How Togetherward is built

React 19 on TanStack Start, server-rendered and served from an edge worker runtime. Client-to-server calls are typed server functions; public HTTP surfaces (webhooks, cron, calendar feeds, health) are separate server routes that verify their own callers with signatures or HMAC rather than relying on the platform gate.

On a case with encryption enabled, protected content is encrypted in the browser before upload with AES-256-GCM and per-file random nonces. Each user holds a key-encryption key wrapped by an Argon2id-derived passphrase key. Each case has its own content-encryption key, wrapped separately for every member of that case.

Consequences we accept deliberately: the server, the storage layer, our operators, and any automated processing see ciphertext for those categories; there is no escrow key, so a case whose members all lose their devices without a recovery kit cannot be recovered. Account authentication and content encryption are separate — a passkey unlocks the account, not the case key.

Structured metadata — filenames, MIME types, sizes, timestamps, task titles, due dates, event dates — stays server-readable so search, reminders, calendars, and exports can function. The security page lists both sides of that line item by item.

Postgres with row-level security on every protected table. Case-scoped rows are gated by a security-definer membership function rather than by application code, and roles live in a dedicated table so a role can never be edited through a profile record. Privileged service-role access is confined to verified webhook handlers and maintenance paths; it is never used to decide whether a caller is an administrator.

The sample case renders deterministic fictional fixtures with a fixed clock. It performs no database call, writes nothing, and cannot mutate anything — that isolation is asserted by a test that fails if the page issues a request. It is a demonstration of the product’s shape, not a personalised assessment.

Process content is tied to official U.S. government sources — USCIS, the Department of State, and the consular posts themselves. Each stored source keeps its canonical URL, publisher, retrieval status, and last-verified timestamp, and a detected change can require human review before anything public updates. Togetherward never queries a government case system, and it does not infer status, timing, eligibility, or legal sufficiency.

There is no public checkout: the only public entry point is the private beta waitlist. There is no scoped attorney access inside a case — sharing with counsel today means the couple exports their own material. Anything not described on this page or the changelog should be assumed not to exist.