Data flow

This page describes the high-level flow of data through Varolio in the default (Cloud SaaS) deployment: what comes in, how it is processed, where it is stored, and what goes out.

Users

Web Application

Outlook add-in

MCP clients

Integrations

Outlook

Recall.ai

Gmail

IN: user actions, uploads
OUT: suggestions, summaries, alerts

IN: email, attachments, meetings, messages
read-only access

AWS Account · Varolio Production · eu-central-1

api.varolio.io
WAF + ALB

Object storage

Amazon S3

large objects · attachments

Processing Pipeline

Normalize & validate

AI extraction & enrichment

Index & embed

External Managed Services

Supabase (PostgreSQL)

cases · metadata · config

Elastic Cloud

threads · cases · knowledge

Redis

cache · rate limits

Temporal Cloud

workflow orchestration

Vertex AI (Gemini)

primary LLM

Amazon Bedrock

fallback LLM

GCS buckets

replicas · media

Incoming data

Source	Data	Transport
Microsoft 365 / Outlook	Email bodies, headers, attachments, metadata	Graph webhooks + Graph API pulls, OAuth2, HTTPS 443
Users (web app / add-in)	Authentication, configuration, user actions	OIDC SSO via Studio, tRPC over HTTPS 443
Users (uploads)	Files and knowledge data	HTTPS 443
Recall.ai (Varolio Notetaker)	Meeting artifacts and media references	Svix-signed webhooks, HTTPS 443
WhatsApp (Meta Cloud API)	Messages	HMAC-verified webhooks, HTTPS 443

All inbound traffic enters through the WAF-fronted API edge (api.varolio.io) and is authenticated and validated before processing. Webhook authenticity is verified per channel (Graph validationToken, Svix signatures, Meta HMAC).

Processing pipeline

Normalize and validate — inbound payloads are normalized into threads and messages; large objects and attachments are stored in S3 (with replicas of attachments and meeting media in Google Cloud Storage).
AI extraction and enrichment — message text is sent over TLS to the AI sub-processors (Vertex AI Gemini as primary, Amazon Bedrock Claude as secondary) and structured output is returned: anchors, signals, case decisions, suggestions.
Index and embed — threads, cases, and knowledge entries are indexed with embeddings into Elasticsearch; case and workflow metadata is written to Supabase (PostgreSQL).

Data at rest

Store	Contents	Residency (Cloud SaaS)
Supabase (PostgreSQL)	Cases, metadata, configuration	EU region
Elasticsearch (Elastic Cloud)	Threads, cases, knowledge, embeddings	EU
Amazon S3	Large objects, attachments	EU (`eu-central-1`)
Google Cloud Storage	Attachment replicas, meeting media	Per-engagement configuration

All stores are encrypted at rest with AES-256. In Dedicated Cloud, the stores live in the customer's chosen region; in BYO Data Store and Cloud-Prem, content data lives on customer-controlled infrastructure.

Outgoing data

Destination	Data	Trigger
Users (via Studio)	AI suggestions and summaries (Pons responses), alerts	Continuous
AI sub-processors	Message text for inference	During processing (TLS)

Varolio's mailbox access is read-only (Microsoft Graph Mail.Read) — the platform never sends, replies to, or modifies email, and does not send outbound messages on any connected channel.

Access model

Every read and write is scoped by account, workspace, and inbox RBAC. Requests without a workspace scope are rejected at the API boundary — see Security for the full isolation model.

Data Flow