

4

Query + context sent to selected AI provider

5

Response parsed with explainability metadata

6

Source attribution linked to original documents

7

Usage tracked against per-user token cap

Database Schema (Core Tables)

deals
id (UUID PK)nametypepurchase_pricenoiloan_amountmarketstatuscreated_bycreated_at
underwriting_analyses
id (UUID PK)deal_id (FK)cap_ratedscrltvirrsensitivity_jsonflags_jsoncalculated_at
documents
id (UUID PK)deal_id (FK)storage_pathclassificationfile_typesize_bytesencryption_key_iduploaded_by
rate_caps
id (UUID PK)deal_id (FK)index_ratespreadstriketerm_yearseffective_dateexpiry_date
ai_interactions
id (UUID PK)user_id (FK)providermodelqueryresponsetokens_usedcost_usdcreated_at

Technology Stack

Frontend

Next.js 15React 19Tailwind CSSRechartsTypeScript

Backend

Node.jsExpress / HonoPostgreSQLPrisma ORMBull Queue

Cloud / Storage

Cloudflare R2AWS (fallback)Cloudflare WorkersRedis Cache

AI / ML

OpenAI APIAnthropic APIGoogle GeminiPinecone / pgvectorLangChain

Security

JWT AuthAES-256-GCMRBACRow-Level SecurityAudit Logging

DevOps

DockerGitHub ActionsTerraformSentryDatadog