Designed for serious data workflows.
What the sample-data demo does, and what the live product (with Supabase) implements today. The two are kept separate on purpose.
Live architecture
Requests move top to bottom. The AI layer never computes figures itself; it explains results the database has already calculated.
User
Browser on desktop, tablet or mobile
Visuioration web application
Next.js, React, TypeScript
Authentication
Identity provider, SSO for Enterprise
API / application layer
Validated, rate-limited service endpoints
Database
PostgreSQL for metadata; warehouse for datasets
Secure file storage
Object storage for uploads and exports
AI services
LLM explains results computed by queries
Analytics
Product events without personal data
Demo mode vs live mode
| Layer | Demo mode (sample data) | Live mode (with Supabase) |
|---|---|---|
| Frontend | Next.js App Router with sample data. Recharts for visualization. | Implemented: the same Next.js 16 / React 19 frontend, with server components, server actions and a per-request Content-Security-Policy. |
| Data layer | Centralised sample data in /lib/demo-data. Every figure is derived from one monthly ledger, so totals agree across pages. | Implemented: Supabase Postgres with row level security on every table. Chart queries run in the database with the signed-in user's permissions. Not yet: a separate analytical warehouse. |
| AI layer | A rule-based simulated assistant that composes answers from precomputed facts. No model is called. | Implemented (optional, needs an Anthropic API key): the model plans structured queries, the database runs them, and every number in the explanation is checked against the results. |
| Storage | Imports are simulated; no files leave the browser. | Implemented: signed uploads to private Supabase Storage, server-side parsing and profiling, size and content limits, and a scheduled clean-up of orphaned files. Not yet: virus scanning. |
| Security | Demo-only sign-in with published credentials. No sessions, tokens or personal data. | Implemented: Supabase Auth, workspace roles enforced by row level security, least-privilege grants, rate limiting and security headers. See the list below. |
| Monitoring | None beyond the browser console. | Not yet: error tracking, uptime checks and alerting. Server logs only. |
| Integrations | CSV, Excel, Google Sheets and API sources are demonstrated in the import flow only. | Implemented: CSV and Excel upload. Not yet: Google Sheets, databases, APIs and other connectors. |
Security, stated honestly
Visuioration holds no certifications and makes no compliance claims. This is what is in place in live mode today, and what is not yet.
- Authentication (Supabase Auth)In place
- Role-based access controlIn place
- Row level securityIn place
- Private file storageIn place
- Input validationIn place
- Rate limitingIn place
- Content-Security-PolicyIn place
- Secrets kept server-sideIn place
- Audit log of AI questionsIn place
- Full audit loggingNot yet
- Backups (Supabase plan)Not yet
- Monitoring and alertingNot yet
- Data retention policiesNot yet
- Virus scanning of uploadsNot yet