| Application backend |
A dedicated server-side application layer handles business logic, validation and privileged operations.
Technical details
The web and mobile applications connect to SurvSync's server-side application layer. Privileged business rules and sensitive operations are enforced beyond the user interface.
|
Important actions are processed on SurvSync's servers rather than relying only on the surveyor's phone or browser. |
| Authentication and access |
Authenticated account context is combined with server-side role, ownership and organisation checks for the requested workflow.
Technical details
Authentication identifies the user. Separate authorisation checks then evaluate the user's role and, where relevant, the practice or personal scope associated with the request.
|
Users can only use protected information and actions when their account has the required access. |
| Protected requests |
Protected changes use authenticated sessions, request validation and anti-forgery controls, with bounded inputs applied to sensitive workflows.
Technical details
Server middleware and workflow-specific checks protect authenticated routes. Mutation requests use cross-site request forgery protection, while selected upload, integration and document workflows also constrain request sizes and accepted input.
|
SurvSync checks both who is making an important request and whether the submitted information is valid before processing it. |
| Photo and media storage |
Inspection media is stored in dedicated S3-compatible object storage, separate from the primary structured application data.
Technical details
Dedicated object storage is designed for file-based workloads such as photographs, voice notes, floorplans and generated documents. Structured records retain the references needed to connect those files to the correct workflow.
|
Photo-heavy inspections do not require large image, audio and document files to be held inside the main application database. |
| Practice data separation |
Server-side data access is scoped by the authenticated user and, for team workflows, the authorised organisation.
Technical details
Protected workflows use user, role and organisation context when reading or changing records. These controls are applied on the server as well as reflected in the interface.
|
Surveying practices work within their authorised data scope rather than receiving unrestricted access to every customer's records. |
| Retry-safe processing |
Selected important document workflows preserve processing state and use duplicate-prevention controls so interrupted requests can be retried safely.
Technical details
Some server operations can finish even when the response does not reach the user's device. Durable generation state and idempotency controls are used in supported document workflows to distinguish a retry from a new request.
|
If a connection is interrupted during a supported operation, SurvSync is designed to reduce the risk of creating the same result twice. |
| Report generation |
Professional report documents are generated through dedicated server-side rendering workflows.
Technical details
Report data is prepared and rendered on controlled application infrastructure, allowing document production to follow consistent templates and processing rules.
|
Complex reports are produced using server resources rather than depending entirely on the performance of the surveyor's phone or browser. |
| Separated infrastructure |
Application processing, structured records and high-volume media storage use specialised services with distinct responsibilities.
Technical details
Separating business processing, structured records and file storage lets each part of the platform use infrastructure suited to that type of work.
|
SurvSync does not ask one technology or storage system to perform every part of the platform's workload. |
| Monitoring and recovery |
Production services expose health checks, record operational events and run reconciliation checks for supported document-generation workflows.
Technical details
Structured application logs and health endpoints support operational monitoring. Document reconciliation checks can identify stale processing, release expired work and complete supported uploaded documents after an interrupted finalisation step.
|
Operational problems can be detected and investigated, and selected interrupted document processes can be identified for recovery or safe retry. |
| Operational records |
Selected user actions, document-processing states and application failures are recorded for operational review and investigation.
Technical details
Activity records cover selected business actions, while structured application events capture operational failures and supported generation states. This is targeted operational logging rather than a claim that every interaction forms a permanent audit record.
|
When a supported workflow needs attention, SurvSync retains useful operational context rather than relying only on a user's recollection of what happened. |
| Controlled AI integrations |
AI features are restricted to eligible accounts and invoked through a server-side integration with bounded requests.
Technical details
The AI service credential remains on SurvSync's server. Account eligibility is checked before supported AI requests are processed, but user-selected content submitted to an AI feature is processed by the configured external AI provider.
|
When a surveyor chooses to use an AI feature, the selected prompt or content is sent to the configured AI provider and the surveyor must review the result before relying on it. |
| External integrations |
Privileged third-party integrations are handled through controlled server-side services when credentials or sensitive operations are involved.
Technical details
The server acts as the controlled boundary for supported payment, storage, authentication and assisted-writing integrations that require privileged access.
|
Sensitive service credentials and privileged integration logic are not simply exposed inside the mobile or web interface. |