myconsent+
architectureSYSTEM ARCHITECTURE

Five-Layer Architecture

A purpose-built architecture designed to handle the complexities of consent lifecycle management at enterprise scale.

web
LAYER 01

Presentation Layer

Adaptive consent widgets for web, mobile, and IoT interfaces

psychology
LAYER 02

Business Logic Layer

Consent orchestration, policy evaluation, and consent receipt generation

api
LAYER 03

API Layer

GraphQL & REST endpoints with automatic rate limiting and auth

storage
LAYER 04

Data Layer

Encrypted consent vault with an append-only, hash-chained audit trail

security
LAYER 05

Security Layer

Key rotation, least-privilege access, and intrusion detection. Zero-knowledge proofs are planned, not deployed

diagramSystem Flow Diagram

DATA VAULTEncrypted & ImmutablePresentation LayerBusiness Logic LayerAPI LayerData LayerSecurity Layer

settingsTechnology Stack

Infrastructure

  • circleKubernetes Orchestration
  • circleMulti-AZ Deployment
  • circleAuto-Scaling Groups
  • circleLoad Balancing

Data & Storage

  • circlePostgreSQL (Encrypted)
  • circleRedis Cache Layer
  • circleElasticsearch (Audit)
  • circleS3 (Cold Storage)

Security

  • circleAES-256 at rest
  • circleTLS 1.3 in transit
  • circleEnvelope encryption with rotating keys
  • circleRole-based access, access logs retained 1 year

What is not built yet

Everything above describes the platform as it is designed and, where stated as shipped, as it is built. These three are direction, not product, and we would rather you heard it here.

  • Zero-knowledge proofs

    The intent is for a regulator to verify a consent without seeing the data behind it. Today the guarantees are encryption at rest and in transit, least-privilege access, and an append-only hash-chained trail that fails verification if a record is altered. The proof system itself is not implemented.

  • Consent Manager registration

    Registration under Rule 4 opens on 13 November 2026, against Part A of the First Schedule — incorporation in India, a ₹2 crore net worth floor, and an interoperable platform. We are not a registered Consent Manager today, and no one is, because the register does not open until then.

  • Independent certification

    No SOC 2 report or ISO certificate has been issued for this platform. When one is, it will appear here with its scope, date and auditor, and the report will be available under NDA. Until then, treat the security section as design intent you are entitled to test.