Skip to content
Route5

Route5

Trust · Architecture

How the system is wired — no mystery boxes.

First-party architecture overview for enterprise buyers. Desk is a Linear-grade SPA with a thin Route5 bridge. AI never ships commitments without human approve.

WhitepaperSubprocessors
Full Trust Center copy follows this language.

Control plane

UsersBrowser · Desktop
ClerkAuth · SSO · MFA
VercelEdge · Next.js
Route5 APIsR5E · GraphQL bridge
SupabaseTenant Postgres
AES vaultGCM tokens
OpenAI / xAIOpt-in inference
StripeBilling · CHD

Clerk sessions gate every sensitive API. Forged cookie UIDs are rejected. Integration secrets use AES-256-GCM. Stripe holds cardholder data — Route5 stays out of PCI CHD scope.

Trust boundaries

  • Product desk

    Linear SPA mirror at /app/* + thin bridge (route5-desk-runtime.js). No parallel React desks.

  • AI boundary

    Capture requires human approval. Enterprise AI opt-out enforced. No training on customer workspace data.

  • Tenant isolation

    Workspace-scoped queries. Legal hold, retention, and DSR honor org boundaries.

  • Residency

    Hosted SaaS defaults US-primary. EU residency / multi-region enforcement is pathway — discuss in sales for regulated deals.

Trust CenterAssurance JSON