Case study 04 / Security and job architecture
Building private, durable infrastructure for multimodal AI
How an image, video, character, animation, and upscale studio is being rebuilt around ownership, encryption, durable jobs, transactional credits, and recoverable provider failures.
In multimodal SaaS, reliability and privacy are visible product qualities. The architecture must make partial failure recoverable without charging twice, leaking media, or losing the job state.
01 / Challenge
Generation succeeds only when the entire lifecycle succeeds
A provider accepting a request does not guarantee that the user receives a result. Network ambiguity, delayed jobs, duplicate submissions, credit deductions, private media, and failed callbacks turn a creative interface into a distributed-systems problem.
02 / System response
Make failure a first-class product state
NudeTools v2 uses durable jobs and idempotent submissions so requests can be retried safely. Credit changes are transactional, refunds are applied exactly once, ambiguous provider acceptance is escalated for reconciliation, and every media object remains account-bound and encrypted.
- 01Encrypt private Cloudflare R2 media with AES-256-GCM
- 02Use short-lived access tokens with revocable database-backed sessions
- 03Make generation submission idempotent and credit accounting transactional
- 04Guarantee exactly-once refunds across repeated failure handling
- 05Separate ambiguous provider acceptance into an operator reconciliation path
- 06Enforce ownership across uploads, results, search, favourites, reuse, and deletion
03 / Result
A verified core, with unfinished work stated plainly
Authentication, encrypted storage, ownership controls, credit quotes, reference uploads, favourites, and a live provider-backed image generation have been verified. Video, upscale, motion presets, checkout, renewals, and transactional email remain active development work.