TranscribIA's architecture, explained for your technical teams.
The most requested reference document during pre-sales. TranscribIA is an audio transcription platform designed for organisations that need to understand, audit and control the processing chain for their recordings. This overview describes the components, data flow, tenant isolation, built-in security measures, two deployment models and subprocessor chain — factually, without overstating claims.
Technical overview v1.0 — 30 June 2026. Publisher: AMBASSADIA SARL (Monaco). Contact: contact@transcribia.eu.
Components
An architecture of dedicated services
Each responsibility is handled by a separate service, orchestrated through Docker Compose (8 services). No data passes through a component unless its role requires it.
# General component diagram
┌─────────────────────────────────────────────────────────────┐
│ Utilisateurs — Frontend React 19 / TypeScript / Vite │
└──────────────────────────┬──────────────────────────────────┘
▼ HTTPS · TLS 1.2+
┌─────────────────────────────────────────────────────────────┐
│ Nginx — reverse proxy + termination TLS │
└─┬──────────────────────┬──────────────────────┬────────────┘
▼ ▼ ▼
┌──────────────┐ ┌──────────────────┐ ┌────────────────────┐
│ API Laravel │ │ Laravel Reverb │ │ ClamAV │
│ 12 / PHP 8.3│ │ (WebSocket) │ │ antivirus uploads │
│ + Sanctum │ │ progression RT │ │ │
└──┬───────┬───┘ └──────────────────┘ └────────────────────┘
│ │
▼ ▼
┌──────────────┐ ┌──────────────────────────────────────────┐
│ PostgreSQL │ │ Redis 7 — cache · queues · sessions │
│ 16 │ └──────────────────────────────────────────┘
│ 1 schéma / │ ┌──────────────────────────────────────────┐
│ organisa- │ │ Workers transcription (consommateurs) │
│ tion │ └─────────────────┬────────────────────────┘
└──────────────┘ ▼
┌────────────────────────────────────┐
│ Serveur GPU — WhisperX / pyannote │
│ transcription + diarisation │
└─────────────────┬──────────────────┘
▼
┌────────────────────────────────────┐
│ IA — OpenRouter (Anthropic/OpenAI)│
│ post-traitement · no-train │
└────────────────────────────────────┘
Sauvegardes : age (chiffrement) + rclone → Backblaze B2 / Scaleway (UE) Frontend
React 19 · TypeScript · Vite
- Static SPA build served by Nginx
- Real-time progress through Reverb (WebSocket)
- No business logic in the browser
Laravel API
Laravel 12 · PHP 8.3 · Sanctum
- Business core, REST, job orchestration
- Sanctum authentication + TOTP 2FA
- 5-level RBAC, least privilege
PostgreSQL
PostgreSQL 16 · multi-tenant
- A dedicated schema for each organisation
- Encryption at rest (disk + database)
- No cross-tenant queries
Redis
Redis 7 · cache · queues
- Application cache and sessions
- Transcription queues
- Worker coordination
Laravel Reverb
Real-time WebSocket
- Live transcription progress
- Job notifications and statuses
- Channel isolated by organisation
Transcription workers
Queue consumers
- Orchestrate ClamAV → GPU → AI
- Asynchronous, reproducible processing
- Isolation by job and tenant
GPU server
WhisperX · pyannote
- High-accuracy audio transcription
- Diarisation (speaker identification)
- Dedicated server, separate from the API
AI (post-processing)
OpenRouter · Anthropic / OpenAI
- Text formatting and post-processing
- No-training clause (no-train)
- Ephemeral data, not retained
A recording's journey
From audio file to encrypted deliverable
This chain illustrates the typical journey of a recording. The applicable measures and behaviour when a component is unavailable depend on the deployment mode and contractual scope; the security policy describes the antivirus behaviour in particular.
Encrypted upload
The audio file travels over HTTPS (TLS 1.2+) to Nginx, then to the Laravel API.
Antivirus (ClamAV)
Every upload is scanned before any processing. Any suspicious file is rejected.
Queueing (Redis)
The transcription job enters the Redis queue, isolated by organisation.
GPU transcription
A worker sends the audio to the GPU server: WhisperX (transcription) + pyannote (diarisation).
AI post-processing
Request through OpenRouter (Anthropic / OpenAI) for formatting. No-train clause, ephemeral data.
Encrypted storage at rest
The transcript and metadata are written to the tenant's dedicated PostgreSQL schema (at rest).
Export
The user exports the deliverable (text, subtitles); progress is visible in real time through Reverb.
Isolation
One organisation, one dedicated PostgreSQL schema
Data isolation goes beyond a simple application filter: each organisation has its own schema in the database.
TranscribIA uses a schema-per-organisation model on PostgreSQL 16: one customer's data is never stored in the same structure as another's. Isolation is structural, at database level, rather than solely logical at application level.
In practice, this means no query can cross data from two organisations by design: the target schema is resolved when the organisation's session opens. This approach also facilitates full export, erasure (right to be forgotten) and potential on-premise extraction of a tenant.
The activity logs (activity_logs) are also maintained per organisation, while platform logs (audit_logs) record sensitive actions without exposing transcript content.
Isolation guarantees
- Dedicated schema. A separate PostgreSQL schema for each organisation, resolved at session start.
- No cross-tenant queries. Crossing two customers' data is impossible by design.
- Isolated queues. Transcription jobs are isolated by tenant in Redis.
- Private real-time channel. Reverb events (progress) are isolated by organisation.
- Per-tenant purge. Full ZIP export and targeted erasure of an organisation without affecting others.
Security by design
Controls built into the platform
The measures below are native and verifiable. They are presented as technical controls, without prejudging your organisation's specific compliance framework.
Encryption (in transit & at rest)
- TLS 1.2+ required, HTTPS throughout (in transit)
- Encryption at rest: disk and PostgreSQL database
- Backups encrypted with age (X25519 + ChaCha20-Poly1305)
- Protected application secrets (AES-256-CBC)
Strong authentication
- Laravel Sanctum authentication
- RFC 6238-compliant TOTP 2FA, role-based enrolment
- Password re-authentication for destructive actions
- Rate limiting, strict CORS and CSP policy
Access control (RBAC)
- 5-level RBAC: super_admin, agent, manager, team_lead, user
- Principle of least privilege
- Permissions by role and organisation
- No implicit privileges outside the tenant's scope
Logging & audit
- Per-organisation activity_logs + platform audit_logs
- Traceability of all sensitive actions
- CSV/JSON exports for your audits
- Scrubbed logs: no transcript content
Anti-malware & hardening
- ClamAV on every upload, before processing
- Scanning that rejects suspicious files
- Components and signatures kept up to date
- Isolated services (Docker, one role per service)
Resilience & backups
- Daily encrypted off-site backups in the EU
- rclone to Backblaze B2 / Scaleway (EU)
- Pre-restore snapshots (overwrite protection)
- Granular per-tenant restoration
Two deployment models
Sovereign SaaS in France or on-premise
Both modes share exactly the same product. The difference lies in who operates the security controls and where the data resides.
Sovereign SaaS (France)
Managed service, hosted in France, ready to use quickly.
Scope operated by the publisher (AMBASSADIA SARL)
- Hostinger hosting, Strasbourg data centre (France)
- The publisher oversees TLS, backups, updates, ClamAV and hardening
- Fully managed stack (8 Docker Compose services)
- EU off-site backups (Backblaze B2 / Scaleway)
- Ready-to-use DPA and compliance documentation
On-premise (your infrastructure)
Standalone deployment in your environment, with no outbound data.
Scope operated by your organisation
- Standalone Docker Compose (8 services), in your infrastructure
- Your security officer manages hardening, logs, backups and monitoring
- Configurable GPU server and AI (local models possible)
- Full control over inventory and controls
- Suitable for classified environments or stringent security requirements
In sovereign SaaS, the publisher operates and documents the controls for your audits. In on-premise, your organisation has operational responsibility for the measures (hardening, monitoring, backups and updates). The 8 Docker Compose services are identical in both cases.
Supply chain
Subprocessors and external flows
TranscribIA relies on a limited number of subprocessors, all located in the European Union. No transfers outside the EU by default.
Hostinger
SaaS hosting (compute + primary storage)
- Location
- Strasbourg, France
- Data
- Audio files, metadata, PostgreSQL database (encrypted at rest)
Backblaze B2 + Scaleway
Encrypted off-site backups (age + rclone)
- Location
- European Union (B2 EU / Scaleway France)
- Data
- Encrypted backups only — no plaintext data
OpenRouter (Anthropic / OpenAI)
AI routing for text post-processing
- Location
- API transit, no-train clause
- Data
- Ephemeral transcripts / prompts — no retention, no training
GPU server (WhisperX / pyannote)
Audio transcription + speaker diarisation
- Location
- Dedicated infrastructure, European Union
- Data
- Temporary audio files, processed then deleted
The full list of subprocessors, their contractual safeguards and the retention policy are set out in the public compliance pack.
Documentation & contact
For your IT directors, security officers and buyers
The full compliance pack — processing register, DPA template, security measures, retention policy, subprocessors and architecture diagrams — is publicly accessible without an account. Our team supports your organisation's technical assessment.
Publisher: AMBASSADIA SARL (Monaco). Contact: contact@transcribia.eu. Technical overview v1.0 — 30 June 2026.