Why DynamoDB
Raw fraud and security signals arrive at high volume and are naturally accessed by organization, entity timeline, severity, and time. The single-table design uses ORG, ENTITY, and RISK access patterns for predictable scale.
Architecture
How ProofPilot AI uses Vercel, Next.js, DynamoDB, and Aurora DSQL as deliberate product architecture.
AWS adapterSubmission kit
Database-first flow
1Vercel / Next.js App Router
2API routes validate all inputs with Zod
3DynamoDB stores raw event streams and entity timelines
4Aurora DSQL stores strongly consistent cases, reports, notes, and ledger
5Risk engine creates cases and ledger records
flowchart LR Judge[Judge Browser] --> Vercel[Vercel Next.js App Router] Vercel --> API[Server Actions and API Routes] API --> Risk[Deterministic Risk Engine] API --> Ledger[Tamper-Evident Ledger] API --> Reports[Report Generator] API --> Dynamo[(DynamoDB Raw Event Store)] API --> DSQL[(Aurora DSQL Relational System of Record)] Dynamo --> Events[High-volume event timelines] DSQL --> Cases[Cases, entities, notes, reports, audit ledger]
Why Aurora DSQL
Cases, reports, notes, memberships, and evidence ledgers need relational integrity and strongly consistent workflows. The PostgreSQL-compatible schema is included in migrations and Drizzle definitions.
Security
Secrets stay in environment variables, ingest payloads are Zod-validated, rate limiting is enforced at the API boundary, and database access is isolated in server-only repository modules.
Reliability and Cost
DynamoDB handles bursty writes without relational hot spots. Aurora DSQL stores compact case/audit state. Demo mode keeps judging friction low when AWS credentials are not available.
DynamoDB single-table item shape
PK=ORG#organizationId SK=EVENT#timestamp#eventId GSI1PK=ENTITY#entityId GSI1SK=EVENT#timestamp GSI2PK=RISK#severity GSI2SK=timestamp#eventId