Data model
Neofir's storage is a multi-tenant relational store with vector search built in. Every business-facing object is scoped to an organization, with row-level security enforced at the database. Soft delete is preferred over hard delete for anything user-visible.
Organization
The root tenant object. One row per signed-up business. Holds:
- Identifiers — slug, display name, owner.
- Plan — current subscription tier and monthly message quota.
- Personality — the configurable PETG block (role, environment, tone, goal, guardrails) plus optional welcome, fallback, shortcuts, and example phrases.
- Service catalog — what the business offers (rows with name, price, duration, optional resource binding).
- Enabled tools — the skills the agent may call, per the tool catalog.
- Branding — colour, logo, widget cosmetics.
- Allowed domains — origin whitelist for the widget.
- Legal acceptance — terms and DPA acknowledgement audit trail.
Users & roles
Dashboard users belong to an organization with a role (owner, admin, or member). Owners can change billing, add seats, and delete the organization; admins can manage conversations, knowledge, and integrations; members can read.
Conversations & messages
A conversation is one session per visitor per channel. It carries the channel type (web / Instagram / Messenger / WhatsApp), the visitor identifier, status (active, closed, handed-off), and the timestamp of the last message.
Messages are append-only. Each message records its role (user, assistant, system), content, the model used to generate it, token counts and cost, and any tool call that ran for it.
Documents & knowledge chunks
A document is a single piece of source material (text, PDF, FAQ, URL). It tracks its title, source type, indexing status, chunk count, and usage mode.
Chunks are the retrieval unit. Each chunk stores its content, an embedding vector, token count, the enclosing markdown heading at chunk start, and (for PDFs) the page it came from. The heading and page surface in the prompt so the agent can cite sources naturally.
Calendar primitives
- Bookings — confirmed slots; the calendar's source of truth.
- Services — catalog rows with id, name, price, currency, unit, duration.
- Resources — multi-resource support (operators, bays, doctors). Each has a name and capacity; bookings reference a resource for conflict detection.
- Business hours — per-day intervals with break support.
- Time off — vacation and closure windows that subtract from availability.
Audit & security
Admin actions affecting another party (organization suspend / delete, conversation export or deletion, takeover) are written to an immutable audit log. Outbound SMS, WhatsApp, and email each have their own log with provider message ids for delivery tracking.
Row-level security
Every tenant-scoped table has RLS enabled with policies that scope reads and writes to the caller's organization. Cross-organization paths (rate-limit counters, platform admin actions, third-party webhook ingestion) run through privileged service code that always pins the organization id explicitly as defence in depth.