Architecture
Availability: QUMI distinguishes Implemented, Controlled release, In review, and Planned. A source route/module is not automatically a generally available feature or stable external API contract.
Current stack
| Layer | Technology |
|---|---|
| Web | Next.js 16, React 19, Tailwind CSS 4 |
| API | NestJS 11 |
| Data | Prisma 7 + PostgreSQL |
| Mobile | React Native / Expo |
| Observability | Pino/request context + Sentry integration |
| Jobs | Nest scheduler and BullMQ/Redis capability |
| Object storage | Local or S3-compatible/R2 driver |
Modular application
The backend is a modular monolith. Active domains include Identity, Tenant, Platform, Workflow, Documents, Resources, Notifications, Integrations, HR, Finance, CRM, Analytics, Public, Orders, Menu/Catalogue, Operations, Customers, Customer Portal, Usage, Invoice, Loyalty, Policy, Timeclock, Support and staff-operation modules.
Tenant boundary
Tenant-owned reads and mutations resolve tenant context server-side. Client-side hiding is not authorization.
API and security posture
Canonical controllers are mounted under /api/v1. The backend applies strict DTO validation, Helmet, CORS allowlisting, request IDs, CSRF protection for cookie-based mutations, role/permission guards, and raw-body support for provider signature verification.
Storage
Relational business state lives in PostgreSQL through Prisma. Binary files use local or S3-compatible object storage depending on environment configuration.