How Togetherward is built

React 19 on TanStack Start, server-rendered and served from an edge worker runtime. Client-to-server calls are typed server functions; public HTTP surfaces (webhooks, cron, calendar feeds, health) are separate server routes that verify their own callers with signatures or HMAC rather than relying on the platform gate.

On a case with encryption enabled, protected content is encrypted in the browser before upload with AES-256-GCM and per-file random nonces. Each user holds a random key-encryption key protected by a passkey-capable credential or a device-local key, with a separate emergency recovery code. Each case has its own content-encryption key, wrapped separately for every member of that case.

Consequences we accept deliberately: the server, the storage layer, our operators, and any automated processing see ciphertext for those categories; there is no escrow key, so a case whose members lose every active unlock method and emergency recovery code cannot be recovered. Account authentication and content encryption are separate: a sign-in passkey may also support private-case unlock when verified and enrolled, but sign-in success alone never releases the case key.

For encrypted document revisions, user-entered details — filenames, exact file types, categories, dates, labels, statuses, and notes — are encrypted with the document. Our servers still see opaque document IDs and storage paths, ciphertext sizes and hashes, upload times, and a coarse file family. Other structured case fields, such as task titles and due dates or timeline event dates, remain server-readable for search, reminders, calendars, and exports. The security page lists both sides of that line item by item.

Postgres with row-level security on every protected table. Case-scoped rows are gated by a security-definer membership function rather than by application code, and roles live in a dedicated table so a role can never be edited through a profile record. Privileged service-role access is confined to verified webhook handlers and maintenance paths; it is never used to decide whether a caller is an administrator.

The sample case renders deterministic fictional fixtures with a fixed clock. It performs no database call, writes nothing, and cannot mutate anything — that isolation is asserted by a test that fails if the page issues a request. It is a demonstration of the product’s shape, not a personalised assessment.

Process content is tied to official U.S. government sources — USCIS, the Department of State, and the consular posts themselves. Each stored source keeps its canonical URL, publisher, retrieval status, and last-verified timestamp. Togetherward Team reviews source changes before guidance updates. Togetherward never queries a government case system, and it does not infer status, timing, eligibility, or legal sufficiency.

There is no public checkout: the only public entry point is the private beta application flow. There is no scoped attorney access inside a case — sharing with counsel today means the couple exports their own material. Anything not described on this page or the changelog should be assumed not to exist.