How Zdravo Works — Under the Hood

Zdravo is a Next.js application backed by Supabase (PostgreSQL + pgvector), Cloudflare R2 (file storage), and Ollama (local embedding/inference). The architecture is designed for reliability: circuit breakers on all external dependencies, a sync journal with dead-letter queue, and row-level security on every database table.

Every memory creation flows through createMemory() in lib/memory/create.ts — the single ingestion entry point. No memory bypasses it. The pipeline:

1. 1Deduplication — SHA-256 content hash check, semantic duplicate detection via Qdrant cosine search (0.92 threshold)
2. 2Embedding — 768-dim vectors via nomic-embed-text (Ollama), text-embedding-3-small (OpenAI), or text-embedding-004 (Gemini)
3. 3Classification — AI-generated tags, summary, memory type assignment (episodic, semantic, procedural, etc.)
4. 4PII Detection — Automated scan for emails, phone numbers, SSNs, credit cards with configurable redaction
5. 5Confidence Scoring — 4-factor weighted model: source credibility, content quality, recency, cross-reference count
6. 6Storage — Structured data to Supabase, vectors to Qdrant (async via sync_journal), files to R2

pgvector stores 768-dimensional vectors with HNSW indexing for fast approximate nearest-neighbor search. Every memory embedding is stored alongside metadata (user_id, memory_type, tags, created_at) for filtered search.

• •Vector dimension: 768 (standardized across all providers)
• •Similarity metric: Cosine similarity
• •Index type: HNSW (Hierarchical Navigable Small World)
• •Search filtering: user_id, memory_type, tags, date range
• •Score threshold: Configurable per-user (default 0.72)
• •Graceful degradation: When embedding fails, memory saves with embedding_failed flag; background worker retries later

Zdravo auto-constructs a knowledge graph from your memories. Edges connect related memories by semantic similarity, shared tags, sequential relationships, and hierarchical parent-child links.

• •Node types: memories, tags, sources, conversations
• •Edge types: similar, tag, sequential, parent, co-occurrence
• •Weight scoring: Edge strength based on similarity score, recency, and access frequency
• •Decay: Graph edges decay over time if not accessed, keeping the graph relevant
• •Traversal: Supports path-finding between related concepts across your knowledge base

Production reliability is not optional. Every external dependency has a circuit breaker. Every pipeline failure has a retry path. Every data operation has an audit trail.

• ✓Circuit breakers on all external APIs (OpenAI, Ollama, Supabase) — automatic failover on 3 consecutive failures
• ✓Sync journal with dead-letter queue — no memory loss on embedding or storage pipeline failure
• ✓Rate limiting at the edge (Cloudflare) and origin (per-tier limits)
• ✓OpenTelemetry distributed tracing across all services
• ✓Graceful degradation — embedding failures don't block memory creation
• ✓Retry logic with exponential backoff on transient failures

Security is architectural, not bolted on. Row-level security on every database table means no data leaks between users, even if application code has a bug.

• ✓Row-level security (RLS) on every Supabase table — enforced at the database level
• ✓PII detection on every memory ingestion — automated scan with configurable redaction
• ✓Content triage middleware — no unsafe content reaches storage
• ✓AES-256-GCM encryption at rest for API keys and org secrets (server-side envelope encryption)
• ✓TLS 1.3 in transit for all client-server and service-to-service communication
• ✓BYOK (Bring Your Own Key) — use your own provider API keys, encrypted with your vault secret
• ✓API key management with hashed keys, rate limiting, and usage tracking
• ✓Audit logging on all admin and destructive operations
• ✓OAuth 2.0 + JWT authentication with session management

Built for teams and organizations that need governance, compliance, and knowledge preservation.

• ✓Knowledge Continuity — employee offboarding pipeline that preserves institutional knowledge
• ✓Team workspaces with role-based access control (owner, admin, member, viewer)
• ✓Admin audit log with filterable events by type, actor, and date
• ✓SCIM provisioning for automated user lifecycle management
• ✓SSO/SAML for enterprise authentication
• ✓Custom data retention policies
• ✓Dedicated support and custom SLAs