Tech Specs
A modern RAG architecture with AI vision.
Architecture at a glance
ManualNinja is a multi-tenant RAG application with a Python backend, a React SPA frontend, a PostgreSQL database, and a Qdrant vector store. PDFs are parsed, chunked, embedded and served as cited answers through a chat interface. The platform now includes AI vision for image analysis, OAuth social login, and Stripe-powered subscription billing.
Backend API
FastAPI + Uvicorn (Python 3.13). REST endpoints for auth, manuals, chat, billing, and admin. JWT-based authentication with OAuth2.
Frontend
React 18 + Vite. Single-page application with chat UI, admin panel, billing portal, and superadmin dashboard.
Database
PostgreSQL 17. Stores organizations, users, manuals, chat sessions, usage tracking, and configurable settings.
Vector store
Qdrant 1.19. Semantic search over manual chunks with organization-scoped filtering.
Embeddings
BAAI/bge-small-en-v1.5 (384 dimensions, CPU). Local inference — no external embedding API calls.
LLM (text)
OpenAI-compatible API. Default model: deepseek/deepseek-v3-0324. Configurable via superadmin dashboard.
Want a local ai for security, no problem. Contact us
LLM (vision)
Novita AI vision model — google/gemma-3-27b-it. Analyzes uploaded images (device labels, error screens, nameplates) with OCR and structured extraction.
PDF extraction
PyMuPDF (fitz). Page-level chunking with metadata preservation for accurate citations.
Authentication
JWT tokens + Google OAuth 2.0 + LinkedIn OAuth 2.0 (OpenID Connect). Email verification with configurable SMTP.
Payments
Stripe — recurring subscriptions via Checkout, customer portal for self-service management, webhook-driven lifecycle events.
Reverse proxy
Caddy — automatic HTTPS via Let’s Encrypt, HTTP/2, HTTP/3 support.
Multi-tenancy & isolation
Each customer organization gets a fully isolated workspace:
- Organization-scoped users, manuals, and chat sessions
- Qdrant payloads include org_id — vector search is always filtered
- Tier-based limits: questions/month, storage, question length, manual count
- All integration keys (Stripe, Google, LinkedIn, LLM, SMTP, reCAPTCHA) are configurable per deployment via the admin UI
Security & data protection
ManualNinja is built with security as a first-class priority. Every layer of the stack is hardened to protect your data and your customers’ trust.
End-to-end encryption
All traffic is served over HTTPS with TLS 1.2/1.3 via Caddy with automatic Let’s Encrypt certificates. No plaintext connections accepted.
Secure authentication
JWT-based auth with strong secrets, bcrypt password hashing, OAuth 2.0 with CSRF-protected state validation, and short-lived exchange codes instead of tokens in URLs.
Brute-force protection
Login rate limiting (10 attempts per 5 minutes per IP), signup rate limiting (3 per IP per day), and mandatory Google reCAPTCHA on public signup.
Multi-tenant isolation
Every database query and vector search is scoped by organization_id. No cross-tenant data leakage is possible — your manuals and chats are yours alone.
Safe file uploads
PDF uploads are validated by magic bytes, content type, and a 50 MB hard size limit. Files are stored with UUID names — no path traversal possible.
Verified webhooks
Stripe payment webhooks are always signature-verified. No unauthenticated payment events are ever processed — the system fails closed if the secret is missing.
Internal services only
The FastAPI backend and Qdrant vector database bind to 127.0.0.1 only. They are never directly accessible from the internet — all external traffic goes through the Caddy reverse proxy.
Email verification
Signup requires email verification with time-limited tokens (24-hour expiry). Unverified accounts cannot log in.
Audit logging
All admin and superadmin actions — organization creation, user management, settings changes — are logged to a dedicated audit trail for accountability and compliance.