fortifai Solution Architecture
Executive Overview
Client VPC or On-Premise

The continuous value assurance platform

An agentic AI platform delivering continuous cost optimisation, margin recovery, and risk prevention across core business functions.

How value reaches executive leadership
Read top-down, the platform begins with the executive owners and the unified cross-functional brief they receive. Beneath that sit the specialised domain agents that produce functional outcomes, the shared detection engine and database that power every agent, the unified data model that normalises commercial terms, and the underlying enterprise and market data sources. Every layer runs inside the client's network boundary with zero outbound data egress.
Enterprise governance envelope · wraps every layer 100% read-only · zero outbound egress · Maker-Checker approvals · SAML / OIDC SSO · AES-256 / TLS 1.3 · inside client VPC 1 · Who acts on the insights CFO · Chief Procurement Officer · Chief Audit Executive · Chief Risk Officer · General Counsel Executive stakeholders and functional transformation leaders 2 · What they receive Enterprise Risk & Margin Control Tower (SARA) Synthesises multi-agent findings into one cross-functional executive brief Stoppable cash & EBITDA opportunity · compliance posture · control health · enterprise conversational assistant 3 · How outcomes are delivered · specialised domain agents Kuber · AEWAC Procurement cost & margin recovery Crystal · Moneta Balance sheet close & working capital Surge · Horizon Sales / O2C revenue & credit assurance Aegis · Argus Trade, third-party risk & audit investigations 4 · What powers the agents Shared Insights & Case Store (PostgreSQL) Pre-computed findings stored asynchronously · agents load their domain view in sub-second time Hybrid Detection, Pattern & Explainable AI Engine 179+ deterministic business rules + statistical anomaly & relationship-graph models + deduplicated savings In-boundary LLM drafts evidence-bound explanations & powers safe, read-only natural-language queries 5 · What it runs on Unified Canonical Data Spine (PostgreSQL 5 Logical Schemas + Vector Memory) Maps diverse ERP schemas into one clean, source-neutral commercial model Normalises payment terms, freight & units of measure · enriches vendors with external registry & market data 6 · Where the data comes from · ERP-agnostic sources Core ERP SAP S/4HANA & ECC Oracle · MS Dynamics Procurement & T&E SAP Ariba · Coupa SAP Concur Supply Chain & Ops Dealer Mgmt (DMS) Transport & Warehouse External Intelligence Commodity Indices Statutory & Tax Registries Connect once to enterprise data sources; activate specialised AI agents across procurement, finance, sales, and audit. 100% deterministic math · evidence-bound AI explanations · human-in-the-loop decisions
fortifai Deployment Configurations
Modular Adoption
Same Foundation · Same Governance

Start with one agent, or deploy the full suite

Whether deploying a single functional agent or an enterprise-wide control tower, the underlying data spine is identical.

What changes as you scale, and what stays the same
Clients can start with a single high-priority agent (such as Kuber for Procurement Cost Optimisation) or deploy multiple agents across functions. In a single-agent deployment, the agent serves its functional leader directly. As additional agents are switched on, the Enterprise Risk & Margin Control Tower activates to unify cross-functional insights for the CFO, CPO, and CAE—requiring zero rework to the underlying database, connectors, or security posture.
Option A · Single-Agent Deployment Option B · Multi-Agent + Control Tower Primary Consumer Single Functional Leader (e.g. CPO) Primary Consumers CFO · CPO · CAE · CRO · General Counsel Cross-Functional Tower Dormant Agent workbench is the top of the stack Enterprise Risk Control Tower Unifies all agents into one executive brief Active Domain Agent Kuber (Procurement) Dedicated workbench & Ask Kuber chat Active Domain Agents Kuber P2P Crystal Finance Surge+ O2C & Audit Shared Platform Foundation (Identical in Both Deployments) Shared Insights & Case Store (PostgreSQL) Each agent queries its functional slice · Control Tower aggregates across all active agents Detection, Statistical Pattern & Explainable AI Engine Deterministic rules + Exclusion Registry · statistical & network models · evidence-bound AI explanations Unified Canonical Data Spine (PostgreSQL 5 Logical Schemas + Vector Memory) Commercial terms & freight normalisation · external supplier intelligence joined by Tax ID / DUNS ERP-Agnostic Enterprise & Market Data Sources SAP · Oracle · Dynamics · Ariba · Coupa · Concur · DMS · TMS · Commodity & Statutory Feeds Unified Security & Governance Envelope 100% read-only · zero outbound egress · Maker-Checker approvals · SSO · AES-256 / TLS 1.3 · inside client VPC
fortifai Reference Architecture
Technical Blueprint
Seven-Layer Data & Control Pipeline

Reference architecture · data and control flow

End-to-end pipeline from source enterprise systems (Layer 1) to executive consumption (Layer 7).

Seven layers inside the client perimeter
Enterprise source systems are ingested read-only and audited for chain completeness, then normalised into a single source-neutral data model stored across five logical PostgreSQL schemas. In the background, the detection engine computes all financial exposures deterministically and persists results in the shared case store. Domain agents query their dedicated slice to render fast functional workbenches, while the Control Tower aggregates across all agents for executive leadership. The in-boundary LLM drafts explanations and translates natural-language queries into safe, read-only SQL—never calculating numbers or altering production records.
Client network / private cloud VPC perimeter On-premise or AWS / Azure / GCP · 100% read-only ERP access · zero outbound data egress 1 · Enterprise source systems & external intelligence Core ERP SAP · Oracle · Dynamics Procurement & T&E Ariba · Coupa · Concur Dealer & Logistics DMS · TMS · Weighbridge External Feeds LME · ICIS · Tax & Registry 2 · Read-only ingestion & data reliability audit Pluggable Connectors Python & Airflow · read-only JDBC / API Data Reliability Scanner Primary key & chain linkage audit Secrets & Audit Logging HashiCorp Vault · extraction logs 3 · Commercial normalisation & enrichment layer (source-neutral) Maps diverse ERP tables into one unified commercial & risk data model Normalises prices across payment terms, freight incoterms & units of measure · filters routine operational noise Enriches suppliers and customers with external statutory, workforce & commodity benchmark intelligence 4 · PostgreSQL storage spine (5 logical schemas + vector memory) Single PostgreSQL Instance · Logical Schema Separation + pgvector Decision Memory 1 · RAW ingest_db 2 · STAGE staging_db 3 · CANONICAL transform_db 4 · FINDINGS anomaly_db 5 · UI VIEWS semantic_db 5 · Asynchronous detection, statistical pattern & cognitive AI engine Tier 1 · Deterministic Rule Engine 179+ rules · full document chain trace · SHA-256 dedup Tier 2 · Statistical & Network Engine Polars & DuckDB · outlier baselines · relationship graphs Case Consolidation & Savings Deduplication Engine Groups related signals into actionable packets & prevents double-counting of savings across levers Evidence-Bound AI Layer (On-Premise LLM / Private Cloud Endpoint) Drafts plain-English case narratives & powers safe, read-only natural-language database queries 6 · Domain agent workbenches (functional execution) Kuber · AEWAC Procurement cost & margin workbenches Crystal · Moneta Finance close & working capital Surge · Horizon O2C revenue & credit assurance Aegis · Argus Trade compliance & audit investigations 7 · Executive synthesis & consumption Enterprise Risk & Margin Control Tower (SARA) → CFO · CPO · CAE · CRO · General Counsel Consolidates all domain agent outcomes into one cross-functional executive cockpit Stoppable cash & EBITDA recovery · regulatory posture · control health · enterprise conversational assistant Cross-Cutting Security, Observability & High Availability AES-256 · TLS 1.3 · SAML/OIDC SSO · Maker-Checker SoD · Prometheus & Grafana · Active-Passive HA (RPO ≤ 30s, RTO ≤ 5m)