ProjexCloud · Tech Stack & Cost Plan · v3.1
Recommended Stack — with Licensing & Service Costs for Production Launch
The opinionated tech stack for ProjexCloud across every layer, with per-component cost estimates for initial production launch (10 design-partner tenants · 1 region · 1-2 verticals live · ~100k API calls/day) and scaling notes through Y2-Y5 growth. Recommendations are dependency-derived from the v3.1 architecture and respect the Opinionated Constraints + Polyglot Persistence doctrines.
Cost framing. Every per-component cost in this doc reflects the initial production launch profile: ~10 paying tenants, 1 region (us-east-1 baseline), 1-2 verticals live, ~100k API calls/day total, ~100GB OLTP data, ~500GB blob storage. Where applicable, we show the scaling curve at 100 / 1,000 / 10,000 / 100,000 tenants in §20. Costs marked passthrough are mostly re-billed to tenants via sdk-meter's passthrough_plus_margin pricing mode — they appear on our P&L but net out against tenant revenue at the catalog margin.
1 · Overview & Decision Principles
This document is the authoritative reference for "what to build with." Every choice below is dependency-derived from the v3.1 architecture, not preference-driven. Where the docs already commit a choice (e.g., PostgreSQL + Kafka + S3 in §8B), this doc reaffirms and adds the specific product/version. Where the docs leave a choice open (e.g., backend framework, ORM, frontend SPA framework), this doc commits a recommendation with rationale.
Principle 1
Dependency-derived, not preference
Choices follow the architectural doctrines (§3A Opinionated Constraints · §3B Localize Complexity · §8B Polyglot Persistence). Where a doctrine says "Postgres pools are for OLTP + PII only," the stack reflects that — no Postgres-as-cache, no Postgres-as-queue.
Principle 2
Owned, not rented
Prefer libraries you copy and own (shadcn/ui · Radix · Drizzle SQL) over heavy frameworks that take control. Matches the Rule of Three: ship one approach; the platform doesn't grow flexibility-creep.
Principle 3
Cost-honest, scale-explicit
Every component named with a cost estimate at production launch. No "we'll figure out infra cost later." Polyglot persistence means many components — the bill must be modelable from day one.
2 · Languages
TypeScript · Kotlin (Android) · Swift (iOS)
COMMITTED
Pick
TypeScript everywhere possible · Kotlin for HDK Android natives · Swift for HDK iOS natives
Why
Single language across server + client + mobile facade reduces context switching. TypeScript's structural type system matches our contracts-first discipline. Kotlin/Swift natives are the only real option for HDK (offline biometric · camera · AR · device attestation).
Versions
TypeScript 5.7+ · Node.js 22 LTS (or Bun for hot-path services) · Kotlin 2.1 · Swift 6
When Rust
Reserve for sustained sub-ms hot paths if Node ever proves insufficient (sdk-meter gate · sdk-pool-router · sdk-identity-resolver projector). Default is TypeScript; Rust is an escape valve, not a starting point.
Alternatives ruled out
Go — strong concurrency but second language to maintain. Java/Kotlin server — JVM tax + dual-stack. Python — fine for ML pipelines (we can use it for parsing/embedding workers); not for the SDK estate.
Cost (initial launch)
$0 — all open source.
3 · Backend Framework
Fastify (default service binary framework)
RECOMMENDATION
Pick
Fastify 5+ for every service binary (identity-service · audit-service · meter-collector · billing-service · ai-gateway-service · etc.)
Why
TypeScript-first; Zod/JSON Schema validation integrates cleanly with our typed contracts; plugin ecosystem mature (helmet · cors · rate-limit · jwt · circuit-breaker); ~30% faster than Express which matters for sdk-meter's ≤2ms gate budget. Hooks system maps to @meter + withTenant + audit-emit middleware naturally.
For hot paths
If meter gate or pool router p99 budget proves tight (≤2ms / ≤5ms respectively), drop to uWebSockets.js for that one service. As a last resort, a Rust microservice. But Fastify handles ≤2ms p99 for typical workloads.
Alternatives ruled out
NestJS — opinionated framework conflicts with our SDK-as-package architecture; adds dependency injection complexity we don't need. Hono — newer; less battle-tested at scale. Encore.ts — vendor lock-in. Express — slower, weaker TS story.
Cost
$0 — open source. Operational cost is the Node.js runtime in containers (counted in §16 Kubernetes).
4 · API Style
REST + OpenAPI (public) · gRPC (internal) · SSE (streaming)
RECOMMENDATION
Pick
REST + OpenAPI 3.1 for every SDK public surface — customer developers use TypeScript, Python, Go, Java, etc., and OpenAPI generates typed clients for all of them.
gRPC for internal service-to-service hot paths (meter event emission → collector; projector → resolver; lineage edges → projection worker).
Server-Sent Events (SSE) for streaming (AI gateway response streams; /billing/live real-time meter; live workflow logs).
Schema source
OpenAPI specs auto-generated from Zod schemas in @projexlight/contracts via zod-to-openapi. SDK code generated from OpenAPI via openapi-typescript + hand-curated wrappers.
Alternatives ruled out
GraphQL — overkill given typed SDKs already give type safety; adds runtime complexity + N+1 risk. tRPC — too coupled to TypeScript; blocks customer apps in other languages. SOAP — no.
Cost
$0 — all open standards and OSS tooling.
5 · ORM / Query Builder
Drizzle ORM
RECOMMENDATION
Why
Type-safe SQL builder with great migration story. Doesn't abstract SQL away — we need raw SQL for RLS, partial indexes, PostGIS queries, and the per-pool per-SDK schema model from §8A. Migration files are SQL (DBA/Finance can review them). Tight bundle, minimal runtime overhead.
Migrations
Drizzle Kit generates SQL migrations from schema changes. Per-SDK db/migrations/ orchestrated by tools/migration-runner per pool in dependency order (matches ProjectStructure §6.3).
Alternatives ruled out
Prisma — too heavy; migration story controversial; abstracts SQL too far for our RLS/PostGIS/partition needs. TypeORM — legacy; weaker TS. Kysely — also excellent; equally valid pick (we choose Drizzle for slightly better migration ergonomics). Raw pg — too low-level for productivity.
6 · Database (PostgreSQL)
PostgreSQL 17
COMMITTED
Pick
PostgreSQL 17 per pool, per SDK schema (e.g., identity.*, payment.*, engagement.*), RLS per tenant — exactly as §8A Pool Placement Matrix mandates.
Extensions
pgcrypto (column-level encryption helpers) · pgvector (vector embeddings for RAG v1) · pg_partman (time-based partitioning) · pgaudit (Postgres-level audit trail) · pg_trgm (text-similarity search) · postgis (sdk-geo)
Production hosting
AWS Aurora Postgres Serverless v2 per pool — auto-scales 0.5-128 ACUs per cluster; built-in Multi-AZ; PITR included; lowest-ops choice.
Alternative: AWS RDS Postgres Multi-AZ for fixed-size pools (cheaper at steady state; more ops).
For BYOC/sovereign/on-prem: self-managed with Patroni or Stolon for HA.
Initial launch sizing
3 pools (1 admin · 1 healthcare app · 1 realty app), each Aurora Serverless v2 starting at 1 ACU (~1 vCPU + 2GB), auto-scaling to 8 ACUs on demand.
Cost (initial launch)
~$1500–2500/mo for 3 Aurora Serverless v2 clusters (1-2 ACU baseline each + storage $0.10/GB-mo + I/O charges). RDS Multi-AZ alternative ~$2000–3000/mo. Self-managed on EC2: ~$1000/mo + ops overhead.
Cost at scale
100 pools (Year 2-3): ~$20-40k/mo · 1000 pools (Year 4): ~$200-400k/mo (much of this is billed back via meter passthrough).
7 · Polyglot Storage (the non-Postgres tier)
Per Architecture §8B, the workloads listed below do not go in Postgres. Each gets its purpose-built engine.
Cache + Identity Projection — Dragonfly (or Redis 7)
RECOMMENDATION
Pick
Dragonfly (Redis-compatible) or vanilla Redis 7+ — drop-in choice based on ops preference
Why Dragonfly
Better memory efficiency (~30% lower) and faster multi-core throughput than Redis. Matters because the Identity Projection store (§2B in AIM) holds 10M+ subjects at scale.
Hosting options
AWS ElastiCache (Redis) Multi-AZ · Upstash serverless (pay-per-request) · Dragonfly Cloud · self-managed
Cost (initial launch)
~$300/mo — 1 ElastiCache cluster (cache.r6g.large Multi-AZ ~$280/mo) OR Upstash starter (~$50-150/mo for light usage) OR Dragonfly Cloud ~$200/mo dev tier.
Telemetry & Usage Rollups — ClickHouse
COMMITTED
Pick
ClickHouse shared cluster partitioned by pool_index (NOT per-pool ClickHouse). Required for sdk-meter rollups and sdk-analytics hot queries.
Hosting options
ClickHouse Cloud · Altinity · self-managed on EC2 (3-node m6id cluster)
Cost (initial launch)
~$500/mo — ClickHouse Cloud production tier minimal · self-managed 3-node ~$450/mo + ops.
Search — OpenSearch
COMMITTED
Pick
OpenSearch 2.x per-pool indexes (sdk-search owns); AWS-friendly Elasticsearch fork.
Hosting
AWS OpenSearch Service Multi-AZ recommended for production.
Cost (initial launch)
~$800/mo — 3-node r6g.large.search Multi-AZ cluster.
Blob Storage — AWS S3 (or GCS / Azure Blob / MinIO)
COMMITTED
Pick
AWS S3 Standard for hot blobs; S3 Intelligent-Tiering for evidence/media that ages out. Per-tenant prefix; encrypted under sdk-vault keys. Multi-cloud: GCS · Azure Blob · MinIO on-prem.
Cost (initial launch)
~$25/mo — 500GB storage ($0.023/GB-mo = $11.50) + request costs (~$10) + data transfer (~$5).
Cost at scale
10TB (Year 3): ~$250/mo · 1PB (Year 5): ~$23k/mo. Mostly billed to tenants via per-MB SKUs.
Vector Store — pgvector (v1) → Qdrant or Pinecone (scale)
COMMITTED
Pick (v1)
pgvector extension in each App Pool's Postgres (free). Works to ~10M vectors per pool. CI monitors vector count per pool; at 8M, plan migration to dedicated store.
Pick (scale)
Qdrant (self-hosted, Rust, fast) for Tier-G with dedicated cluster · Pinecone (managed) for SaaS production at hyperscale
Cost (initial launch)
$0 — pgvector included in Postgres.
Cost at scale
Pinecone starter ~$70/mo; production tier ~$500-2000/mo. Qdrant self-hosted ~$300-500/mo per cluster.
Lakehouse (P7) — Iceberg + Trino + Glue/Polaris Catalog
COMMITTED
Pick
Apache Iceberg on S3 as the table format · AWS Glue Data Catalog or Apache Polaris as catalog · Trino (or AWS Athena) as query engine. Ships in Phase 7.
Cost (initial launch)
$0 initial — Iceberg lands in Phase 7 (week 44-50). Pre-P7 budget Iceberg infra investment ~$2-5k/mo.
Key Management — AWS KMS · GCP KMS · HSM
COMMITTED
Pick
Provider chosen by deployment variant: AWS KMS for AWS deployments · GCP KMS for GCP · HashiCorp Vault for self-managed/on-prem · HSM (CloudHSM / KeyVault Premium / Thales Luna) for FIPS-140-2 L3 + sovereign. BYOK customers plug their own KMS via sdk-secrets abstraction.
Cost (initial launch)
~$200–400/mo AWS KMS: $1/key/mo × ~200 keys (Pool KEKs + Tenant Keys; envelope encryption minimizes key count) + $0.03/10k requests × ~3M requests/mo ≈ $9-15. Bulk: ~$220-400/mo.
Cost at scale
1000 tenants: ~$1500-3000/mo. Mostly billed back via tenant usage SKUs.
8 · Event Streaming
Redpanda (preferred) or Apache Kafka
RECOMMENDATION
Pick
Redpanda — Kafka-compatible (no code changes for producers/consumers) but no ZooKeeper/JVM. Simpler ops at our 200+ pool scale.
Why Redpanda
~6-10× lower TCO than self-managed Kafka per Redpanda's benchmarks. Single-binary deployment. Strong consistency by default. Wire-compatible with Kafka tooling.
Hosting options
Redpanda Cloud BYOC (deployed in your AWS/GCP account) · Redpanda Cloud Dedicated · self-managed on EC2 · for vanilla Kafka: AWS MSK or Confluent Cloud
Cost (initial launch)
~$700/mo — Redpanda Cloud BYOC starter or self-managed 3-node i4i.large cluster (~$400-700/mo). AWS MSK ~$800-1500/mo. Confluent Cloud starts ~$500/mo but ramps fast with throughput.
9 · Workflow Engine
Temporal
COMMITTED
Pick
Temporal — sdk-workflow wraps it; tenants never see Temporal directly. One Temporal namespace per pool family.
Hosting options
Temporal Cloud (managed; recommended for initial launch — significant ops savings) · self-hosted with Postgres or Cassandra backend
Cost (initial launch)
~$1000/mo Temporal Cloud production tier (starts ~$200/mo dev; production ramps with action volume). Self-hosted: ~$500/mo infra + heavy ops cost.
Cost at scale
Temporal Cloud bills per "Action" — at 10M actions/mo ~$3000-5000/mo.
10 · AI Providers + MCP
Multi-provider LLM SDKs + MCP SDK
COMMITTED
Pick
LLM provider SDKs (consumed by sdk-ai-gateway):
• @anthropic-ai/sdk (Claude Sonnet 4.7 / Opus 4.7 / Haiku 4.5)
• openai (GPT-5 / GPT-4.x)
• @google/generative-ai (Gemini)
• @aws-sdk/client-bedrock-runtime (Bedrock — Claude via AWS, Llama, others)
• ollama-js (local models for on-prem deployment)
MCP support: @modelcontextprotocol/sdk (consumed by sdk-mcp-bridge)
AI streaming UX: Vercel AI SDK for the conversation surfaces (Tenant Workspace + Conversation)
Cost (initial launch)
~$3000–5000/mo in LLM API costs (mostly billed back to tenants via passthrough_plus_margin SKUs; net cost ~$500-1000/mo). Anthropic Claude Sonnet 4.7: $3 input / $15 output per 1M tokens. Initial light AI usage: ~10M tokens/day = $100-300/day passing through.
MCP SDK: $0 (open source).
Vercel AI SDK: $0 (open source; Vercel hosting only if you use it).
Cost at scale
100 tenants with moderate AI use: $20-50k/mo passthrough (~$3-8k net at 15% margin). 1000 tenants: $200-500k/mo passthrough.
Langfuse (LLM observability)
COMMITTED
Pick
Langfuse for AI trace observability (sdk-ai-gateway emits per call)
Hosting
Langfuse Cloud Pro ($59/mo) for initial launch · Langfuse Cloud Team ($499/mo) at production scale · Self-hosted OSS (free + ops)
Cost (initial launch)
$59/mo Langfuse Cloud Pro.
11 · Frontend (3 Platform Portals)
Next.js 15 App Router (the 3 portals)
RECOMMENDATION
Pick
Next.js 15+ (App Router) for all three platform portals: ProjexCloud Admin · Tenant Admin · Tenant Workspace
Why
React Server Components match the data-heavy admin portal needs (cuts client JS); SSR matters for Tenant Admin (per-tenant subdomains with branding); huge ecosystem; Module Federation host for Tenant Workspace integrates well with Next.js + Webpack.
Module Federation
@module-federation/nextjs-mf for Tenant Workspace shell hosting vertical app remotes. Iframes for tenant custom apps (different React versions; security boundary).
Hosting
Containerized on our own Kubernetes (no Vercel lock-in). Alternative: customers self-hosting their custom apps on Vercel is supported via the npm SDKs.
Cost
$0 — open source. Hosting cost = Kubernetes nodes (see §16).
Design System — shadcn/ui + Radix UI + Tailwind CSS
RECOMMENDATION
Pick
shadcn/ui components (copied into @projexlight/design-system) · Radix UI primitives for accessibility · Tailwind CSS 4+ for utility-first styling
Why
"Owned not rented" — components are copied into our codebase, no upgrade hell. Radix gives WCAG 2.1 AA accessibility primitives (critical for enterprise + government buyers). Tailwind v4 zero-config.
React Native parity
react-native-web bridges design-system components to RN where applicable; mobile-specific primitives via React Native + HDK.
Alternatives ruled out
Mantine — full-featured but heavier · Chakra — velocity slowed · Ant Design — enterprise-y but stylistically opinionated · MUI — fights customization
Cost
$0 — all open source. (Tailwind CSS is MIT; shadcn/ui is MIT; Radix is MIT.)
Data fetching · State · Forms · Tables · Charts · Maps
RECOMMENDATION
Server state
TanStack Query (React Query) — server-state caching, deduplication, optimistic updates
Client state
Zustand — lightweight, TS-friendly. (Avoid Redux Toolkit — overkill for our needs.)
Forms + validation
React Hook Form + Zod (already using Zod in contracts)
Tables
TanStack Table — headless data tables (admin portals need)
Charts
Recharts (simple usage) or Visx (complex viz) or Apache ECharts (heavyweight dashboards)
Maps
Mapbox GL JS (matches sdk-geo provider choice; reuse access token)
Cost
$0 — all open source. Mapbox: free tier covers 50k MAUs/mo; $0.50 per 1k MAUs beyond.
12 · Mobile (HDK)
React Native (new architecture) + Kotlin/Swift
COMMITTED
Pick
React Native 0.78+ with New Architecture (Fabric renderer + TurboModules) for cross-platform UI · Kotlin 2.1 for Android native HDK modules · Swift 6 for iOS native HDK modules
Bridge tooling
react-native-codegen for TurboModule type-safe bridges; per-HDK TS facade auto-generated from native specs.
Build & distribution
Fastlane for iOS/Android CI builds · EAS Build (Expo Application Services) considered if we keep some Expo modules · iOS App Store Connect + Google Play Console for distribution
Cost
$99/year iOS Apple Developer Program + $25 one-time Google Play Console = ~$125/year. EAS Build optional: ~$99/mo Production tier (saves significant CI build infrastructure cost).
13 · Observability
OpenTelemetry + Grafana stack (or Datadog)
COMMITTED
Instrumentation
OpenTelemetry SDK — committed in @projexlight/telemetry foundation package. Auto-instruments Fastify, Drizzle, fetch, Kafka clients.
Backend (recommended)
Grafana Cloud — Tempo (traces) + Loki (logs) + Mimir (metrics). Free tier covers initial launch; Pro at $99/mo.
Backend (alternative)
Datadog — managed; richer feature set; significantly more expensive (~$15-30/host/mo + APM + logs)
AI traces
Langfuse (covered in §10)
Trace UI
sdk-trace (P6A) — our own cross-system trace viewer aggregates from OTel + sdk-audit + sdk-meter + sdk-lineage. Doesn't replace Grafana/Datadog — those are infra-level; sdk-trace is product-level.
Cost (initial launch)
$0–99/mo Grafana Cloud (free tier likely enough for initial; $99/mo Pro). OR ~$1500/mo Datadog (20-30 hosts) — only if you prefer managed and accept the bill.
Cost at scale
Grafana Cloud Pro scales to ~$500-2000/mo at production scale. Datadog scales to ~$5-15k/mo.
14 · Testing
Vitest + Playwright + k6 + Pact
RECOMMENDATION
Unit + integration
Vitest (Vite-based; faster than Jest; native ESM + TypeScript)
End-to-end
Playwright (browser automation; multi-browser; trace replay)
Load testing
k6 (Grafana-owned; JavaScript test scripts; matches PRD AC load tests for meter gate, pool router, ReBAC 10M edges)
Contract tests
Pact for cross-SDK contract tests (CI runs cross-consumer contract suite on every PR per Architecture §0)
Chaos tests
Chaos Mesh (Kubernetes-native; for the chaos drills mandated in PRDs)
Cost
$0 — all open source.
15 · Build, Monorepo, Releases & Private Registry
pnpm + turbo + Changesets + Verdaccio (or GitHub Packages)
COMMITTED
Monorepo
pnpm workspaces + turbo for caching builds (committed in v3.1 design)
Releases
Changesets for semver discipline; CI auto-publishes bumped packages on merge to main
Private registry
GitHub Packages — easiest if you already use GitHub; ~$0.25/GB storage + $0.50/GB transfer.
Cloudsmith — feature-rich (per-tenant tokens, fine-grained access); $99/mo+.
Verdaccio self-hosted — free + ops; great control.
Cost (initial launch)
$0–100/mo — GitHub Packages free for private repos up to 500MB; Cloudsmith Starter ~$99/mo if you want per-tenant token policy (relevant for ICP 4 tenant developers).
16 · Container Orchestration
Kubernetes + Helm + ArgoCD
COMMITTED
Pick
Kubernetes — committed. EKS on AWS, GKE on GCP, AKS on Azure. Vanilla K8s for on-prem.
Package & deploy
Helm charts per service (committed) · ArgoCD for GitOps (declarative deploys, multi-cluster)
Container runtime
containerd (K8s default) · base images: distroless for security and size · Node.js 22 slim for services
Service mesh
Defer initially. Add Linkerd (lightweight) or Istio (full-featured) when multi-cluster mTLS becomes a requirement (P7+).
Cost (initial launch)
~$700/mo — 1 EKS cluster control plane ($73/mo) + node group: 6 × c6i.xlarge ($600/mo) = ~$673/mo. Add ~$50/mo for load balancers (ALB/NLB).
Cost at scale
3 regions × 3 clusters Year 3: ~$10-20k/mo K8s + load balancing.
17 · CI/CD
GitHub Actions
RECOMMENDATION
Pick
GitHub Actions — ubiquitous, integrates with our private registry, simple runner self-hosting
Why
Same vendor as code hosting; lowest friction; private repo includes 50k build-minutes/mo free; self-hosted runners possible for heavy CI work (Android builds, e2e suites)
Alternatives ruled out
GitLab CI — fine if you're on GitLab. Buildkite — premium ops; overkill at our stage. Jenkins — high ops overhead.
Cost (initial launch)
$0–200/mo — first 50k minutes free for private repos; beyond at $0.008/min Linux. With self-hosted runners (cheap EC2), CI minutes cost can stay under $200/mo even at active development.
18 · Per-Deployment-Variant Variations
| Layer | SaaS default | BYOK | Sovereign Cloud | On-Prem / Air-Gapped |
|---|
| KMS | AWS KMS | Customer's KMS (AWS / GCP / HSM) | Partner-provided KMS | HashiCorp Vault on-prem / Thales HSM |
| Blob | AWS S3 | AWS S3 (CMK-wrapped) | Partner cloud S3-compatible | MinIO on-prem |
| Event bus | Redpanda Cloud BYOC | Same | Self-managed Redpanda | Self-managed Redpanda |
| Cache | ElastiCache | Same | Self-managed Redis/Dragonfly | Self-managed |
| OLTP | Aurora Serverless v2 | Same | Self-managed Postgres + Patroni | Self-managed Postgres + Patroni |
| OLAP | ClickHouse Cloud | Same | Self-managed ClickHouse | Self-managed ClickHouse |
| LLM | Anthropic + OpenAI + Gemini | Same | Region-allowed providers only | Local models (Llama 3.3 / Mistral via Ollama or vLLM) |
| Workflow | Temporal Cloud | Same | Self-managed Temporal | Self-managed Temporal |
| Observability | Grafana Cloud / Datadog | Same + customer SIEM forwarder | Self-managed Grafana | Self-managed Grafana |
19 · Initial Production Launch Cost Summary
The consolidated monthly cost for the initial production launch profile (10 design-partner tenants · 1 region us-east-1 · 1-2 verticals live · ~100k API calls/day · ~100GB OLTP · ~500GB blob).
19.1 · Recurring monthly infrastructure
| Component | Service / hosting | Monthly cost (USD) |
|---|
| Postgres (3 pools) | AWS Aurora Serverless v2 (or RDS Multi-AZ) | $2,000 |
| Cache + Identity Projection | AWS ElastiCache (or Dragonfly Cloud / Upstash) | $300 |
| Event streaming | Redpanda Cloud BYOC (or self-managed) | $700 |
| ClickHouse (telemetry + usage rollups) | ClickHouse Cloud production tier | $500 |
| OpenSearch (search) | AWS OpenSearch Service Multi-AZ | $800 |
| Blob storage | AWS S3 Standard + Intelligent-Tiering | $25 |
| KMS | AWS KMS | $300 |
| Workflow engine | Temporal Cloud production | $1,000 |
| Kubernetes (1 cluster + 6 nodes) | AWS EKS + c6i.xlarge nodes + load balancers | $750 |
| Vector store | pgvector (in Postgres) — $0 | $0 |
| Iceberg lakehouse | Defer to P7 — $0 initial | $0 |
| Observability (Grafana Cloud Pro) | Grafana Cloud Pro | $99 |
| AI traces (Langfuse Cloud) | Langfuse Cloud Pro | $59 |
| Private npm registry | GitHub Packages (or Cloudsmith $99) | $50 |
| CI/CD | GitHub Actions (private + light self-hosted runners) | $100 |
| DNS + domains | Route 53 + domain renewals (~$15/mo + ~$3/mo) | $20 |
| iOS + Android distribution | Apple Dev ($99/yr) + Google Play ($25 once) | $10 |
| SSL / code signing | Let's Encrypt (free) + code-signing cert | $50 |
| Subtotal · Infrastructure + Services | | ~$6,763 |
19.2 · Passthrough costs (mostly billed back to tenants)
| Component | Usage estimate | Monthly cost (USD) |
|---|
| LLM API costs (Anthropic + OpenAI + Bedrock) | ~10M tokens/day average across all tenants | $3,000–5,000 |
| SMS via Twilio (sdk-notification) | ~50k SMS/mo | $400 |
| Email via SES / SendGrid | ~500k emails/mo | $50 |
| WhatsApp BSP (Twilio) | ~10k conversations/mo | $300 |
| Maps (Mapbox) | Within 50k MAU free tier initially | $0 |
| Payment fees (Stripe) | Passthrough to merchant; net $0 platform cost | $0 |
| Subtotal · Passthrough | | ~$3,750–5,750 |
Net of passthrough billing: approximately $500–1,500/mo (revenue recovery via passthrough_plus_margin SKUs at 15% margin).
19.3 · Year-1 one-time costs
| Item | Cost (USD) |
|---|
| SOC2 Type I audit | $20,000–40,000 |
| HIPAA gap assessment + readiness | $15,000–30,000 |
| Penetration test (annual; required pre-SOC2) | $15,000–30,000 |
| Legal review (privacy policy · ToS · DPAs · BAAs) | $10,000–20,000 |
| Cyber-liability insurance (annual premium) | $5,000–15,000 |
| Subtotal · Year-1 one-time | ~$65,000–135,000 |
19.4 · The headline number
Initial production launch · monthly recurring (infrastructure + services + observability + AI passthrough):
- ~$10,500–12,500 / month total cost (gross including LLM passthrough)
- ~$7,500–8,500 / month net cost after tenant billing recovers passthrough at 15% margin
- ~$90,000 / year infrastructure run rate (excluding personnel)
- ~$65,000–135,000 one-time Year-1 audit / legal / insurance
Plus payroll (the dominant cost): 8 engineers Y1 average $200k loaded = ~$1.6M/year.
Total Year-1 burn ≈ $1.75M–1.9M (matches the seed-stage assumption in BusinessPlan.md §11).
20 · Cost at Scale (illustrative)
How the infrastructure bill grows with tenant count. Most costs scale sub-linearly (per-pool fixed costs amortize as tenants increase per pool) until pool count itself grows (typically every 5k tenants per Admin Pool, every 2-30k per App Pool).
| Component |
10 tenants (P1 launch) |
100 tenants (Y2) |
1,000 tenants (Y3) |
10,000 tenants (Y4) |
100,000 tenants (Y5) |
| Postgres (pools) | $2,000 | $5,000 | $25,000 | $200,000 | $1,500,000 |
| Cache (Redis/Dragonfly) | $300 | $1,000 | $5,000 | $30,000 | $200,000 |
| Event streaming (Redpanda) | $700 | $2,000 | $8,000 | $40,000 | $250,000 |
| ClickHouse | $500 | $2,500 | $12,000 | $60,000 | $400,000 |
| OpenSearch | $800 | $3,000 | $15,000 | $80,000 | $500,000 |
| Blob (S3) | $25 | $250 | $2,500 | $25,000 | $250,000 |
| KMS | $300 | $1,500 | $8,000 | $40,000 | $250,000 |
| Temporal Cloud | $1,000 | $3,000 | $15,000 | $80,000 | $500,000 |
| Kubernetes | $750 | $3,000 | $15,000 | $100,000 | $700,000 |
| Iceberg lakehouse (from P7) | $0 | $2,000 | $10,000 | $60,000 | $400,000 |
| Vector store (Pinecone/Qdrant from scale) | $0 | $500 | $3,000 | $20,000 | $120,000 |
| Observability | $99 | $500 | $2,000 | $10,000 | $50,000 |
| LLM passthrough (mostly billed back) | $3,000 | $25,000 | $200,000 | $1,500,000 | $10,000,000 |
| SMS/email passthrough | $750 | $5,000 | $40,000 | $300,000 | $2,000,000 |
| Total monthly (gross) | $10,224 | $54,250 | $360,500 | $2,545,000 | $17,120,000 |
| Net after passthrough billing | ~$7,500 | ~$25,000 | ~$130,000 | ~$800,000 | ~$5,500,000 |
Reading the table. Gross cost grows with tenant count but most growth is LLM + SMS passthrough billed back to tenants at margin. Net infrastructure cost as a percent of ARR drops over time (10-15% at scale per BusinessPlan §8), confirming the 75-80% gross margin target. By Year 5, net infra is ~$66M/year against ~$500M+ ARR.
21 · What We Do Not Use (and Why)
| Anti-pick | Why not |
|---|
| Prisma ORM | Too heavy; abstracts SQL too far for our RLS / PostGIS / partitioned-table needs; migration story has unresolved production issues. Drizzle is the better choice for our shape. |
| GraphQL platform-wide | Typed SDKs already deliver type safety; GraphQL adds N+1 risk + runtime complexity without proportional value. (Specific SDKs may expose GraphQL endpoints if a vertical demands; not platform default.) |
| NestJS | Opinionated framework conflicts with SDK-as-package architecture; DI complexity we don't need. |
| Material UI / Ant Design (as primary) | Opinionated styling fights design-system customization. shadcn+Radix+Tailwind is "owned not rented." |
| Pinning to one cloud | SDK abstractions (sdk-secrets · sdk-vault · sdk-media) decouple cloud choice. Required for sovereign + on-prem variants. |
| Jest | Vitest is strictly better in 2026 (faster, native ESM, better TS support). |
| Monorepo without Changesets | Semver discipline collapses without it. 57 SDKs cannot be released ad-hoc. |
| Auth0 / Okta as our IdP product | We ARE the IdP (sdk-identity). We federate WITH customer's Okta/Azure AD/Ping; we don't pay for Auth0 as our auth. |
| Stripe Billing | We ARE the billing product (sdk-billing + sdk-meter). Stripe is just the payment processor behind sdk-payment. |
| Putting telemetry in Postgres | Violates §8B Polyglot Persistence. ClickHouse is the right tool. |
| Cross-pool transactional SQL | Architecturally banned (§8A). Cross-pool reads go through warehouse / Iceberg lakehouse only. |
Appendix · Notes & Decision Authority
- Pricing reference period: List prices observed in 2025-2026 — actual costs depend on enterprise discounts, committed-use savings, and reserved-capacity pricing (typically 20-40% off).
- Initial production profile assumptions: 10 design-partner tenants in 1 region (us-east-1), 1-2 verticals live, ~100k API calls/day total platform-wide, ~100GB OLTP, ~500GB blob storage. Larger initial footprints scale costs proportionally (use §20 table).
- Self-managed vs managed trade-off: Initial-launch numbers assume the managed option for most components (Aurora · ElastiCache · ClickHouse Cloud · Temporal Cloud · Grafana Cloud) to reduce ops burden on a small early team. Self-managed alternatives reduce cost ~40-60% but add headcount-equivalent ops time. Switch to self-managed as the SRE team grows (P5-P6).
- Decision authority: Tech-stack changes require Platform Architect sign-off + Working Group review. Doctrines (§3A · §3B · §8B) take precedence over individual tech preferences.
- Cost monitoring: Tag every resource with
tenant_id · pool_index · sdk_name for showback (CostExplorer / GCP Billing). Per-SDK cost dashboards in ProjexCloud Admin Portal (P4).
Cross-references
| You're looking for | Document |
|---|
| Why these tech choices (architecturally) | ./Architecture-v3.1.html §3A · §3B · §8B |
| Where each tech lands per phase | ./SDK-Build-Plan-v3.1.html §0A |
| Repo + SDK + DB structure | ./ProjectStructure-v3.1.html |
| Per-phase acceptance criteria (where tech choices must verify) | ../../prd/P*-*.md |
| How costs net out against revenue model | ../../business/BusinessPlan.md §8 · §11 |