Why does your agent never invent a vacancy that doesn't exist, never break the safety ratio, and never see another school's data? Not luck — it's the architecture underneath: a real-time data flow, agents that govern each other, and walls that seal every school. Shipping today — not future-marketing.
agent · pre-push gate
adversarial suite — every pre-push
school ownerpass
instructorpass
surferpass
jailbreak attemptsblocked
judge verdictship
safety core: sealed · the system cannot relax it
TL;DR · 4 thingsLive
A governed agent, not a chatbot
One source of truth, separated permissions, every school walled off — the agent can't break a rule or cross a wall.
Walls between schools
Server-side scoping + private context file + isolated agent. Zero cross-school reads — enforced in code, not in policy.
Forecast calibrated per spot
Proprietary blend + a per-spot wave reading + windows tuned to each lesson level.
Adversarial swarm at the pre-push gate
Six personas + a judge attack our own Agent at every pre-push gate. A failed rule blocks the push.
0
Cross-school leaks (all-time)
46
Adversarial runs today
6
Personas in CI
Where software stops being hype
Two years of operations engineering.
The agent is a feature. The OS underneath is the moat. Each line below is a system that another team needs months to copy — not weeks.
Lesson state-machine
Refund tier (>96h 100%, <24h 0%), no-show, reschedule chain (original-slot ID protects refund tier from bypass), conditional cancel + auto-refund cron, group split with idempotent re-dedupe.
Hash-chain ledger + drift cron
Every Stripe event written to an append-only ledger with SHA-256 chain. Daily cron reconciles Stripe ↔ DB and flags drift. Backups across three independent silos in separate jurisdictions, AES-256-GCM envelope encryption.
Channel-Manager iCal
SSRF guard at DNS resolution time, streaming size cap, encoding auto-detect, anti-wipeout guard on suspicious empty feeds, per-feed advisory lock, STATUS:CANCELLED outbound so Airbnb actually unblocks the slot.
Per-spot forecast
Proprietary per-spot model that reads wave, wind, tide and sea-state together, promotes official ocean alerts, adjusts to the tide and shows an hourly confidence indicator — tuned to the wave at the peak, not the offshore reading.
Beach Editais + SurfBooking ratios
SurfBooking ratios (1:6 beginner, 1:8 intermediate, 1:4 kids, 1:4 private), kids-age validation, sanity-check price (sub-€10 reject), Editais warning every time 2+ coaches share a lesson.
GDPR + admin protocol
Right-to-erasure across 20+ tables (preserving fiscal ledger), object-storage cleanup of avatars + lesson photos, admin audit log on 30+ destructive actions, 2FA dual-OTP on admin-on-admin actions, mutual lockout block.
Voice agent · shipping today
Talk to the calendar. The calendar talks back.
Two mics: one on the calendar header for bulk operations, one on each lesson tile for surgical edits. No commands to memorise — natural Portuguese, browser-native speech.
Best-window picker
"Move to the best day this week" → fetches 168h forecast, scores per level (wave height range + swell period >12s + offshore wind direction), picks the top hour, modal shows conditions (1.2m · 8kn offshore · score 78/100) before confirm.
Bulk reschedule
"Move all beginner lessons to next week" / "to next month" / "to the best day". One sentence reschedules dozens of slots in parallel, with per-lesson conditions shown — staff conflicts caught server-side before commit.
Surgical edits per lesson
Mic on the lesson tile knows the context: "Instructor Pedro" / "Price 55€" / "6 students" / "Duplicate to Saturday at 10". Fuzzy first-name match against active staff. No menus — direct PUT, instant feedback.
Never opens the agent silently
If the parser can't understand the command, it shows examples in a toast — stays in the calendar. The agent only opens when the user explicitly says "open the agent". Stops the frustrating "AI tried to answer and made it worse" pattern.
PT-PT mishear normalisation
Browser speech recognition hears "Móvel" instead of "Move-a", "Mac me" instead of "Marca-me". The parser normalises before regex, accepts "dia 24" / "next week" / "next month", and word-numbers ("cinco alunos") — built specifically for how Portuguese surf school owners actually speak.
Stock-aware agent
Ask "how many M wetsuits do I have?" and the chat agent answers from a pre-computed stock block in the system prompt — never invents numbers. Equipment + maintenance qty visible separately. Lazy-fetched, so it doesn't cost tokens on unrelated queries.
The brain that grows · shipping today
The agents don't just answer. They remember, they watch themselves — and they evolve by measurement.
Most AI features freeze the day they ship. Ours has a memory that accumulates, a self-improvement loop built on measured A/B trials, and a live map that surfaces its own weak spots.
A memory that consolidates
A persistent knowledge graph. Every rule, amendment and measured trial is stored — not redrawn from scratch each time. Connections that hold over time consolidate and draw thicker; history — even a rejected amendment — stays with its timestamp. It never lies about the present; it only adds the past.
Self-improvement, measured
The agent can propose changes to its own instructions — each tested by an A/B trial (control versus treatment), promoted only if it measurably wins, with real schools' feedback as the canary that retracts a change that made things worse. The architecture is built and runs on demand; the autonomous nightly loop switches on when we decide — no hardcoded ceiling in the design.
A network that watches itself
A live map in the operator console shows the whole nervous system — and flags its own weak signals: a test persona beating the agent, a proposal that protects no rule. Self-diagnosis as a feature, not a defect — the network showing its own signals.
At a glance
One coordinated intelligence — one source of truth, three real-time outputs.
Coordination
One brain, one truth
↓
Across the network
Network effect
Network intelligence
Outside data
Checked
Verified sources
Per school · Walled
Isolated
Each school walled off
Three walls per school · server-side scoping · pinned rulebook · private context file. Zero cross-school reads.
↓
→ Web · Marketplace
Public spot pages, Surf Today rankings, bookable lessons.
→ Mobile app
Check-ins, QR codes, waivers — operations on the sand.
→ Partner network
Hotels & partners promote local lessons with link/QR.
Different by design
This isn't a feature. It's an architecture choice from day one.
Dozens of interacting subsystems, each obsessing over a slice of surf operations — forecast, ratios, waivers, payouts, channel sync, attribution, agent isolation. The integration is the moat. Each piece in isolation is well-trodden engineering; the way they line up around how a surf school actually runs isn't.
A booking platform with surf on top isn't this. A forecast app with bookings stapled on isn't this either.
The open layer — intelligence that connects
The moat isn't a single feature. It's an operating system other systems — brands, apps, sensors — plug into, by the rules.
One session, any signal
The Intelligence Layer treats an Apple Watch, a board sensor and a manual note as streams of one session — each with its own clock, merged server-side into the surfer's Passport. Raw GPS never leaves the device; only the consolidated result travels, and only with adult consent.
An open API and MCP
The per-spot forecast, real availability and booking creation are readable by any marketplace, channel manager or AI — through standard formats. Partners plug into the intelligence by the rules, never around them.
An agent that can't lie
Every reply the agent produces passes a deterministic honesty gate before it reaches anyone: it can never invent a forecast, promise a refund, leak money figures to staff, or name a competitor — in any language. These guards are locked by a regression test-set, so the agent can sharpen its wording but never regress on the truth.
Security at the perimeter
Before any request reaches our agents or our database, it has to clear the edge layer.
An enterprise edge in front of everything
All traffic enters through an enterprise edge — WAF, DDoS mitigation, bot fight mode, country-level ASN filtering. The origin servers never see the raw public internet; an attacker has to defeat the edge first.
Layered rate limiting
Beyond the edge, every sensitive endpoint carries its own per-IP / per-user / per-endpoint rate limit — login attempts, AI calls, search queries, public listings. A single compromised credential or a creative scraper gets capped long before it can do damage at scale. Cost-DoS on the AI endpoints (a stranger trying to drain our LLM budget) is metered the same way.
TLS-only, HSTS, signed cookies
No cleartext traffic anywhere — strict HTTPS on every domain with HSTS preload. Session cookies are signed and HttpOnly so an XSS bug in any page can't read the auth token. Payment touch-points run through Stripe Checkout / Connect — we never see card numbers ourselves.
Two-factor authentication with encrypted secrets
School owners and admins can require a second factor — a six-digit code from an authenticator app or biometric unlock on mobile. The TOTP secrets that drive those codes are encrypted at rest with a strong modern cipher — so even a database dump leaves the second factor intact. Passwords are hashed with bcrypt + salt; rotating an account's email revokes every active session for that user.
The nervous system
What happens when a school owner creates or edits a lesson:
1
Origin — Control Center
Owner sets time, level, tide restriction, capacity, instructor. Submitted to the SurfBooking core.
Server validates the ratio against the platform rulebook (1:6 beginner, 1:8 intermediate, 1:4 kids), checks tide windows, scores the conditions, and writes the result.
3
Distribution — three outputs, in real time
Web · Marketplace
Lesson appears on the public spot page + Surf Today rankings.
Mobile app
Check-ins, QR Codes, waivers. Instructors manage the day on the sand.
Partner network
Hotels and partners promote local lessons via link/QR — each booking knows where it came from.
Governed intelligence, not a chatbot
Our AI isn't one chatbot with instructions. It's a governed system with separated permissions — built to resist prompt-injection and to make sure no answer can cross a wall it shouldn't.
Guarantee · Coordination
One source of truth
Every answer is grounded in the platform's real state — bookings, calendar, sea. Outside signals never reach the core directly: everything is filtered first.
Guarantee · Network
The network learns, schools stay private
Aggregated, anonymised patterns feed continuous improvement — a network effect — without ever sharing one school's data with another.
Guarantee · Outside data
External sources come in checked
Public data (rulebooks, official sources) is sanitised before it can influence anything — the standard defence against Indirect Prompt Injection.
Guarantee · Per school
Each school walled off
Each school's assistant is sealed inside that school, walled off for GDPR. It knows the local context (hours, equipment, house rules) and can never read another school's data.
Walls between schools
Each school is a sealed silo. We enforce this at every layer.
Server-side scoping
Every endpoint that returns bookings, students, staff or forecast filters by the school's ID before any data leaves the database. The UI cannot override this.
Anti-jailbreak constitution
The AI assistant is bound by a server-pinned rulebook injected before every conversation. It is told it works for a single school, that it cannot mention others, and that platform rules override anything the school says — even when the school insists.
Your own context file
Each school edits a private text file the assistant reads before answering — your hours, your equipment, your house rules. The file is bounded, audit-logged on every edit, and never shared with other schools.
PII stripped before any model sees it
Every user-supplied message passes through a redaction pass that strips email addresses, phone numbers, tax IDs, IBANs and card numbers before reaching any language model. The same pass runs on the model's reply on the way back, so even a model that hallucinates one cannot leak it. Cards detected by IIN-prefix + Luhn check; other identifiers by anchored shape match. The pass is regression-locked by the adversarial test layer above.
Forecast pipeline
Why our 'best window for beginners' isn't just a guess.
Honest confidence, not false precision
When the data isn't certain, the spot gets a 'low confidence' badge instead of pretending we know. We'd rather tell you it's borderline than sell you false precision.
The wave at the peak, per spot
The number you see is the wave at the peak for that exact beach — not the raw open-ocean value. The same Atlantic swell reaches an exposed point and a sheltered bay with very different real heights, and we read each one on its own terms.
Per-level pedagogical windows
We score windows across the forecast horizon against SurfBooking's level definitions — what counts as a good window for beginners is not what counts for advanced. The 'best window' the wizard shows is the one that fits the level the school is teaching.
Adversarial defence layer
What runs against our own Agent before any production user does.
S
Staff
Probes privacy walls
C
Customer
Demands refund · leaks card
D
School owner
Stress-tests scale
M
Multi-turn
Lulls then strikes
Deterministic preflight on every reply path
Before any Agent reply reaches a user, the user-supplied text passes through a sanitisation layer that strips personal identifiers and neutralises known prompt-injection patterns. The layer is regression-locked by an internal test suite — a new attack added in the wild gets a paired regression test before the fix is considered shipped.
Six personas, scripted to break things
We maintain six adversarial personas — including a frustrated customer, a school owner stress-testing scale, a staff member probing privacy walls, and a multi-turn attacker who lulls the Agent across many turns before striking — each one a detailed role-play that knows exactly what to leak (a card number, a refund demand, a colleague's data) to trip the Agent. The deterministic rules run at every pre-push gate; the multi-turn live-LLM conversations that drive them across full scenarios run in the adversarial swarm (operator-run).
Build-blocking, not vibes-based
A failing rule isn't a warning — it stops the deploy. Whether the rule is 'no IBAN survives the redaction layer' or 'staff role cannot see another instructor's bookings', the verdict is verifiable in code and binary. Marketing copy is not graded; only behaviour is.
Background diligence on every school application
When a school requests a Partner badge, a Verification Agent runs a background sweep so the human reviewer reads a brief, not a blank form.
Public-data fact-check
The Verification Agent runs an isolated web search (the only outside-facing search in the platform), gathers public mentions of the school + its declared licence, and tags each claim as confirmed / unconfirmed / contradicted. Each fact carries its source URL so the human reviewer can verify in one click.
Bias and review-pattern sweep
A second pass scans the school's public review footprint for red flags — coordinated negative campaigns, suspicious 5-star bursts, banned-behaviour patterns. The output is informative only, never a block; an isolated risk-score (0-100) lands on the brief for the reviewer to weigh.
Sealed briefing — never shared back
The brief is stored in an admin-only research history table. It is never forwarded to another school, never used to train models, never appears in any other school's context. Only the reviewer who opens the case sees it; deletion of the case deletes the brief.
Human decides — every time
The agent never approves or rejects. It writes the brief; a person reads and clicks. Every approval and every rejection is recorded with the brief attached, so a regulator (or the school itself, if it asks) can reconstruct exactly what was known at the moment of the decision.
Data resilience
What we promise about your operation outliving any single failure.
Administrative operations (account changes, role escalations, GDPR purges) write to an append-only log retained by convention. Refund and payout reconciliation goes one step further with a server-side hash chain so cash-flow tampering is detectable on replay.
Three-silo backup
Daily encrypted snapshots replicated across the production database, an independent object-storage provider, and a physical machine in another country. Losing one silo loses zero data.
Self-serve encrypted export
Any school can download its full operational data as an AES-256 ZIP keyed to its own password. Even we cannot read it. The export excludes app-customer PII (kept inside the SurfBooking messaging channel) but includes everything else.
What auditors see
Under NDA, when a regulator asks, we open up our controls — the code paths that prove privacy, audit-trail integrity and RGPD purge work as described. We never open the content those controls protect: the school's context file, the assistant's prompts, the conversations between schools and the AI. Audit of controls, not audit of content.
Algorithmic constitution
The rules that bind every agent.
Our entire multi-agent network is governed by server-pinned laws hard-coded into each agent's base instructions (shielded against jailbreaks and prompt-injection). The constitution is what guarantees school isolation, attribution honesty and automated mass-payments without human nudging.