Systems Architecture
Architected for Deterministic Speed,
Cryptographic Isolation & Zero-Loss Integrity
Most modern enterprise software consists of 20 uncoordinated microservices bound together by fragile HTTP webhooks. Neo OS replaces this fragile paradigm with a unified relational data layer, client-side encryption, and strict double-entry invariant validation.
18ms
Local Ledger Query Latency
100%
Debit/Credit Invariant Proof
AES-256
Authenticated GCM Encryption
0ms
Webhook Failure Downtime
Systems Topology
The 5 Core Architectural Subsystems
Engineered from foundational principles to eliminate single points of failure, synchronization conflicts, and security breaches.
SUBSYSTEM 01 // DATA INTEGRITY CORE
Double-Entry Financial Invariant Engine
Traditional SaaS tools treat invoices, inventory counts, and account balances as arbitrary database rows that can be mutated independently. Neo OS enforces strict financial immutability at the database driver level.
• Zero Floating Point Drift: All currency amounts are stored in scaled 64-bit BigInt precision to eliminate IEEE 754 rounding vulnerabilities.
• Atomic Debit/Credit Balancing: Every commercial event requires an equal and opposite journal entry. Unbalanced journal entries are rejected by database triggers.
• Cryptographic Merkle Hash: Every completed fiscal day generates a SHA-256 audit root hash, making retroactive ledger tampering computationally impossible.
• Atomic Debit/Credit Balancing: Every commercial event requires an equal and opposite journal entry. Unbalanced journal entries are rejected by database triggers.
• Cryptographic Merkle Hash: Every completed fiscal day generates a SHA-256 audit root hash, making retroactive ledger tampering computationally impossible.
// Invariant Validation Trigger
CREATE OR REPLACE FUNCTION verify_ledger_balance()
RETURNS TRIGGER AS $$
DECLARE
v_debit_sum NUMERIC(18,4);
v_credit_sum NUMERIC(18,4);
BEGIN
SELECT COALESCE(SUM(debit), 0), COALESCE(SUM(credit), 0)
INTO v_debit_sum, v_credit_sum
FROM journal_entries
WHERE transaction_id = NEW.transaction_id;
IF v_debit_sum != v_credit_sum THEN
RAISE EXCEPTION 'Double-Entry Invariant Violation:
Debits (%) != Credits (%)', v_debit_sum, v_credit_sum;
END IF;
RETURN NEW;
END;
$$ LANGUAGE plpgsql;
SUBSYSTEM 02 // CIPHER & SECURITY LAYER
Client-Side Authenticated Cryptography (AES-256-GCM)
Enterprise confidential data (customer credit card tokens, secret commercial contracts, employee compensation packages) is encrypted on the client device before touching network cables.
• Browser-Native Web Crypto: Utilizes hardware-accelerated cryptographic primitives directly within modern browser engines without external third-party dependencies.
• Tenant-Derived Key Hierarchy: Encryption keys are derived using PBKDF2 with 600,000 iterations from corporate master passkeys. Even a compromised database leak reveals only encrypted ciphertext.
• Granular RBAC Decryption: Data can only be decrypted by authorized team members whose cryptographic session tokens possess the matching capability role.
• Tenant-Derived Key Hierarchy: Encryption keys are derived using PBKDF2 with 600,000 iterations from corporate master passkeys. Even a compromised database leak reveals only encrypted ciphertext.
• Granular RBAC Decryption: Data can only be decrypted by authorized team members whose cryptographic session tokens possess the matching capability role.
// Web Crypto AES-256-GCM Execution
async function encryptPayload(data, derivedKey) {
const iv = crypto.getRandomValues(new Uint8Array(12));
const encoded = new TextEncoder().encode(JSON.stringify(data));
const ciphertext = await crypto.subtle.encrypt(
{ name: "AES-GCM", iv: iv, tagLength: 128 },
derivedKey,
encoded
);
return { cipherHex: bufToHex(
ciphertext),
ivHex: bufToHex(iv),
timestamp: Date.now()
};
}
async function encryptPayload(data, derivedKey) {
const iv = crypto.getRandomValues(new Uint8Array(12));
const encoded = new TextEncoder().encode(JSON.stringify(data));
const ciphertext = await crypto.subtle.encrypt(
{ name: "AES-GCM", iv: iv, tagLength: 128 },
derivedKey,
encoded
);
return { cipherHex: bufToHex(
ciphertext),
ivHex: bufToHex(iv),
timestamp: Date.now()
};
}
SUBSYSTEM 03 // OFFLINE & PERSISTENCE
Local-First Reactive State & Sync Engine
Operations should never halt because a fiber-optic cable was cut or an airport Wi-Fi captive portal expired. Neo OS operates on a local-first paradigm with encrypted IndexedDB storage.
• Sub-10ms UI Interactions: All reads and writes occur instantly in local memory and disk, resulting in zero perceived network latency.
• CRDT Vector Clocks: Distributed conflict resolution ensures multi-user concurrent edits to notes, tasks, or customer profiles merge deterministically without data overwriting.
• Resilient Background Replay: Queued mutations are serialized and automatically replayed against the central database upon connection re-establishment.
• CRDT Vector Clocks: Distributed conflict resolution ensures multi-user concurrent edits to notes, tasks, or customer profiles merge deterministically without data overwriting.
• Resilient Background Replay: Queued mutations are serialized and automatically replayed against the central database upon connection re-establishment.
// Sync Vector Clock Protocol
interface MutationQueueItem { readonly mutationId: UUID;
readonly entity: 'invoice' | 'deal' | 'journal';
readonly vectorClock: Record;
readonly payloadCipher: string;
readonly checksum: SHA256;
readonly retryAttempts: number;
}
interface MutationQueueItem { readonly mutationId: UUID;
readonly entity: 'invoice' | 'deal' | 'journal';
readonly vectorClock: Record
readonly payloadCipher: string;
readonly checksum: SHA256;
readonly retryAttempts: number;
}
Metric Description
General LedgerQuery (100k Rows)
Invoice Generation & Ledger Post
Cold Start Time (Full Application)
Offline To Online Sync (500 Records)
Zero-Knowledge Encrypted Payload Size
Invoice Generation & Ledger Post
Cold Start Time (Full Application)
Offline To Online Sync (500 Records)
Zero-Knowledge Encrypted Payload Size
Neo OS Engine
14.2 ms
38.5 ms
1.2 s
180 ms
+16 bytes (Auth Tag)
38.5 ms
1.2 s
180 ms
+16 bytes (Auth Tag)
Industry Standard (SaaS Average)
840.0 ms
3,200.0 ms (Zapier/API)
6.8 s (SAP/NetSuite)
Manual Refresh / Error prone
+40% (Base64 JSON overhead)
3,200.0 ms (Zapier/API)
6.8 s (SAP/NetSuite)
Manual Refresh / Error prone
+40% (Base64 JSON overhead)
Engineering Method
In-Memory Indexed Tree
Single Relational Transaction
Tree-Shaken WebOS Bundle
Batch Vector Replay
Compact Binary Buffers
Single Relational Transaction
Tree-Shaken WebOS Bundle
Batch Vector Replay
Compact Binary Buffers
Enterprise Deployment
Three Sovereign Deployment Architectures
Managed Multi-Tenant Cloud
Best for agile SMBs and growing agencies. Hosted on high-performance European & Global regions with automated row-level security (RLS) isolation and continuous geographic backups.
Best for agile SMBs and growing agencies. Hosted on high-performance European & Global regions with automated row-level security (RLS) isolation and continuous geographic backups.
Setup Time: Instant // SLA: 99.9%
Dedicated Single-Tenant VPC
Isolated database instances and dedicated computation nodes running in your preferred cloud provider (AWS, GCP, Azure, or Hetzner). Zero shared infrastructure with other tenants.
Isolated database instances and dedicated computation nodes running in your preferred cloud provider (AWS, GCP, Azure, or Hetzner). Zero shared infrastructure with other tenants.
Setup Time: 48 Hours // SLA: 99.99%
Air-Gapped On-Premises
Packaged as Docker containers or Kubernetes Helm charts for sovereign deployment behind national or corporate firewalls. 100% data residency and compliance with local banking regulations.
Packaged as Docker containers or Kubernetes Helm charts for sovereign deployment behind national or corporate firewalls. 100% data residency and compliance with local banking regulations.
Setup Time: 1 Week // Custom Licensing
Technical & Security FAQ
Does Neo OS use proprietary data formats or database engines?
No. We strictly adhere to open standards. Our relational backend relies on standard ANSI SQL and PostgreSQL. You can export complete relational database dumps at any time and inspect every table using standard open-source tools like DBeaver or psql.
No. We strictly adhere to open standards. Our relational backend relies on standard ANSI SQL and PostgreSQL. You can export complete relational database dumps at any time and inspect every table using standard open-source tools like DBeaver or psql.
How are WebRTC peer-to-peer audio and video calls routed?
Video calls use browser-native WebRTC with SRTP/DTLS encryption. Peer connections connect directly between users' machines. When strict corporate NAT firewalls prevent direct peer-to-peer connection, encrypted media packets traverse our zero-logging TURN servers without decryption keys.
Video calls use browser-native WebRTC with SRTP/DTLS encryption. Peer connections connect directly between users' machines. When strict corporate NAT firewalls prevent direct peer-to-peer connection, encrypted media packets traverse our zero-logging TURN servers without decryption keys.
How does Neo OS ensure AI features do not leak proprietary corporate data?
Our intelligence features use deterministic mathematical routines for financial calculations (runway, taxes, margins) rather than generative approximations. When LLMs are used for OCR document parsing, requests pass through private enterprise endpoints with zero data retention and strict guarantees that data is never used for training.
Our intelligence features use deterministic mathematical routines for financial calculations (runway, taxes, margins) rather than generative approximations. When LLMs are used for OCR document parsing, requests pass through private enterprise endpoints with zero data retention and strict guarantees that data is never used for training.
© 2026 Neos Technologies Inc.