Architecture

One platform. Every surface.

The iPhone and Android apps, the web app, the Enterprise and developer portals and every QR code all talk to a single, typed API. Here's how it fits together, and where your data goes.

How we secure it Sub-processors

Every surface

Clients

iPhone and Android app

Web app

Enterprise portal

Developer portal

QR and NFC finder pages

Partner systems

my.regimate.app

Gateway

TLS termination

Security headers

One origin for every app

Static app hosting

Reverse proxy to /api

Node.js 22 · Express 5

Regimate API

BetterAuth sessions

Zod validation

Drizzle ORM

Rate limiting

AI moderation

Scheduled jobs

Image processing

Signed links

Managed and private

Data and services

PostgreSQL

Redis

Private object storage

Resend email

Stripe billing

Anthropic moderation

Expo and Web Push

Data flows

Follow the data, step by step.

Two journeys show how the platform keeps people anonymous while still getting things home.

When a finder scans a tag

Scan

The QR code or NFC tag opens the item's public page on my.regimate.app. No app or account is needed.

Message

The finder's message and optional photo are rate limited, checked by AI moderation and stored in an anonymous conversation.

Notify

The owner gets a push notification and an email. Neither side sees the other's contact details.

Reply

The owner replies in the app. The finder reads it through an HMAC-signed link that lasts 30 days, or by email if they confirmed an address.

Return

When the owner marks the item returned, the finder is thanked and any other open conversations are told it's back.

When a partner checks a serial

Request

A marketplace, repairer or pawnbroker calls the Finder API with a serial number or IMEI and an API key.

Authenticate

The key's secret is checked against its bcrypt hash, then per-minute, daily and monthly limits are checked in Redis.

Match

The identifier is normalised, ignoring case, spaces and punctuation, and matched against the registry.

Respond

The partner gets a status, never an identity: registered or not, lost or stolen, category, month registered and, for lost or stolen items, a private contact link.

Record

Only a SHA-256 hash of the query is logged. If the item is lost or stolen, its owner is told it was just checked.

Engineering principles

Boring where it matters, careful everywhere.

Contract-first API

An OpenAPI 3.1 specification documents 177 endpoints. Typed React Query clients and Zod validators are generated from it, so the apps and the API can't drift apart.

Safe deploys

Database migrations run at start-up under a Postgres advisory lock, so a rolling deploy can never run them twice.

One job runner

Scheduled work, such as data retention, digests and webhook retries, takes an advisory lock so only one replica runs each job.

Race-safe by design

Returns, checkouts and subscriptions are guarded against duplicate and simultaneous requests, and tests fire the same request three times at once to prove it.

Security regression tests

A dedicated suite pins down location snapping, EXIF stripping, log redaction, duplicate serials, email throttles and upload ownership.

Least-privilege containers

The API runs as a non-root user in a slim Node.js 22 image. The web tier is a separate Caddy container that only serves the apps and proxies the API.

The stack

Modern, typed, end to end.

TypeScript Node.js 22 Express 5 BetterAuth Drizzle ORM PostgreSQL Redis Zod OpenAPI 3.1 React Vite Tailwind CSS TanStack Query Expo React Native Caddy sharp Stripe Resend Anthropic Claude

Domains

Where everything lives.

Address	What it serves
regimate.app	This website: product information, pricing, security and legal.
my.regimate.app	The Regimate web app, sign-in, and the API used by the iPhone and Android apps.
my.regimate.app/enterprise	The Enterprise portal for organisations.
my.regimate.app/developers	The Finder API developer portal, documentation and status.
my.regimate.app/help	The help centre.
my.regimate.app/find, /t and /property	Public pages opened by Regimate QR codes and NFC tags.
regimate.co.uk	Redirects to regimate.app.

Free for personal use

Lost things deserve a way home.

Create your free account Talk to us