> ## Documentation Index
> Fetch the complete documentation index at: https://docs.kowalah.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Platform architecture and hosting

> What the Kowalah platform is built on, where your data is stored, and how the customer application is separated from Kowalah's internal systems.

This page answers the two questions an IT team asks first about any SaaS platform: **what is it built on, and where does our data live?**

## What Kowalah is

**Kowalah is a full software platform with its own application, database, and infrastructure.** Anthropic's Claude is the AI *model* used for the platform's AI features — one component (one [subprocessor](/security/subprocessors)) among several, not the platform's backend. Your programme data lives in Kowalah's own database.

## What the platform is built on

Kowalah runs on a small set of established, managed cloud providers. Each handles a specific, limited part of the service.

| Layer                   | Provider                          | What it does                                                                                       |
| ----------------------- | --------------------------------- | -------------------------------------------------------------------------------------------------- |
| **Application**         | Next.js on **Vercel**             | The customer application at `app.kowalah.com` and its APIs                                         |
| **Database**            | **Supabase** (managed PostgreSQL) | Stores your Kowalah programme data — projects, deliverables, opportunities, Expert Requests, tasks |
| **Authentication**      | **Clerk**                         | Verifies who each user is; no anonymous access                                                     |
| **AI model**            | **Anthropic** (Claude)            | Powers AI features such as AI Chat and analysis                                                    |
| **Search / embeddings** | **OpenAI**                        | Generates embeddings so accelerators and prompts are searchable                                    |
| **File storage**        | **Supabase Storage**              | Holds files you upload (for example, Expert Request attachments)                                   |
| **Session cache**       | **Upstash** (Redis)               | Short-lived, transient conversation and session context                                            |
| **Email**               | **Resend**                        | Transactional email (notifications, invitations)                                                   |
| **Error monitoring**    | **Sentry**                        | Application error tracking                                                                         |

<Info>
  This is the technical architecture. The canonical, contractual list of data processors — with their roles and locations — is maintained in the [Data Processing Agreement](/security/subprocessors) and updated as the platform evolves.
</Info>

## Where your data is stored

<CardGroup cols={2}>
  <Card title="Your programme data" icon="database">
    Held in Kowalah's **Supabase** (PostgreSQL) database — the projects, deliverables, opportunities, and related records that make up your programme.
  </Card>

  <Card title="Files you upload" icon="file">
    Held in **Supabase Storage**, authorized per request against the record they belong to.
  </Card>

  <Card title="Fetched on demand" icon="timer">
    The platform reads data to answer a request and return it. It does not bulk-copy, mirror, or warehouse your data elsewhere.
  </Card>

  <Card title="Managed, encrypted infrastructure" icon="lock">
    Data is encrypted in transit (TLS) between every hop, and encrypted at rest in the managed database and storage.
  </Card>
</CardGroup>

<Note>
  Specific **hosting regions and data-residency commitments** are documented in the [Data Processing Agreement](/security/subprocessors) and can be confirmed for your contract. Talk to your Kowalah team if you have a regional requirement.
</Note>

## Customer platform vs Kowalah's internal systems

The application your team uses is separate from the internal systems Kowalah staff use to run the business.

* **The customer platform** (`app.kowalah.com`) is where your team works. It reads and writes only your organization's programme data, enforced by the [access controls](/security/access-controls) and tenant isolation described elsewhere in this section.
* **Kowalah's internal/admin systems** run as a separate application, with their own authentication, so that internal operations are isolated from the customer environment. Your users never connect to these systems, and the customer platform has no path into them.

## The two AI access points

Alongside the web platform, Kowalah offers two AI access points into your programme data — the **Claude Connector** and the **Kowalah Agent**. These have their own, tightly scoped data model, documented in depth in [data flow and exfiltration](/security/data-flow) and [data and access control](/security/data-and-access).

<Card title="How data flows through the AI access points" icon="arrow-left-right" href="/security/data-flow">
  See exactly what can and cannot move between your organization and Kowalah, and how to verify it yourself.
</Card>