PostgreSQL & persistence

The database stores isolation, idempotency, and history. API restarts do not erase integrations or sessions.

Model

• Identity: User, Session, Account, Verification, Membership.
• Platform: Workspace, ApiKey, Integration.
• Checkout: CheckoutSession, Payment, PaymentEvent.
• Delivery: WebhookEndpoint, WebhookDelivery.
• Operations: AuditLog, ApiRequestLog, RateWindow.

Each account has one business; Workspace and membership identifiers still scope dependent records. Relations use foreign keys. Sessions have a unique workspace/idempotency key; payments are unique per session; events and deliveries have their own deduplication constraints.

Migrations

pnpm db:generate
pnpm db:deploy
# Development only, after changing the schema:
pnpm db:migrate --name describe_the_change

Version SQL migrations and review destructive changes. Do not replace production migrations with db push. Back up before migration and test compatibility with the previous image.

Sensitive data

Payer and prefill fields are encrypted. Checkout capabilities have authentication digests plus encrypted copies for idempotent responses. API credentials have digests only; webhook signing secrets are encrypted.

Backup and retention

Schedule pg_dump to encrypted off-host storage and test restoration to an isolated database. A Docker volume is not a backup. Define retention for sessions, requests, events, and personal data before production; the worker already removes old rate-limit windows.

Platform additions

Business receiving configuration stores fixed destinations by network and asset. The global 4P credential is operator-managed outside these tenant settings. Any legacy ProviderConnection records are not authority to enable live payments or a supported source of per-business provider keys. NotificationInbox durably stores notification tokens with retry leases. EmailOutbox stores encrypted recipients, plain text and HTML with immutable sender/provider metadata, an idempotency key digest, credential binding, attempts and provider acceptance identifiers. Its accepted status is not a delivery receipt; inconclusive SMTP sends become uncertain instead of being replayed blindly. SupportMessage stores encrypted submissions. All require an explicit retention policy before collecting production personal data at scale.