How it is built, in plain words.
For architects and reviewers who want the shape of the system before they read the security overview.
The shape
A multi-tenant control plane on Cloud Run holds accounts, environments, Promises, workflows, schedules, evidence, billing, and Milita. When a Promise runs, the control plane dispatches one single-use container, or a warm one for an interactive run, which fetches its validated plan and a short-lived Salesforce session, drives a headless Chromium through the real Salesforce interface as the right persona, uploads evidence, and reports each step back.
A separate cloud engine hosts the browser an author watches during Debug, streamed into the conversation over a tunnel, with Salesforce-only egress. A single-instance purge job is the only identity that deletes evidence. Shared contracts define every wire between processes so drift fails at build time. Scheduled sweeps dispatch queued runs, time out stuck ones, evaluate incidents, enforce retention, and roll up billing. The database is the source of truth; nothing is synced to Git.
The services
| Service | What it does |
|---|---|
| API and app | Authentication, tenants, authoring, the run queue and dispatch, scheduled sweeps, Milita, the application and this website. |
| Runner job | One run, one ephemeral container: fetches its bundle and a short-lived Salesforce session, drives headless Chromium, uploads evidence, calls back to the API. |
| Live runner | Warm runners, so an interactive run starts in seconds instead of a cold boot. |
| Engine | The cloud engine for authoring: holds the primitives runtime and drives the hosted browser over a tunnel. |
| Hosted browser | The Chromium the author watches, dialing the engine's tunnel, with Salesforce-only egress. |
| Purge job | The only identity that deletes bundles and archives. |
Where things live
- Google Cloud: Cloud Run, Cloud SQL Postgres 16, Cloud Storage, Secret Manager, Identity Platform, Cloud Scheduler, Artifact Registry, Cloud Monitoring, all managed with Terraform.
- One external HTTPS load balancer in front of every public name, TLS 1.2 or higher, Cloud Armor in production. Binary Authorization attests every image.
- Two environments: a development project with its own identities that never holds production data, and the production project that is the SOC 2 boundary.
- Model requests go to Google Vertex AI. Which model answers is an operator setting, not a deploy, with one-click rollback.
The nouns underneath
| Noun | What it is |
|---|---|
| Workflow | One reusable path, one sign-in, built in the Workflow Builder. Immutable versions hold the validated plan. |
| Promise | What a customer schedules and relies on: triggers, then stages of workflows, each use run as a persona. Built in the Promise Builder. |
| Persona and principal | A role a workflow runs as; per environment it resolves to a real non-admin Salesforce user. |
| Environment | A connected Salesforce sandbox. One org per environment. |
| Regression | Every Promise started at once and followed as one record with one verdict. |
| Vitals | Today's Promise runs as a heartbeat strip above fourteen days of history. |
How it was built: AI-first
Release Assurance is an AI-first company, and the platform is the clearest example. One person, with AI coding agents he directs, shipped more than 2,200 pull requests in about six months, every one through review, an automated gate, and a merge queue. The agents have their own GitHub identity and their own Google identity. They cannot touch production data, and they cannot approve their own work. The founder approves every change that reaches the main branch, and production deploys only from a release pull request he approves. The same discipline that lets one person run a production platform is what an auditor will examine.