Sawtak

Privacy starts at the boundary.

The privacy proxy is the only public entry point to the API. The backend lives on an internal network and verifies proxy authentication before handling a request. Redis stays with the proxy; PostgreSQL stays with the backend.

Less information crosses the boundary.

The proxy removes client-IP headers such as x-forwarded-for, x-real-ip, and cf-connecting-ip. It replaces the browser’s User-Agent, removes the referrer and non-session cookies, and forwards a proxy session identifier instead. The design avoids IP logging at both proxy and backend layers.

Redis handles anonymous sessions and sliding-window rate limits at the edge. The internal API checks X-Proxy-Secret, applies authentication where needed, and runs Gemini-based spam and content validation before writing to a database or chain.

Two modes. Two evidence paths.

An anonymous report and an identified complaint have different privacy and editing requirements. They deliberately do not share the same persistence pipeline.

Proof, without a token economy.

Sawtak uses a custom Cosmos SDK chain with Proof of Authority rather than public Proof of Stake. Only pre-approved validators produce blocks. The standard staking and minting modules are disabled in favour of a custom poa module, so there is no public staking, inflation, or validator token reward scheme.

The development testnet runs three validators. Anonymous complaints carry cryptographic proofs of submission, while evidence CIDs preserve a tamper-evident reference without putting large files on-chain.

This makes the trust assumption explicit: record integrity depends on the approved authority set. It is not a claim of permissionless governance or absolute censorship resistance.

Small services. Clear responsibilities.

Frontend

Next.js 16, TypeScript, React Query, Zustand

Backend & proxy

Bun and Elysia.js, with a separate privacy-proxy service

Data & queues

PostgreSQL 15, Prisma ORM, Redis, Bull

Blockchain

Cosmos SDK, a custom POA module, and CosmJS

Evidence

IPFS / Pinata for anonymous reports; private Cloudflare R2 for identified complaints

Identity & access

Google OAuth, Haweya national-ID OAuth, JWT access and refresh tokens, team-based RBAC

Observability

Prometheus, Grafana, Redis and PostgreSQL exporters, Alertmanager

Docker or Podman Compose brings the services and three-node testnet up together, with configuration supplied through an environment file. A mock Haweya OAuth provider supports local development.

Built to be checked.

The project’s documented test suite separates isolated route behaviour from the real request pipeline.

Unit / route-layer tests

184

Mocked dependencies and inline Elysia handlers. No network required.

Integration tests

24

A live proxy-to-backend pipeline against PostgreSQL and Redis.

Watch the boundaries, not just uptime.

Prometheus collects request rates, latency, errors, stripped-header counts, and rate-limit activity. Redis and PostgreSQL exporters add storage and connection health; Grafana brings the signals together in pre-provisioned dashboards.

Alertmanager routes email or webhook notifications for conditions including an unreachable backend, elevated 5xx rates, high p95 latency, and database or cache pressure. Monitoring stays on the admin network.

Accountability on the other side of anonymity.

Administrative actions are audited. Identity reveal requires two-step approval, from Team Admin to Platform Admin. Passwords use bcrypt with cost 12; JWT access and refresh tokens and role-based permissions control authenticated workflows.