System context

The system#

MSO Cloud is one multi-tenant deployment that serves every organization. An organization owns brands; a brand is a partition inside the organization, not a separate tenant or a separate installation. Nothing in the box is built per customer: what an organization runs is composed from the plugins and blueprint enabled for it, and its data stays inside its own row-level-security scope.

flowchart TB
  subgraph PEOPLE["People"]
    direction LR
    MEM["Org member<br/>editor · viewer"]
    ADM["Org admin<br/>owner · admin"]
    SUP["Super admin<br/>platform staff"]
  end
  EDGE["Cloudflare DNS + Traefik<br/>host resolves to one org"]
  SYS["MSO Cloud<br/>commerce and marketing<br/>intelligence platform"]
  subgraph FIRST["First-party sources"]
    direction LR
    MKT["Marketplace APIs<br/>and seller exports"]
    ADS["Ad, web, search<br/>and CRM accounts"]
    SHE["Google Sheets<br/>workbooks"]
  end
  subgraph THIRD["Third-party and identity"]
    direction LR
    VEN["Market-data vendor<br/>API and file drops"]
    DIR["Org LDAP / AD<br/>directory"]
  end
  subgraph CALLED["Services MSO Cloud calls"]
    direction LR
    LLM["Language-model<br/>providers"]
    CHN["Notification transports<br/>push · email · Telegram · Zalo"]
    OBJ[("S3-compatible<br/>object storage")]
  end
  PEOPLE --> EDGE --> SYS
  FIRST -->|"scheduled pull, upload, sheet binding"| SYS
  THIRD --> SYS
  SYS --> CALLED

People and directories#

owner and admin hold the same capability set; rank, not capability, separates them. A super admin holds no membership row in any organization and is not one of the four organization roles.

Systems MSO Cloud reads#

Connector family is the data plane, and the planes never mix.

First-party marketplace. TikTok Shop, Shopee, Lazada and TikTok Affiliate over vendor APIs, plus Shopee and Lazada seller exports uploaded as CSV or XLSX. Marketplace data is the only ground truth for order money.

First-party marketing. Google Ads, Meta Ads, TikTok Ads, Shopee Ads, Google Analytics 4, Google Search Console, LinkedIn Page and Brevo. Spend and conversions stay attributed to the platform that reported them.

First-party datasets and audience. A Google Sheets workbook read through a service account, one tab per dataset, is how an organization brings its own operational records (people, budget, recruitment) in without an engineer. A social-listening corpus arrives the same two ways, as a file upload or a bound sheet tab. An Odoo HR connector manifest exists and ships disabled.

Third-party market intelligence. A market-data vendor's Open API and its file exports (provider kalodata, offered in the product as Creator Commerce) and category-heat file drops (provider eci, offered as EcomHeat). These are estimates: they land in their own store, carry an estimate label wherever they appear, and never become a first-party KPI.

Services MSO Cloud calls#

Language-model providers. Google, Anthropic, OpenAI, OpenRouter, Ollama, Mistral, DeepSeek and any OpenAI-compatible endpoint, reached only through the platform's own AI package. An organization configures an ordered list of connections and models; the platform fails over down that list. The provider and model name never reach an end-user surface.

Notification transports. Web push (VAPID), email (Resend), a Telegram bot and a Zalo Official Account. The in-app inbox is inside the boundary and needs no transport.

Object storage. An S3-compatible bucket holds organization backup and restore archives; a development machine runs MinIO for it. The bucket is never public: a download is proxied over the platform's own authenticated origin.

Edge. Cloudflare serves DNS for the apex and the tenant wildcard; Traefik terminates TLS and stamps the real client address. A request's host resolves to exactly one organization before any organization context exists, so the tenant is decided at the edge of the box rather than by a cookie.

MCP clients. An engineer's own tooling can read an organization's metrics over the Model Context Protocol, through the same metric catalog every dashboard reads.

What the boundary guarantees#

• Family is the plane. First-party marketplace, first-party marketing and third-party market estimates flow through separate stores, and a third-party estimate is barred from becoming a first-party number.
• Credentials never come back out. Every vendor key, directory bind password and channel secret is envelope-encrypted with a versioned key and is never returned to a client.
• The host decides the tenant. On an organization's own subdomain or verified domain, the host wins over the session cookie, and an organization switch is refused.
• Three tiers gate an outbound notification. The platform configures a channel, the organization is allowed to use it, and the person opts in. Until all three hold, nothing leaves the box for that person.
• Numbers carry proof. A generated sentence whose number is not traceable to a supplied fact is dropped rather than published.

Related#

• System Architecture
• Cloud Architecture
• The Decision Engine
• Ingest pipeline
• Security