Event-Driven Notification Platform

Architecture Views

26 views, in reading order. Every view ships three ways: an HTML page, an SVG that re-opens in diagrams.net fully editable, and draw.io source.

Read the set in order. Acts 1 and 2 fix the boundary and the structure; act 3 says what is stored, who owns it and what may be sent to whom; act 4 shows what actually happens when an event arrives, including when it fails; act 5 covers running it; act 6 covers why it is safe and what breaks. Six decisions carry the design: events and notifications are separate domains with separate storage; rules are evaluated in a stateful stream job rather than per-event RPC; durable workflow state is used only for the 15 percent of traffic that needs delay, fallback or multi-step behaviour; three priority tiers run end to end so a marketing burst cannot delay a one-time passcode; personally identifiable data is resolved at render time and never touches the bus or the archive; and at-least-once with idempotent consumers is the stated contract, with deduplication that fails open so the platform duplicates rather than drops.

1 · Context and scope

The boundary: who publishes, who receives, and what the platform never owns.

01 System Context Who publishes events, who receives notifications, and where the platform boundary sits. HTML page SVG draw.io

02 High-Level Architecture The shape of the platform in one picture, for the reader who will see only one. HTML page SVG draw.io

2 · Structure

The layers, the deployable units, every interface, the channel contract, how content is governed, and what tenants share.

03 Layered Architecture What depends on what, and the single dependency that points the wrong way. HTML page SVG draw.io

04 Container and Component Architecture Every deployable unit, its technology, its replica floor, and the protocol on every hop. HTML page SVG draw.io

05 Integration and Interface Catalogue Every way something enters or leaves the platform, with protocol, cadence and owner. HTML page SVG draw.io

06 Channel Abstraction The five-step contract every channel implements, and what differs between them. HTML page SVG draw.io

07 Template and Content Lifecycle How a message goes from draft to published, and how a bad one is taken back. HTML page SVG draw.io

08 Multi-Tenancy and Noisy-Neighbour Control What every tenant shares, what each one gets alone, and what stops one from hurting the rest. HTML page SVG draw.io

3 · Data

Three separate domains — event, notification, delivery — where each lives, for how long, and what consent permits.

09 Data Flow Where data comes from, what it becomes at each stage, and the one stage where PII appears. HTML page SVG draw.io

10 Event Topology and Priority Tiers Which topics exist, why three tiers, how ordering is guaranteed, and how a stuck message gets out. HTML page SVG draw.io

11 Data Architecture and Retention What is authoritative, what is rebuildable, and how long each thing lives. HTML page SVG draw.io

12 Core Data Model The entities a decision reads and writes, and how they join. HTML page SVG draw.io

13 Preference, Consent and Override Policy Which notifications may ignore a stated preference, and on what authority. HTML page SVG draw.io

4 · Runtime

The decision an event triggers, the path a message takes, when it is sent, and what happens when a provider fails.

14 Notification Orchestration The seven questions asked of every event, in order, and what happens when the answer is no. HTML page SVG draw.io

15 Event to Delivered Email The happy path end to end, with the latency budget at each hop. HTML page SVG draw.io

16 Timing, Scheduling and Digests Six ways a notification can be timed, and the one due-work stream they all converge on. HTML page SVG draw.io

17 Retry, Failover and Dead-Lettering What happens when a provider says no, and how a message that cannot be sent stays recoverable. HTML page SVG draw.io

5 · Operations

Where it runs, how a change reaches production, how it scales, what is watched, and how an operator answers a question.

18 Deployment and Failure Domains What runs where, what survives a zone loss, and what a region loss actually costs. HTML page SVG draw.io

19 Delivery Pipeline and Environments How a change reaches production, and what stops a bad one. HTML page SVG draw.io

20 Autoscaling, Capacity and Backpressure What each tier scales on, where scaling stops, and what the platform does once it has stopped. HTML page SVG draw.io

21 Observability and Operations Every signal, where it goes, and how a support engineer answers the question in one place. HTML page SVG draw.io

22 Administration and Operations Surface What an operator can do, who may do it, and which actions are dangerous enough to gate. HTML page SVG draw.io

23 The Operator Loop How an alert becomes an answer, a fix and a clean backlog, without leaving a gap. HTML page SVG draw.io

6 · Assurance

Trust boundaries, the secretless producer path, and every failure mode with the cover for it.

24 Security Architecture — Trust Zones Where the boundaries are, what crosses them, and where an attacker actually arrives. HTML page SVG draw.io

25 Identity and Access — Producer Authentication How a producing workload proves who it is without ever holding a long-lived secret. HTML page SVG draw.io

26 Failure Modes and Disaster Recovery Everything that can break, what covers it, and the one trade-off deliberately accepted. HTML page SVG draw.io

Open svg/<view>.svg or drawio/<view>.drawio in draw.io Desktop or at app.diagrams.net to edit. The SVG carries the diagram inside it, so it is both the picture and the source. This folder is self-contained — copy it whole and every link still resolves.