The platform

How it is built, and how it is operated

The engineering decisions a technical buyer asks about on the second call, answered here instead.

Six properties

Each of these is checkable, which is why it is written down

“We take security seriously” is not a claim anybody can test. “Scoping is applied where the query is built, and a build that forgets it fails” is.

The engine and the drafter are separate

Not by convention and not by prompt instruction. The computation layer cannot import the model client, and the build fails if it can — the import graph is the boundary, made mechanical rather than reviewed for.

Rating, weight, free time, duty and currency are pure functions over exact decimals
The settlement path reaches no model at all and runs at zero token cost
A validator blocks any rendered amount that has no charge line behind it
Prompts are versioned data, so a wording change is one diff and the golden set catches what it altered

Built to be integrated, not just used

The console is one client of the API rather than a wrapper around a private one. A transport or accounting system can consume the same surface without a person logging in.

EDI in and out — booking, status and manifest messages, plus carrier tracking events
The same status message delivered twice produces one milestone, not two
Completion callbacks signed over the exact bytes, so a receiver can reject a tampered body
Exports as documents, spreadsheets with the working intact, structured data and EDI
Live progress on a running job, so a long rating run is legible rather than a spinner

Operated like something people depend on

Work runs on a real queue rather than inside the web process, and a job that was interrupted is reconcilable rather than lost.

Jobs are durable — a worker killed mid-run resumes rather than vanishing
The same input submitted twice inside the window produces one execution, not two
Every stage of every job is recorded with its timing, so a slow lane is attributable
A shipment reference alone reconstructs a full lifecycle from the logs

Confidentiality is the default

A shipment file holds a customer’s commercial invoice, which names their buyer and their price. That is competitive intelligence, not a privacy footnote.

The organisation is applied where the query is built; a cross-organisation read answers 404
Per-organisation encryption keys on stored documents, presigned access only
No IEC, GSTIN, container number, bill of lading number or consignee name reaches log storage
Customer text is treated as hostile — it is parsed, rendered, printed onto documents and exported to spreadsheets
Retention aligned to the customs record rules rather than to a default somebody picked

For engineering teams

The API is the product; the console is a client of it

Everything the console does is an ordinary API call, and the integrations a freight operation actually needs are the ones that run unattended.

Every action in the console is an API call you can make. Create a shipment, commit an import, rate it, run an invoice audit, prepare a declaration, generate a document, read its provenance chain — all of it is addressable without a browser.
Status arrives the way freight status actually arrives: unattended EDI messages and carrier tracking events, de-duplicated on receipt. Results leave as signed callbacks, so a receiving system can verify an invoice audit came from us and arrived intact.

The stack

Boring where it should be

Nothing here is novel, and that is the intention. The interesting decisions in this product are about what it refuses to do, not about what it is written in.

Engine	Python, layered so route handlers hold no queries and the computation module cannot import the model client
Data	Postgres with spatial support for ports and routes; every monetary column exact, never floating point
Queue	A real job queue with durable state — rating and document generation never run inside the request that asked for them
Console	React and TypeScript, with the rounding and unit rules mirrored from the engine so the browser cannot disagree with it
Documents	Form-bound rendering onto the carrier and customs forms, plus spreadsheets, structured data and EDI

Rating, document generation and bulk EDI ingestion run on a queue rather than inside the request that asked for them. A worker killed mid-run resumes rather than losing the job, and the same input submitted twice inside the window produces one execution — which matters when a carrier redelivers a status message.

Ask the awkward architecture questions

Where the deterministic boundary actually is, what happens to a job when a worker dies, how a cross-tenant read is prevented, what a signed callback covers. Those are the right questions and we would rather answer them early.

Talk to us The standard

Get in touch

Talk to the people building it

No chatbot and no ticket queue. Tell us what your operation actually looks like — the modes you move, whether you clear your own customs, and roughly how many shipments a month — and someone who works on the software will reply.

info@legosphere.com