Skip to content

Architecture Overview

CampusCore runs entirely inside a dedicated AWS environment that your university owns. The diagram below shows the components of the platform and how they interact: boxes are components, arrows describe the behavior between them. For the AWS resources behind these components - the network, compute, and storage your account actually provisions - see the companion AWS Resource Architecture.

flowchart TD
  subgraph community["  Campus community  "]
    direction LR
    users["Students, faculty & staff"]
    guests["Public visitors"]
  end

  idp["Campus identity provider"]

  subgraph deployment["  CampusCore deployment - dedicated AWS environment per university  "]
    spa["Frontend"]
    subgraph backend["  Backend system  "]
      agent["AI Agent"]
    end
    kb[("Knowledge base<br/><i>PostgreSQL + pgvector</i>")]
    files[("Object storage (S3)")]

    subgraph ingestion["  Content ingestion  "]
      scraper["Web scraper"]
      connectors["Connectors<br/><i>Canvas · ServiceNow ·<br/>Gmail · Google Calendar · Google Drive ·<br/>Outlook · OneDrive · SharePoint ·<br/>PostgreSQL · S3 buckets</i>"]
      pipeline["Ingestion pipeline<br/><i>queues + workers</i>"]
    end
  end

  subgraph sources["  Campus content sources  "]
    direction LR
    web["Campus websites"]
    uploads["Documents & files"]
    systems["Campus systems"]
  end

  subgraph providers["  AI model providers  "]
    direction LR
    openai["OpenAI"]
    google["Google"]
    cohere["Cohere<br/><i>planned</i>"]
  end

  users -- "sign in through campus SSO" --> idp
  idp -- "asserts identity<br/>(SAML / OIDC)" --> backend
  users -- "ask questions, upload<br/>documents, administer" --> spa
  guests -- "ask questions without an account<br/>(optional, enabled per school)" --> spa
  spa -- "calls typed APIs; answers stream<br/>back live with source citations" --> backend
  agent -- "hybrid semantic +<br/>keyword search;<br/>access rules enforced<br/>on every query" --> kb
  agent -- "sends question + retrieved context;<br/>receives the generated answer" --> providers

  web -- "crawled on a schedule" --> scraper
  uploads -- "uploaded in the app or<br/>attached to conversations" --> pipeline
  systems -- "ingested via APIs or file stores,<br/>e.g. Google Drive, Canvas" --> connectors
  scraper -- "queues discovered pages" --> pipeline
  connectors -- "queues synced content" --> pipeline
  pipeline -- "keeps original files" --> files
  pipeline -- "extracts, chunks, embeds,<br/>and indexes content" --> kb
  pipeline -- "embedding & OCR<br/>during ingestion" --> providers

  classDef ccPeople fill:#f1f5f9,stroke:#94a3b8,color:#0f172a
  classDef ccCloud fill:#eff6ff,stroke:#3b82f6,color:#0f172a
  classDef ccExternal fill:#fffbeb,stroke:#d97706,color:#0f172a
  classDef ccBoundary fill:#f8fafc,stroke:#cbd5e1,color:#475569
  classDef ccCloudBoundary fill:#f5f9ff,stroke:#3b82f6,stroke-width:2px,color:#1d4ed8
  classDef ccInnerBoundary fill:#ffffff,stroke:#93c5fd,color:#3b82f6
  class users,guests,web,uploads,systems ccPeople
  class spa,agent,kb,files,scraper,connectors,pipeline ccCloud
  class idp,openai,google,cohere ccExternal
  class community,sources,providers ccBoundary
  class deployment ccCloudBoundary
  class ingestion,backend ccInnerBoundary

Reading the diagram

The diagram encodes its claims in three colors and one nesting.

  • The blue boundary is the whole product: one dedicated AWS environment per university, owned by that university. Nothing inside it is shared with any other institution.
  • Amber boxes are external services: your own identity provider, and the AI model providers that generate answer text.
  • Slate boxes are your people and your content - everything CampusCore serves and ingests, but does not own.
  • The AI Agent sits inside the Backend system box because it is not a separately hosted service; it runs inside your environment like everything else in the boundary.
  • The Cohere box is marked planned; today the platform uses OpenAI and Google models.

Where your data lives - and doesn't

  • One university, one environment: your deployment runs in an AWS account you own, and no data or infrastructure is shared between institutions.
  • Encrypted everywhere: data is encrypted at rest and in transit across the entire platform.
  • Your sign-on, your access rules: authentication runs through your existing identity provider, and content permissions follow each user into every answer they receive.
  • AI models see only what's needed: to compose an answer, the question and the retrieved passages are sent to the model providers; use of that data is governed by the providers' enterprise API terms, which we review with you during onboarding.