VerityLayer Technical Architecture

System Architecture

High-Level Overview


┌─────────────────────────────────────────────────────────────┐
│                     Load Balancer (Optional)                 │
└─────────────────────────────────────────────────────────────┘
                              │
                              ▼
┌─────────────────────────────────────────────────────────────┐
│                    Web Application Server                    │
│                      (Apache/Nginx + PHP)                    │
└─────────────────────────────────────────────────────────────┘
                              │
                 ┌────────────┴────────────┐
                 ▼                         ▼
┌──────────────────────────┐  ┌──────────────────────────┐
│   Central SaaS Database  │  │   Tenant Databases       │
│   (veritylayer_saas)     │  │   (org_1_db, org_2_db)   │
│                          │  │                          │
│   - organizations        │  │   - risk_register        │
│   - users                │  │   - vulnerabilities      │
│   - subscriptions        │  │   - assets               │
│   - org_db_connections   │  │   - siem_alerts          │
└──────────────────────────┘  └──────────────────────────┘


---
Multi-Tenant Architecture

Database Separation

Central SaaS Database:
Organization registry

User accounts

Billing/subscriptions

Tenant connection registry

System configuration

Tenant Databases:
Risk management data

Vulnerability data

Asset inventory

SIEM data

All customer-specific data

Connection Routing

Automatic routing in db_connect.php:

`php if (TENANT_DB_MIGRATION && isset($_SESSION['org_id'])) { // Route to tenant database $conn = TenantDatabaseManager::getTenantConnection($_SESSION['org_id']); $centralConn = TenantDatabaseManager::getCentralConnection(); } else { // Legacy shared database mode $conn = db(); $centralConn = $conn; } `


Key Features:
Automatic connection routing based on session

Connection pooling and caching

Health monitoring

Automatic failover

---
Security Architecture

Authentication & Authorization

Authentication Flow:
User submits credentials

System validates against users

 table (central DB)


Session created with org_id

Subsequent requests route to tenant DB

Authorization:
Role-Based Access Control (RBAC)

Permissions stored in central DB

Roles: Super Admin, Org Admin, User, Viewer

Data Encryption

At Rest:
Database passwords: AES-256-GCM

Sensitive fields: Application-level encryption

File uploads: Encrypted storage

In Transit:
HTTPS/TLS for web traffic

SSL/TLS for database connections

API authentication tokens

Audit Trail

Logged Events:
User login/logout

Data modifications

Permission changes

Database connection changes

Administrative actions

---
Application Structure

Directory Layout


veritylayer/
├── admin/                    # Admin tools
│   ├── batch_provision.php
│   ├── migrate_org_data.php
│   └── verify_migration.php
├── Assets/                   # Asset management module
├── AutoPentest/             # Automated pentesting
├── BCDR/                    # Business continuity
├── database/                # Database schemas
│   ├── schema.sql
│   ├── create_org_db_connections.sql
│   └── install_org_db_connections.php
├── docs/                    # Documentation
├── includes/                # Core includes
│   ├── config.php
│   ├── db_helpers.php
│   └── multi_tenant_auth.php
├── Projects/                # Project management
├── SIEM/                    # Security monitoring
├── src/
│   ├── Controllers/         # Application controllers
│   └── Core/
│       ├── db_connect.php
│       └── TenantDatabaseManager.php
├── super_admin/             # Super admin interface
├── tenant-db-setup/         # Tenant provisioning tools
│   ├── setup_wizard.php
│   ├── test_connection.php
│   └── tenant_schema.sql
├── UserManagement/          # User management
├── VendorManagement/        # Vendor risk
└── Vulnerabilities/         # Vulnerability tracking


---
Database Schema

Central SaaS Database

organizations

sql
CREATE TABLE organizations (
    org_id INT PRIMARY KEY AUTO_INCREMENT,
    org_name VARCHAR(255) NOT NULL,
    org_slug VARCHAR(100) UNIQUE,
    subscription_plan ENUM('trial','starter','professional','enterprise'),
    subscription_status ENUM('active','trial','suspended','cancelled'),
    max_users INT DEFAULT 10,
    created_at TIMESTAMP DEFAULT CURRENT_TIMESTAMP
);


org_db_connections

sql
CREATE TABLE org_db_connections (
    id INT PRIMARY KEY AUTO_INCREMENT,
    org_id INT NOT NULL,
    db_host VARCHAR(255) NOT NULL,
    db_port INT DEFAULT 3306,
    db_name VARCHAR(100) NOT NULL,
    db_user VARCHAR(100) NOT NULL,
    db_password_encrypted TEXT NOT NULL,
    hosting_type ENUM('managed','customer_cloud','customer_onprem'),
    health_status ENUM('healthy','degraded','down'),
    is_active BOOLEAN DEFAULT 1,
    FOREIGN KEY (org_id) REFERENCES organizations(org_id)
);


Tenant Database

risk_register

sql
CREATE TABLE risk_register (
    risk_id INT PRIMARY KEY AUTO_INCREMENT,
    title VARCHAR(255) NOT NULL,
    description TEXT,
    risk_category VARCHAR(100),
    likelihood INT,
    impact INT,
    inherent_risk_score INT,
    status ENUM('Open','In Progress','Closed'),
    created_at TIMESTAMP DEFAULT CURRENT_TIMESTAMP
);


vulnerabilities

sql
CREATE TABLE vulnerabilities (
    id INT PRIMARY KEY AUTO_INCREMENT,
    title VARCHAR(255) NOT NULL,
    severity ENUM('Critical','High','Medium','Low','Info'),
    status ENUM('Open','In Progress','Remediated','Accepted'),
    discovered_date DATE,
    cvss_score DECIMAL(3,1)
);


---
API Architecture

RESTful Endpoints

Authentication:


POST /api/auth/login
POST /api/auth/logout
POST /api/auth/refresh


Organizations:


GET    /api/organizations
POST   /api/organizations
GET    /api/organizations/{id}
PUT    /api/organizations/{id}
DELETE /api/organizations/{id}


Risks:


GET    /api/risks
POST   /api/risks
GET    /api/risks/{id}
PUT    /api/risks/{id}
DELETE /api/risks/{id}


API Authentication

Token-based:

php
// Request header
Authorization: Bearer {api_token}


Org context extraction:

php
// From API key
$orgId = getOrgIdFromApiKey($apiKey);
$_SESSION['org_id'] = $orgId;


---
Performance Optimization

Connection Pooling

Configuration:

sql
UPDATE org_db_connections 
SET connection_pool_size = 20 
WHERE org_id = 1;


Benefits:
Reduced connection overhead

Better resource utilization

Improved response times

Caching Strategy

Connection Caching:
Memory cache (per request)

Session cache (per user session)

Automatic cleanup on logout

Query Caching:
MySQL query cache

Application-level caching (Redis/Memcached)

Database Optimization

Indexing:
Primary keys on all tables

Foreign key indexes

Composite indexes for common queries

Partitioning:
Date-based partitioning for large tables

Tenant-based partitioning (via separate DBs)

---
Scalability

Horizontal Scaling

Application Servers:
Stateless application design

Session storage in Redis/database

Load balancer distribution

Database Scaling:
Read replicas for reporting

Sharding by organization

Separate databases per tenant

Vertical Scaling

Server Resources:
CPU: 4+ cores recommended

RAM: 8GB+ recommended

Storage: SSD recommended

---
Monitoring & Logging

Application Monitoring

Health Checks:

bash
php admin/health_check.php


Metrics:
Request rate

Response time

Error rate

Database connections

Database Monitoring

Connection Health: `sql SELECT org_id, health_status, last_health_check FROM org_db_connections WHERE health_status != 'healthy'; `

Query Performance: `sql SHOW PROCESSLIST; SHOW STATUS LIKE 'Slow_queries'; `


Log Aggregation

Centralized Logging:
Application logs → Syslog/ELK Stack

Database logs → Monitoring service

Audit logs → Secure storage

---
Disaster Recovery

Backup Strategy

Frequency:
Central DB: Daily full, hourly incremental

Tenant DBs: Daily full

File storage: Daily

Retention:
Daily backups: 30 days

Weekly backups: 90 days

Monthly backups: 1 year

Recovery Procedures

Database Recovery: `bash


Restore central DB

mysql -u root -p veritylayer_saas < backup_central.sql
Restore tenant DB

mysql -u root -p org_1_db < backup_org_1.sql


Application Recovery:

bash
Restore from backup

tar -xzf veritylayer_backup.tar.gz -C /var/www/
Restore permissions

chown -R www-data:www-data /var/www/Risk\ APP\ AI/


---
Security Hardening

Server Hardening

Firewall:

bash
Allow only necessary ports

ufw allow 80/tcp
ufw allow 443/tcp
ufw allow 3306/tcp  # Only from app server
ufw enable


PHP Security:

ini
; php.ini
expose_php = Off
display_errors = Off
log_errors = On
allow_url_fopen = Off


Database Hardening

MySQL Configuration:

ini
; my.cnf
bind-address = 127.0.0.1  # Local only
max_connections = 200


User Privileges:

sql
-- Minimal privileges
GRANT SELECT, INSERT, UPDATE, DELETE ON org_1_db.* TO 'org_1_user'@'%';
-- No GRANT, DROP, ALTER permissions

`` ---

Compliance

Data Residency

Geographic Separation:

EU customers → EU data centers
US customers → US data centers
Customer on-premise → Customer location

GDPR Compliance

Data Protection:

Encryption at rest and in transit
Right to erasure (data deletion)
Data portability (export functionality)
Audit trails

SOC 2 Compliance

Controls:

Access controls (RBAC)
Encryption
Audit logging
Backup and recovery
Incident response

---

Technology Stack

Backend:

PHP 8.0+
MySQL 8.0+
Apache/Nginx

Frontend:

HTML5
CSS3 (Bootstrap 5)
JavaScript (jQuery)

Security:

OpenSSL
AES-256-GCM encryption
TLS 1.2+

Tools:

Composer (dependency management)
Git (version control)

---

Support & Maintenance

Update Cycle

Release Schedule:

Major releases: Quarterly
Minor releases: Monthly
Security patches: As needed

Compatibility

PHP Versions:

Minimum: 7.4
Recommended: 8.0+
Tested: 8.1, 8.2

MySQL Versions:

Minimum: 8.0
Recommended: 8.0.30+
Compatible: MariaDB 10.5+

---

For technical support: tech-support@veritylayer.com