Wonder Security & Trust
Infrastructure & Architecture
Architecture Overview
Imagine is a cloud-native learning platform built on managed infrastructure from AWS, Vercel, and MongoDB Atlas. The core backend and primary data infrastructure are hosted in Frankfurt, with the platform designed around managed cloud services rather than institution-hosted infrastructure.
Platform Components
Imagine uses established managed cloud services for each major layer of the platform, allowing infrastructure, storage, databases, and application services to be operated and scaled independently.
| Layer | Platform |
|---|---|
| Web application | Vercel |
| Core application API | AWS ECS Fargate — Frankfurt |
| Primary application database | MongoDB Atlas |
| Object and file storage | AWS S3 — Frankfurt for verified private storage |
| Private content delivery | AWS CloudFront |
Environment & Tenant Separation
Imagine is a multi-tenant SaaS platform designed to provide strong logical separation between institutions. Each institution has its own dedicated MongoDB database and institution-scoped file namespace, while the application runtime and supporting managed infrastructure are shared. Production and Staging run as separate application deployments, with logical separation within shared infrastructure components.
| Layer | Production / Staging | Between Institutions |
|---|---|---|
| Application runtime | Separate deployments | Shared application runtime |
| API services | Separate services and endpoints | Shared API service |
| MongoDB data | Separate databases | Separate database per institution |
| MongoDB infrastructure | Shared Atlas cluster | Shared Atlas cluster |
| S3 storage | Shared buckets | Shared buckets with institution-specific namespaces |
| Redis / Valkey | Shared managed instance with environment-level queue separation | Shared managed instance with tenant context in application jobs |
| Application credentials | Shared | Primarily shared application-level credentials |
Network & Infrastructure Security
Imagine's backend operates within a dedicated AWS network environment, with public application traffic routed through an AWS Application Load Balancer and protected using HTTPS. Internal infrastructure is subject to network-level access restrictions, with additional network hardening currently in progress.
| Control | Configuration |
|---|---|
| Network | Dedicated AWS VPC |
| Public entry point | AWS Application Load Balancer |
| HTTPS | TLS 1.2 and TLS 1.3 |
| Internal Redis access | Restricted to the application VPC |
| Application-service exposure | Additional network hardening in progress |
| HTTP → HTTPS enforcement | Hardening in progress |
Status: Hardening in progress
Data Residency
Imagine keeps its core backend, primary database, and private file storage in Frankfurt. Vercel application processing is restricted to European regions, while the residency of AI and other external subprocessors is documented separately as part of the subprocessor review.
| Component | Provider | Region |
|---|---|---|
| Core production backend | AWS | EU Central (Frankfurt) |
| Private file storage | AWS S3 | EU Central (Frankfurt) |
| Application database | MongoDB Atlas | EU Central (Frankfurt) |
| Web application processing | Vercel | Frankfurt, Dublin, and London |