Nimbrae is the shared backbone — one identity layer, strict per-brand data isolation, commerce, HR, and a cross-brand event log — that lets a family of independent brands and partner businesses each stand on their own, with no "powered by" badge in sight.
Services deployed and running today. Each is a real container on the platform host, behind SSO, with its own isolated database.
Keycloak, one realm per brand, white-labeled login, Google OAuth + passkeys. Users sign in to the brand, never to "Vex".
The shared library every app builds on: fail-closed database isolation, typed env, session auth, health checks, and signed cross-app calls.
Mint and resolve stable, privacy-preserving identifiers across brands, with crypto-shred erasure built in.
The permissions base for everyone on the platform, owners included. Unified authorization — Identity, Resource, and Governance layers over Moneta. Deny-wins, fail-closed access decisions.
Attribute-based permissions with L1–L12 job levels, grants, requests, quotas, and a full audit trail.
A flexible calendar & scheduling engine — each brand or SaaS customer chooses its own calendar system (Gregorian, fiscal, or a custom multi-month scheme) and Horae runs it.
Courses, lessons, quizzes, progress tracking, and role-based portals for every brand's staff.
Employee onboarding, verification and people operations.
The employee portal and records, plus the exec registry / rolodex directory.
A browser design editor for social posts, decks, print and video, with brand kits, templates, charts, QR codes and GIF/video export. The first app in the Vellum design family. Open Weft ↗
Transactional email (self-hosted mail + SES) and in-platform messaging, per-brand sending identities.
Versioned TOS/Privacy per brand, document templates, DocuSeal e-signing, and a consent audit log.
Stripe-backed entitlements with idempotent, order-safe webhooks — a stale retry can never regress a subscription.
An append-only cross-brand event log for audit trails and async reactions — exactly-once, in-order delivery for consumers.
Built and running in some form, but still being completed, hardened, or wired end-to-end.
A childcare management app — enrollment, kiosk check-in, attendance — on the platform backbone. In active build, not yet public.
Multi-tenant HR engine (row-level security per tenant) and the public-facing HR SaaS it powers. Engine in active dev, SaaS in design.
Bedrock-backed assistant that auto-drafts TOS/Privacy per brand from capability tags. Backend + frontend live; rollout in progress.
Built on Medusa: headless commerce per brand — storefront, inventory, rentals. Live for some brands; catalog + checkout still being completed.
Centralized security posture, secret hygiene, and isolation guardrails being hardened across every app on the platform.
One desktop app (Linux first, then macOS and Windows) to sign in once and install, update and open every Nimbrae app — offline-capable apps like Weft work with no connection.
Files for every brand and team, synced and available offline.
The single pane at platform.vex.industries — brand registry, KPIs, AWS health, legal queue, identity management.
Where the platform is headed. Phases follow the master architecture plan; dates are targets, not promises.
Shared identity, API gateway, event backbone, CI/CD, and the core isolation guarantees. Done.
Online store, point-of-sale, and inventory sync — starting with Verlengbaar's catalog and checkout.
Multi-tenant HR database with row-level security, access-request workflows, and audit logging.
Public HR SaaS — onboarding and employee portal — powered by the GrayOps engine.
Commerce ↔ PeopleOS event flows and unified cross-brand analytics.
Developer portal, VPartner API, and webhooks so external businesses can build on the backbone.
White-label PeopleOS, embedded commerce, EDI, and tiered VPartner plans (Foundation / Growth / Enterprise).