Consumer Messaging Platform — WhatsApp-Class System

Who uses the platform, which external services it depends on, and what crosses the boundary — with no internal components shown.

The shape of the system in one picture: clients hold a persistent authenticated socket, the core accepts and orders, and fanout drives delivery per device.

What depends on what. Dependencies point downward only; delivery back to a device re-enters through the edge layer rather than reversing a dependency.

The deployable units, their technology, and the protocol on every link — C4 level 2 for the messaging core.

Phone-number sign-up end to end: verification, attestation, identity key generation, prekey publication and contact discovery.

The primary flow: compose, encrypt, accept, fan out, deliver and confirm — with the idempotency gate that makes a client retry harmless.

Every message state, what triggers it, who emits it, what the sender sees, and how long the server keeps anything at all.

Four conversation classes, four fanout strategies — showing where the cost sits and why group messaging stays affordable at 1024 members.

The loop that makes delivery survive a device being off, offline or asleep — and the acknowledgement that closes it.

Photos, video, documents and voice notes: compressed and encrypted on device, stored as opaque bytes, distributed by CDN.

Three ephemeral signal classes and the privacy gate that decides whether any of them are visible at all.

From device key material through asynchronous session setup to per-message ratcheting — and where the platform sits, which is outside the trust boundary.

Linking a companion device, seeding its history, and keeping four devices consistent without making the phone a relay.

WebRTC signalling over the existing chat socket, keys derived from the Signal session, and an SFU that forwards frames it cannot read.

Ephemeral posts with an audience resolved at publish time, encrypted per post, and hard-deleted at 24 hours.

Where conversation data actually lives, what the platform can search, and how a user moves history to a new phone without the platform reading it.

Data grouped by who owns it and whether it can be rebuilt — the question that decides what a regional outage actually costs.

Thirteen entities covering accounts, devices, keys, conversations, envelopes, receipts and media — and the column that is conspicuously absent.

Every way the platform touches another system, with the protocol and cadence on each interface and the direction of the call.

Five zones in decreasing exposure, the attacks that arrive at each, and what stops them — with the flow crossing every boundary labelled.

What runs where and what survives a failure: anycast edge, two active regions, three availability zones each, accounts pinned to a home region.

How a change reaches production and what stops a bad one — including the gates that exist specifically because this system carries cryptography.

Six signal classes across five pipeline stages, each ending in a defined action — the matrix form makes a missing cell visible.