Control-plane architecture
MindShield separates the public website, customer dashboard, cloud API, application database and Windows Agent responsibilities. The diagram intentionally omits sensitive deployment details.
Customer environmentWindows Server & SQL ServerProtected workloads
Local access→
Customer environmentMindShield AgentDiscovery, scheduling and backup execution
Authenticated HTTPS→
MindShield serviceCloud APIIdentity, policy and operational coordination
Scoped database session→
Data layerTenant-aware PostgreSQLAuthorization context and row-level controls
Layered boundaries
Agent boundary
The Agent performs customer-authorized discovery and backup operations within the customer environment.
API boundary
Cloud requests pass through authentication, authorization and scoped database context.
Tenant boundary
Organization context and RLS reduce cross-tenant data exposure risk.
Public-site isolation
The static public website has no direct database or privileged production access.
Important boundary
This architecture reduces risk but does not eliminate the need for secure customer credentials, patched systems, protected storage destinations, access reviews and tested recovery procedures.