Docs / Technical / Architecture

System Architecture & Security Posture

Detailed technical specifications of the Swot HR high-availability stack, containerized micro-services topology, zero-trust security perimeter, AES-256 data at rest encryption, and real-time WebSocket synchronization.

1. High-Level System Topology

Swot HR decouples the frontend client presentation from backend micro-services, ensuring high availability, independent scaling, and zero single points of failure.

docs.swotpam.com/architecture/topology

┌─────────────────────────────────────────────────────────────┐
│                 CLIENT LAYER (Web / Mobile)                 │
│              Next.js 16 + React 19 + TailwindCSS            │
└───────────────┬─────────────────────────────┬───────────────┘
                │ REST API (HTTPS)            │ WebSockets (WSS)
                ▼                             ▼
┌─────────────────────────────────────────────────────────────┐
│                API GATEWAY & BACKEND CLUSTER                │
│                 Express.js + TypeScript                     │
│  ├── JWT Authentication & RBAC Validation Engine            │
│  ├── Attendance Real-Time Processor                         │
│  ├── Automated Payroll Calculation Service                  │
│  └── AI Query Engine & Policy Semantic Embeddings          │
└───────────────┬─────────────────────────────┬───────────────┘
                │                             │
                ▼                             ▼
┌──────────────────────────────┐ ┌────────────────────────────┐
│      DATABASE CLUSTER        │ │       CACHE & BROKER       │
│  PostgreSQL 16 + Prisma ORM  │ │   Redis 7 (Session Store)  │
│  (AES-256 Data At Rest)      │ │   (Pub/Sub Broadcasts)     │
└──────────────────────────────┘ └────────────────────────────┘

2. Security & Zero-Trust Perimeter

All communications are secured via TLS 1.3 in transit. Sensitive fields including employee bank details, national IDs, and salary figures are encrypted using AES-256-GCM.

🔒

JWT + Refresh Rotation

Short-lived access tokens (15 mins) paired with strictly scoped, single-use refresh tokens stored in HttpOnly cookies.

🛡️

MFA & Rate Limiting

Enforced TOTP multi-factor authentication with IP-based rate limiting (100 req/min per IP).

📋

Immutable Audit Trail

Write-only append audit log pipeline preserving every employee state transition for SOC2 / ISO 27001 auditability.

3. Data Flow & Real-Time Events

Attendance punches and leave status changes are pushed immediately to all connected team dashboards using WebSocket pub/sub channels.

4. Persistence Layer (Prisma & PostgreSQL)

Structured schemas enforce relational integrity across organizations, departments, roles, shifts, leave balances, payroll runs, and audit logs.

← Admin Guide

Deployment & Sizing →