How ShadowClan is built
A plain-language look at the pieces behind the app, how they keep your data safe, and how they grow with the community. High-level on purpose: we never publish internal addresses, keys or account details.
Architecture
You
Browser or installed app
The same app on desktop and phone. Everything travels over encrypted HTTPS.
Frontend
Web app on a global CDN
Pages are served from a content delivery network close to you, with strict browser security headers.
Backend
Sign-in service
Managed authentication with email, Google, two-factor codes and passkeys. Passwords never reach our servers.
API service
Stateless containers that check every request, apply access rules and rate limits, and power real-time chat.
Data
Managed database
A managed PostgreSQL database reached only over an encrypted, authenticated connection, and encrypted at rest.
File storage
Photos, CVs and chat files in object storage, with per-member folders and type and size rules.
Secrets vault
Keys and passwords live in a managed vault, never in code or in the app you download.
Scheduled jobs
Reminders, digests and clean-up run on a schedule, separate from the requests you make.
Monitoring
Errors and slow requests are tracked so we can fix problems, often before anyone notices.
Security
- Encrypted in transit (HTTPS) and at rest.
- Two-factor sign-in and passkeys are available to every member; admins must confirm with two-factor before sensitive actions, and those actions are logged.
- Short-lived sessions that can be signed out from every device in Settings.
- Access rules on every request and every file: private files are only reachable through links given to the people who should see them.
- Rate limits and automatic checks against spam, scraping and abuse.
- Every release goes to a separate test environment first, passes automated functional and security tests, and needs owner approval before it reaches you.
- You can export or erase your data at any time, and we don't sell member data.
Scalability
- The API runs in stateless containers that add or remove copies automatically as traffic changes.
- Pages and images are cached on the CDN, so most of what you load doesn't touch our servers.
- Long lists (feeds, messages, search results) load in pages instead of all at once.
- Slow work such as emails and reminders runs in the background, so your clicks stay fast.
- Every release is load-tested against response-time budgets before it ships.
Found a security issue? Email info@shadowclan.in. Read how we handle your data in our Privacy Policy.
Request an invitation