Agent graph with state
Routing, extraction, clarification, conversation and tool execution are separate nodes over shared state. An ambiguous request is sent back for clarification rather than guessed at.
Technology
One engine. Configured per product.
Nothing here was chosen to look impressive on a slide. Every part earns its place by doing a job the others cannot. The same orchestration layer and the same control layer sit behind each product — what differs is the tools an agent may call, the knowledge it retrieves, and the rules it answers to.
01
The agent layer
A graph, not a prompt. Each node does one job and runs on the model that fits that job, so cost, speed and accuracy are decided per step instead of once for everything.
Long-term, per user
Preferences, facts, summaries and episodes persist across sessions, isolated per user and per organization. Nothing is shared between customers, and no shared model is trained on their data — what accumulates is a dataset belonging to that one organization.
Answers with a source
Vector search over indexed documentation, with the source attached to the answer. Where the material does not cover a question, the agent says so instead of inventing a reply.
Speech to speech
Voice is a channel, not a separate product. It reaches the same tools and the same control layer as text, so an operation performed by voice is governed identically.
Documents into structure
Incoming files become structured data with confidence values and provenance, so a fact taken from a document can be traced back to where it was found.
Guards on the boundary
Content filtering, denied topics, personal-data detection and prompt-attack prevention sit on the model boundary, independent of what any individual prompt asks for.
02
The control layer
The part that makes an acting agent acceptable inside a business. It is deterministic code, not a model: a model may propose, but it never decides what is permitted.
A decision, then a record
For each operation the layer gathers the facts, classifies the risk and decides: proceed, notify, ask a person, or refuse. The intent and the reasoning are written to immutable storage before anything happens — so a refused or interrupted attempt is documented too.
Independent reconciliation
A separate process compares what was recorded against what actually changed in the system and flags disagreement. Verification never relies on the component that performed the work.
Consent that is provable
A risky operation stops and shows what is about to happen: the amount in words, the document, the reason. Consent is bound to those exact facts — if the facts move, the approval no longer holds.
Rules outside the code path
Authorization rules live in a policy engine instead of being scattered through application logic, so what is allowed can be read, reviewed and changed without redeploying a product.
03
Built with
Grouped by the job it does in our system, not by vendor. Hover a logo to bring it forward.
Agent and controlthe layer that reasons and the layer that decides
LangGraph
Amazon Bedrock
Anthropic Claude
Python
Serverless compute
Data and evidencewhere facts, records and knowledge live
Operational store
Immutable records
DNS and domain routing
Identity
Product surfacewhat a customer actually touches
Next.js
React
TypeScript
Tailwind CSS
Headless UI
Stripe
Deliveryhow it is built, tested and shipped
Infrastructure as code
Source control
Linux
Cloud workstation
Kiro
Observability
04
How we build
Four rules that survive contact with a real codebase. They are the reason one very small team can hold this much surface without it collapsing.
Single source of truth
One definition, one place to change it. A component, a color or a price exists once; every surface reads from it. Duplicates are how systems drift apart quietly, and quiet drift is the expensive kind.
Layers with strict boundaries
Application, widgets, features, entities, shared — and imports only ever go downward. A structure that refuses shortcuts is a structure that still makes sense a year later.
Infrastructure as tested code
Nothing is created by clicking in a console. Infrastructure is written, reviewed, validated against policy rules, then applied — so an environment is rebuilt rather than remembered.
Property-based testing
Beyond example cases, we state properties that must always hold and let the machine hunt for counter-examples. It finds the edge cases a person would not think to write down.
05
Programs
Membership we hold, stated plainly.
Programme member
Approved member of the NVIDIA Inception program. It gives access to the NVIDIA AI ecosystem — inference microservices, technical resources and training. This is the one badge on this site we were handed to display, and the only programme shown here as a badge rather than as a name.
NVIDIA Inception
Every other logo on this page marks a technology we build with, not a partnership or an endorsement. Where a provider holds certifications such as SOC 2 or ISO 27001, those belong to that provider; when we describe controls of our own, we are describing what our software does.
Git logo by Jason Long, used under the Creative Commons Attribution 3.0 Unported licence; the wordmark was removed so the mark reads at small size.
Cloudflare, the Cloudflare logo, and Cloudflare Workers are trademarks and/or registered trademarks of Cloudflare, Inc. in the United States and other jurisdictions. Datadog is a trademark of Datadog, Inc. NVIDIA and NVIDIA Inception are trademarks of NVIDIA Corporation. Amazon Web Services, AWS and the AWS logos are trademarks of Amazon.com, Inc. or its affiliates. None of these companies endorses or sponsors our products.
06
Questions about the engine
The ones a technical reader asks first, answered without a call.
- Which model runs this?
- More than one. A model is chosen per node of the graph, and replacing one does not touch the graph, because the engine is a program with state rather than a prompt.
- What stops the model from doing something it should not?
- Deterministic code, not another model. The model proposes; code decides on anything that moves money, grants access, deletes data or cannot be undone. A model can be talked into an exception, and code cannot.
- What exactly is recorded, and when?
- The intent, the grounds it rested on and the decision, written before the action rather than reconstructed after it. Records are immutable and are reconciled by a separate process, so a refusal is as traceable as an approval.
- Can this run outside Amazon Web Services?
- Yes. The orchestration layer deploys as a managed runtime on more than one provider and the infrastructure is defined as code, so the stack is reproducible. Primary infrastructure runs on Amazon Web Services in the United States today.
- Do you train on customer data?
- No shared or general-purpose model is trained on it. Data is isolated per organization, and what accumulates is a dataset that stays with the customer.