Movahedi Solutions
Infrastructure and Cloud Architecture
1000823315 ONTARIO INC., operating as Movahedi Solutions, Mississauga, Ontario, Canada. Contact: mohammad@movahedi.ca. This page describes, in plain terms, how the public site is built and delivered, what is verified, and what is not. It covers the public site only. Engagement data is handled per engagement, and it is not stored on the public site. That distinction is kept clear throughout this page.
Public site architecture, in plain terms
The public site is a static site. Its source is held in GitHub, and it is built and deployed from GitHub, so a change to the live site can be traced to its source. It is delivered over HTTPS through Cloudflare. In plain terms: GitHub holds the source and produces the site; Cloudflare delivers the site to a visitor over an encrypted connection. That is the architecture for the public site, and no other hosting claim is made on this page.
What is verified, with dates and links
- Delivery over HTTPS through Cloudflare, verified October 27-28, 2026. Detail: Security Practices.
- Built and deployed from GitHub, verified October 27-28, 2026. Detail: Secure Software Development Lifecycle.
- Third-party header scan, October 28, 2026: see Security Practices for the dated result.
- SSL Labs grade A on all four endpoints tested, assessed October 28, 2026, at 01:00:26 UTC, at SSL Labs: movahedi.ca. Detail: DNS and SSL Checks. No A+ SSL grade is claimed, because the grade returned was A.
- DNS and mail records, checked October 28, 2026 (UTC). Detail: DNS and SSL Checks.
Engagement data, kept separate from the public site
Engagement data is handled per engagement, under the terms agreed for that engagement. It is not stored on the public site. Client material is used only for its engagement, access is limited to what the engagement requires, and at engagement end it is returned or deleted on the client's instruction. Client data is not sold, and client data is not used to train models. Detail: Privacy and Data Handling and Privacy Notice for Engagements.
Public site stack, verified from the site source and the live site
Each component below was verified in the site source or on the live site, with its date and link. Public site stack, which is verifiable, is kept separate from engagement services, which are advisory work agreed per engagement. The public site stack is not a client data platform, a database, a tenant system, or an encryption and key management system, and no such claim is made here.
| Component | Evidence | Date | Check it |
|---|---|---|---|
| Source and deployment: movahedi-ca GitHub repo | Site built and deployed from GitHub | October 27-28, 2026 | Secure Software Development Lifecycle |
| Delivery: Cloudflare, over HTTPS | Public site served over HTTPS through Cloudflare | October 27-28, 2026 | Security Practices |
| Header scan | See Security Practices | October 28, 2026, at 00:59 UTC | Security Headers scan |
| SSL check | SSL Labs grade A on all four endpoints | Assessed October 28, 2026, at 01:00:26 UTC | SSL Labs: movahedi.ca |
| Application runtime: Cloudflare Worker movahedi-ca | Serves site assets and API and MCP routes, per the site configuration read October 28, 2026, with live confirmation October 28, 2026, at 02:17 UTC | October 28, 2026 | movahedi.ca/api/v1/health |
| Site build: Astro static site | Built with Astro as a static site, per the site build | October 28, 2026 | movahedi.ca |
| Search: Tier 1 index plus Pagefind | Search at /search/ returns Tier 1 index results plus Pagefind full article text results; Pagefind runs after the build on built HTML and loads only on the search page. Scope note: Pagefind verified in source, not from branding text on the fetched page. | October 28, 2026, live search page fetch at 02:17 UTC | movahedi.ca/search/ |
| Privacy API: REST at /api/v1 | Live and read-only, enforcement, glossary, Law 25 checklist, cookie patterns, crawler registry, breach deadlines; 2,000 anonymous calls per IP per day, 10,000 with a free key; ETag on every response. Live health response: status ok, version 1.0.0, data version 2026-10-28, counts 10 enforcement actions, 11 Law 25 checks, 202 cookie patterns, 51 crawlers, with the glossary at its then-current count of 320. Scope note: health fetched live; individual data endpoints verified from the developers page table, not each called. | October 28, 2026, at 02:17 UTC | movahedi.ca/developers and movahedi.ca/api/v1/health |
| MCP server: 11 read-only tools at /mcp | Streamable HTTP; tools: privacy_search_enforcement_actions, privacy_get_enforcement_case, privacy_lookup_glossary_term, privacy_list_glossary_terms, privacy_law25_requirements, classify_cookie, lookup_tracker, lookup_crawler, list_crawlers, privacy_search_api, privacy_execute_plan. Contract hash 90f07f530204002c72b87a5775e2b4be9b9c3a4943708da1caeedba7359eb90e, updated 2026-10-25. Scope note: no live MCP tool call made in that run; tools documented, not tool-called. | October 28, 2026, at 02:17-02:18 UTC | movahedi.ca/developers, movahedi.ca/mcp, movahedi.ca/.well-known/poppy.json |
| Personal Agent Protocol (Poppy) version 0.2 | No sign-in sessions, same read-only API and MCP, sessions max 24 hours, session records hold no names, emails, or IP addresses. Protocol version 0.2, organization Movahedi Solutions, issuer movahedi.ca. | October 28, 2026, at 02:18 UTC | movahedi.ca/.well-known/poppy.json and movahedi.ca/developers |
| API key issuance: Cloudflare Turnstile | Free key via Turnstile challenge plus API terms acceptance, shown once, never stored on the site side, no account or email needed | October 28, 2026 | movahedi.ca/developers |
| Public tools library and reference data | 21 hands-on tools; glossary 333 terms; AI Crawler Registry 51 records across 26 operators, dataset v1.0.0, 2026-10-23, at /api/v1/crawlers and via lookup_crawler and list_crawlers | October 28, 2026 | movahedi.ca, movahedi.ca/developers, movahedi.ca/api/v1/health |
| Site tools, client-side | Most tools run in the visitor browser; free tools run entirely in the browser with no account | October 28, 2026, live site check | Website Accessibility and Privacy Self-Check |
Tools, only verified tools
Public-site vendors: Cloudflare, GitHub, Google Workspace, MailerLite, and Cal.com. Engagement tools are agreed per engagement. Detail: Subprocessors.
Related pages
- Trust Center
- Security Practices
- Secure Software Development Lifecycle
- DNS and SSL Checks
- Encryption Statement
Scope and limits, stated briefly
For the public site, HTTPS through Cloudflare and Strict-Transport-Security with preload from the dated scan are stated, for the site only, not for client data generally. For engagement data, encryption, key management, and storage are confirmed in writing per engagement, as set out in the Encryption Statement. Contact: mohammad@movahedi.ca.