Consumer Messaging Platform — WhatsApp-Class System  ·  View 17 of 23

Data Architecture and Ownership Zones

Data grouped by who owns it and whether it can be rebuilt — the question that decides what a regional outage actually costs.

Editable source SVG draw.io All views
On device — system of record for plaintext
On device — system of record for plaintext
Conversation data
Conversation data
Chat Database
SQLCipher, full history
Chat Database...
Media Cache
Decrypted blobs
Media Cache...
Search Index
Local only
Search Index...
Cryptographic material
Cryptographic material
Session & Ratchet State
Session & Ratchet State
Identity Private Key
Hardware backed
Identity Private Key...
Server — transient, rebuildable
Server — transient, rebuildable
In flight
In flight
Undelivered Ciphertext
TTL 30 d
Undelivered Ciphertext...
Delivery Queue
Per device
Delivery Queue...
Media Blob
TTL 30 d
Media Blob...
Ephemeral state
Ephemeral state
Presence
TTL 60 s
Presence...
Typing State
TTL 10 s
Typing State...
Socket Registry
Rebuilt on reconnect
Socket Registry...
Server — durable metadata, never content
Server — durable metadata, never content
Account and social graph
Account and social graph
Account & Device Registry
Account & Device Registry
Group & Community Metadata
Group & Community Metadata
Block & Privacy Settings
Block & Privacy Settings
Keys and safety
Keys and safety
Public Prekey Bundles
Public Prekey Bundles
Backup Key Vault
HSM, rate limited
Backup Key Vault...
Abuse & Report Records
Retention 90 d
Abuse & Report Records...
Cloud Backup Providers
Cloud Backup Providers
CDN Edge Cache
CDN Edge Cache
encrypted backup
encrypted backup
origin pull
origin pull
drained on delivery
drained on delivery
key escrow, user held
key escrow, user held
Data Architecture and Ownership Zones
Data Architecture and Ownership Zones
Data store
Data store
Security / platform
Security / platform
Queue / topic
Queue / topic
External / third party
External / third party
batch
batch
synchronous
synchronous
event / async
event / async
Everything above the durable band is rebuildable or expendable. Losing it costs delivery latency, not history.
Everything above the durable band is rebuildable or expendable. Losing it costs delivery latency, not history.
v 1.0 · owner Platform Architecture · date 2026-08
v 1.0 · owner Platform Architecture · date 2026-08Text is not SVG - cannot display

Three zones

  • On device: the only plaintext, and the system of record for chat history
  • Server transient: in-flight ciphertext and ephemeral state, all TTL-bounded
  • Server durable: account, group, key and safety metadata — never content

Rebuildability

  • Everything in the transient zone is expendable; losing it costs delivery latency
  • Prekey bundles are re-published by devices on reconnect
  • The durable zone is the only tier that needs a genuine backup and restore plan

Retention

  • Undelivered ciphertext and media blobs: 30 days maximum
  • Presence 60 seconds, typing 10 seconds, socket registry until reconnect
  • Abuse and report records: 90 days, then aggregated and purged
Solution Architecture v1.0 · Platform Architecture · 2026-0817-data-architecture