Trust Center
External Boundaries

Integrations

Every external system that exchanges data with the Vorantiq operating environment, governed as an explicit trust boundary. This is not a marketplace catalogue. Every integration declares its purpose, trust boundary, data-flow direction, authentication model, ownership, failure-domain implication, observability posture, rollback posture, and current maturity state.

Governance posture

Nothing appears on this page unless it exists in this repository or is architecturally grounded in a tracked B-document. No fake ecosystem inflation, no "coming soon" marketing, no partner brand placement. An integration may carry two states when its code is shipped but deployment activation is intentionally pending — this avoids the trap of marking shipped-but-dormant code as complete.

State legend

Complete

Wired, live, and exchanging data with the external system as designed.

Scaffolded

Adapter or connector code is shipped; production activation may be per-tenant or pending.

Architected

Designed in a tracked B-document; no implementation in repo yet.

Planned

Acknowledged future work without current implementation or vendor selection.

Blocked

Cannot advance until the active Production-Safety Stop is lifted.

Not enabled

Code is shipped and no-op safe; the deployment-time activation env var is intentionally unset in production today.

Stripe

Complete

Billing, subscription lifecycle, payment processing.

Trust boundary
Stripe → us via signed webhooks; us → Stripe via API.
Data flow
bidirectional
Authentication
Webhook signature verification + API key.
Ownership
Stripe owns payment data; we own the local subscription mirror.
Failure domain
Outage degrades signups, not existing tenant runtime; webhook drop → daily reconciliation (planned).
Observability
Every webhook event recorded to audit trail; idempotency via provider_event_id.
Rollback
Revoke API key, remove webhook endpoint; in-flight subscriptions remain intact.

Vercel

Complete

TLS edge, static + serverless hosting, deployment surface.

Trust boundary
TLS terminates at Vercel edge; serverless functions execute in their managed runtime.
Data flow
outbound
Authentication
Dashboard SSO + git-based deploy on main push.
Ownership
Vercel owns the runtime; we own application code, env vars, and deployment manifest.
Failure domain
Regional outage takes the platform offline. No alternate-hosting failover today.
Observability
Per-commit deployment statuses to the GitHub deployments API; build-time source-map gate enforced.
Rollback
Instant rollback via Vercel dashboard; or git revert + push.

Neon Postgres

CompleteBlocked

Primary OLTP database — tenant data, sessions, audit log, billing mirror.

Trust boundary
Encrypted at rest by Neon; TLS in transit; single region today.
Data flow
bidirectional
Authentication
Connection string with credentials (DATABASE_URL).
Ownership
Neon owns storage and PITR; we own schema, migrations, integrity.
Failure domain
Outage takes the platform offline; PITR is the documented recovery path.
Observability
/health probe checks DB liveness; restore runbook documented.
Rollback
PITR for data; Alembic downgrade for schema (additive migrations are reversible).

Resend

Complete

Transactional email — registration, password reset, MFA setup.

Trust boundary
Outbound — recipient address + templated body sent over HTTPS.
Data flow
outbound
Authentication
API key.
Ownership
Resend owns delivery and bounce handling; we own templates and triggers.
Failure domain
Email failure degrades auth-flow UX (password reset, MFA setup); does not block existing sessions.
Observability
Structured-log line per send with correlation id; provider response recorded.
Rollback
Rotate API key; swap provider via the abstracted email interface.

Anthropic

Complete

Outbound LLM inference for agent runtime.

Trust boundary
Prompts and tool-call payloads leave the environment for inference; responses return.
Data flow
bidirectional
Authentication
Per-tenant or platform-owned API key.
Ownership
Anthropic owns inference; we own routing, prompt, and response handling.
Failure domain
Typed errors (auth / rate-limit / 5xx / timeout); routing-plane fallback to alternate provider when configured.
Observability
Adapter typed errors, per-call provider response auditing.
Rollback
Disable adapter via routing config; rotate API key.

OpenAI

Complete

Outbound LLM inference for agent runtime.

Trust boundary
Same as Anthropic — prompts and tool-call payloads leave the environment for inference.
Data flow
bidirectional
Authentication
Per-tenant or platform-owned API key.
Ownership
OpenAI owns inference; we own routing, prompts, response handling.
Failure domain
Same typed-error pattern as Anthropic; routing-plane fallback applies.
Observability
Adapter typed errors, per-call provider response auditing.
Rollback
Disable adapter via routing config; rotate API key.

Slack

Scaffolded

Per-tenant workspace integration for notification + agent-action surfaces.

Trust boundary
Per-tenant OAuth-scoped access token; tokens encrypted at rest.
Data flow
bidirectional
Authentication
OAuth 2.0 with token rotation on standard refresh flow.
Ownership
Slack owns the workspace and the OAuth grant; we own per-tenant token storage and connector logic.
Failure domain
Outage degrades notifications for connected tenants; rest of the environment is unaffected.
Observability
OAuth grant + revoke events are audit-loggable; per-tenant connector state visible in registry.
Rollback
Tenant disconnects connector or revokes grant in Slack admin; per-tenant token row is removed.

OpenTelemetry

ScaffoldedNot enabled

Distributed tracing + structured-log export.

Trust boundary
Outbound only when activated; vendor-neutral — deployment chooses the exporter target.
Data flow
outbound
Authentication
Vendor-specific via OTEL_EXPORTER_OTLP_HEADERS.
Ownership
Adapter is owned in this repo; deployment chooses vendor and endpoint.
Failure domain
Exporter failure does not affect runtime — adapter degrades to no-op safely.
Observability
Self-evident; emission gated by OTEL_ENABLED.
Rollback
Unset OTEL_EXPORTER_OTLP_ENDPOINT; spans stop emitting on the next process.

Sentry

ScaffoldedNot enabled

Application error capture and aggregation.

Trust boundary
Outbound — errors with stack traces would leave the environment if DSN is set.
Data flow
outbound
Authentication
DSN (Sentry-issued URL with embedded credential).
Ownership
Sentry owns aggregation; we own the frontend SDK + 3 configs and the planned PII scrubber.
Failure domain
None today — DSN unset in Vercel production, SDK initializes as no-op, captureException calls degrade silently.
Observability
Self-instrumentation only when DSN is set; backend errors flow through structured logging.
Rollback
Unset DSN env vars in Vercel; configs become no-op on next deploy.

GitHub + Actions

Complete

Source-of-truth code, CI runner, deployment hook surface.

Trust boundary
Source code on GitHub; CI runners on GitHub-managed compute; main push triggers production deploy.
Data flow
bidirectional
Authentication
SSH keys for git; GitHub App token for deployment-status surface.
Ownership
GitHub owns hosting and runner compute; we own workflows and the deployment manifest.
Failure domain
Outage prevents new deploys; running production surface is unaffected.
Observability
Per-commit check runs (Sanity / Lint / Unit Tests / CI Summary); deployment-status events for both Vercel projects.
Rollback
Branch protection (gated on org-admin activation); commit history is the canonical record.

Honest gaps

Known limits of the current integrations posture, named without softening.

01

No alternate-hosting failover for Vercel. A regional outage takes the platform offline.

02

No multi-region data-residency split for Neon. Single region today.

03

No alternate email provider beyond Resend; outbound email is a single-vendor dependency.

04

No production OpenTelemetry exporter selected. Vendor selection is design-track B.5.1.

05

Frontend Sentry SDK shipped but not active — DSN unset in Vercel production. Backend Sentry SDK not yet integrated.

06

No daily reconciliation job between Stripe and the local subscription mirror; webhook delivery is the only sync today.

07

OAuth connector catalogue is small. Only Slack is registered; new connectors require in-repo classes gated on per-vendor security review.

08

Branch protection on main is gated on org-admin activation.

What is NOT an integration

A few systems that look like integrations but are deliberately classified elsewhere: the local LLM adapter is an in-repo module, not an external system; internal observability primitives (correlation IDs, structured logging, metrics registry) are documented at /observability because they are not external trust boundaries; third-party UI libraries and TypeScript dependencies are managed via Dependabot and ship as bundled artifacts.

View canonical External-System Boundaries document