AgileNotes.AI System Architecture

AWS · serverless
lambdalith compute · ~76 tables
rev 2026-07

AWS account

Band 01

Surfaces CloudFront edge

agilenotes.ai

Marketing site

S3static

app.agilenotes.ai

Product app

Vanilla ESM · ViteClean ArchitectureS3

admin.agilenotes.ai

Admin console

SPAS3

help.agilenotes.ai

Help center

S3static

dashboard. + reports.agilenotes.ai

Dashboard & reports

server-renderedAPI GW origin

Band 02

APIs & compute API Gateway · Lambda · EventBridge

api.agilenotes.ai

Public API Gateway

cookie JWTCSRF

VPC

agilenotes-backend

Backend stack

apiApp lambdalithaiWorkerNode.js · CJSVPC

api-admin.agilenotes.ai

Admin API Gateway

TOTP MFA

agilenotes-admin

Admin stack

AdminApi lambdalith

EventBridge

Schedules

billing · dailyproactivity · 6h

Band 03

Data & identity VPC · managed services

VPC

RDS Proxy

Connection pool

VPC

PostgreSQL

Relational core

~76 tablesDrizzle ORM

Cognito

User pool

pre-signup triggerSAML SSO

Secrets Manager

Credentials

DB · NMI

SSM Parameter Store

Runtime config

AI model ids · Bedrock

AWS Bedrock

Claude Opus 4.8

generate → cache → pollIAM · SigV4

AWS Transcribe

Voice capture

speech → text

Public internet · third parties

Band 04

External services third-party integrations

APM syncs

Jira · ADO · Agility · Rally

work item pull

NMI

Payments

Collect.jsCustomer Vault

Customer IdP

Enterprise SSO

SAMLper-org

Legend

Synchronous request / invoke
Scheduled / event-driven
Data & config reads
External / third-party call
Trust boundary (account / VPC)

hover to preview · click to pin a node's connections

Tech stack

Frontend

Vite Vanilla JS · ES modules Clean Architecture · DI Jest + jsdom

Backend

Node.js Lambdas · CJS Drizzle ORM PostgreSQL Cognito EventBridge Collect.js AWS Bedrock · Claude AWS Transcribe

Architecture note

Domain services live once, in Lambda CJS; the frontend imports them via the @domain alias — no twin files, no parity drift.

Compute is grouped by workload, not by route: apiApp, aiWorker, and AdminApi each own a workload, so a warm instance and its DB connection are shared across every route in it.

PCI scope

Card data never enters AWS. Collect.js tokenizes in the browser, so Lambdas and Postgres handle only NMI Customer Vault tokens. That keeps PCI scope at the SAQ-A level.