System Architecture

How ScanToProve works

A cloud-native, multi-tenant platform built on a Hub & Spoke model. Eight verticals across two product families (Asset Provenance + Living Identity) plus a B2B sample-auth API — all sharing one NTAG 424 + Polygon engine.

Architecture last refreshed 25 February 2026·Added Pet Health · Auto · OPCLS · DNA Rails · Cryptographic Verification layer

Core Model

Hub & Spoke Architecture

Users land at the Command Center, then navigate into isolated verticals. Five asset products, three identity products, and one B2B API — each with its own dashboard, data, and public surfaces.

Command Center/app
ASSET

Wine & Spirits

/app/wine

ASSET

Luxury Goods

/app/luxury

ASSET

Enterprise Warehouse

/app/warehouse

ASSET

Supply Chain

/app/supplychain

ASSET

Barrels & Casks

/app/barrels

IDENTITY

Pet Health

/app/pet

IDENTITY

Auto

/auto

IDENTITY

OPCLS

/opcls

B2B API

DNA Rails

/api/v1/sample-auth

Data Flow

From scan to blockchain in seconds

Every asset event follows a deterministic pipeline — captured, processed, stored, anchored, and broadcast.

ScanRFID / NFC / QR / Camera
VerifyNTAG424 SUN (AES-128) + tamper check
ProcessAI identification & R2 direct upload
StoreMongoDB + R2 + Redis cache
BatchPattern C Merkle accumulation
AnchorPolygon transaction (one tx, many events)
NotifyEmail, webhooks & push alerts

Technology

Tech Stack

Eight layers working together — from the browser, through cryptographic verification, to the blockchain.

Client Layer

React 18

CRA + Craco, Tailwind CSS, Shadcn/UI

PWA

Service Worker, offline-first, IndexedDB

White-label runtime

Subdomain auto-detection → single-vertical lock at module load

Sentry

Real-time error monitoring & crash reporting

Multi-Tenancy

Enterprise-grade isolation

Every organization operates in its own silo. Data never bleeds between tenants or verticals.

Organization Isolation

Each client gets a unique organization_id. All queries are scoped to the org. No cross-tenant data access.

Vertical Isolation

Assets tagged with vertical field. Queries pass ?vertical=wine — enforced in both frontend and API.

White-Label Branding

Each licensed client can configure their own logo, colour scheme, domain, and theme. Managed via the Super Admin onboarding wizard.

Core Data Model

// Asset Document

{

"id": "uuid",

"organization_id": "org_uuid",

"vertical": "wine | luxury | warehouse | supplychain | barrels | pets | auto | opcls",

"category": "string",

"name": "string",

"created_at": "ISO datetime"

}

// API Query Pattern

GET /api/assets?vertical=wine

GET /api/assets?vertical=barrels

GET /api/zones?vertical=barrels

GET /api/assets/export/valuation?vertical=barrels

// Enforcement

query = {

"organization_id": user.org_id,

"vertical": request.vertical

}

Security

Eight layers of protection

JWT Authentication

Token-based auth with session management. Role-based access control per user.

Multi-Tenant Isolation

Organization-level data isolation. Each tenant sees only their assets.

Vertical Data Isolation

Assets tagged by vertical. Cross-contamination impossible at query level.

White-Label Subdomain Lock

Per-domain build trims unused vertical code paths. Customer never sees another tenant's product.

Cloudflare Turnstile

Bot captcha on auth + public pet endpoints. Stops scrapers and credential-stuffing.

End-to-End Encryption

TLS in transit. BYOK R2 credentials encrypted at rest (Fernet AES-128).

NTAG424 SUN + DNA TT

AES-128 cryptographic verification on every tap, rolling counter clone detection, physical tag-tamper loop → immutable Polygon event.

Audit Trail

Every scan, transfer, and edit logged immutably. Polygon-anchored — full compliance-ready history.

Integrations

Connect everything

Open APIs, webhooks, and hardware-agnostic scanning. ScanToProve fits into your existing stack.

REST API

JWT-authenticated endpoints with interactive Swagger docs. Assets, provenance, scans, analytics.

DNA Rails B2B API

x-api-key endpoints at `/api/v1/sample-auth/*` for DNA labs — activation → result chain, Polygon-anchored.

OPCLS Gateway

Federated chip lookup across 40+ pet registries. Open standard (Apache 2.0), no PII at the gateway.

Webhooks

Real-time event delivery to Slack, Discord, Teams, Zapier, or custom endpoints. HMAC-SHA256.

Transactional Email

Resend-powered (`alerts@scantoprove.com`) — lost-pet alerts, claims, geo-fence breaches.

Hardware

USB HID, Bluetooth LE, Web NFC, REST API readers. Works with Zebra, Impinj, Chainway, and more.

Direct Cloud Upload

Browser → R2 multipart (5 MB parts, 3 retries). No middleware, no transcode-then-upload.

White-Label Domain

Subdomain auto-detection locks a deployment to one vertical. One build, many products.

See the platform in action

Explore the live platform or dive into our technical documentation.