Architecture
Tamper evidence, not an audit tab
The record model, what it proves precisely, how fast it runs, and how we tested it. This is the page where the mechanics are allowed.
One write path
Every change — from the interface, an import, the API, a workflow or an agent — goes through the same path and becomes a versioned, attributed changeset. History is append-only, and that is enforced by the database itself for every role, the owner included. Nothing overwrites anything.
Hash-chained versions
Each version is hashed under a frozen canonicalisation specification with committed test vectors, and bound to the version before it. Re-verifying the full history is a first-class operation: you get an answer, not a promise.
Signed transitions
Approvals re-authenticate. The signature binds the exact content hashes that were signed, with author and approver meanings, and the transition and its signature commit together or not at all.
What it proves, precisely
The chain covers each file’s content hash, so it proves which file was approved. It does not re-read the file store, so it does not yet prove the stored bytes are unchanged. We would rather say that than let you assume it.
Signatures are built to support 21 CFR Part 11 and EU Annex 11 processes. Compliance belongs to your validated process, not to a vendor’s software, so we do not claim it.
Measured, not projected
Two million products on one mid-range machine
Enterprise PIM pricing assumes enterprise infrastructure. We measured what a catalogue that size costs to run on a single desktop-class node, not a cluster.
| Measure | Result | Budget |
|---|---|---|
| Catalogue | 2,000,000 entities · 9,591,712 versions | — |
| Write latency, p95 | 12–16 ms | 150 ms |
| Library search, p95 | 127 ms | 200 ms |
| Permission-filtered search, p95 | 6.3 ms | — |
| Delivery read, p95 | 1.6 ms | — |
| Search index lag, p95 | 0.31 s | 3 s |
| History, diff and blame | 4–8 ms at 9.6 M versions | — |
| Agent writes | 20 writes/s at a flat ~11 ms | — |
| Full-depth chain re-verification | 9,616,636 versions · 0 failures · 19.3 min | — |
Single-tenant numbers on one named machine, with the message broker emulated; cloud measurements are still owed. The whole record is rehashed on every write, so these figures were measured at 24 fields per content type and do not transfer to very wide schemas.
How we test
Scrivino is built in work packages, and each one passes an independent review before it counts as done. The phase that produced today’s product was sealed on 16 October 2026:
- Work packages
- 62
- Review waves
- 18
- Findings filed
- 749
- Findings closed
- 630
None of the findings left open at the seal was rated above P2. The verification programme behind the benchmark also found deep defects in our own system; they were fixed before the numbers above were taken.
What it runs on
Platform
.NET 10, PostgreSQL and Elasticsearch, as a web application in Microsoft Azure’s EU regions.
Interfaces
A full OpenAPI description, a delivery API with a change feed, signed webhooks for about forty event types, and 73 tools for agents over the Model Context Protocol.
Files
Content-addressed storage with de-duplication. Renditions are generated by a separate worker; files it cannot render are kept and flagged.
Check the record yourself
We are looking for design partners: manufacturers and brands with a real catalogue and a real deadline. You get the system, our time, partner terms, and a say in what we build next.