System Architecture
A deep dive into REFRACT PDF's No-Egress security model and tenant-native integration.
The No-Egress Philosophy
REFRACT PDF is engineered on the principle of Data Residency. Unlike traditional PDF APIs, your sensitive JSON data never leaves your environment.
Security First
The document rendering engine runs inside the customer's own tenant. Our central API only handles licensing handshakes, never document content.
For a detailed breakdown of authentication mechanisms, access controls, and document integrity enforcement, see Security & Verification.
Technical Stack
Serverless Rendering
REFRACT PDF processes document rendering serverlessly, allowing automatic scaling and low operational overhead for both SMB and enterprise workloads.
Async Queue Processing
REFRACT PDF supports optional asynchronous processing using a queue-based dispatch layer, enabling high-volume document generation and enterprise batch workflows.
Flexible Storage Providers
Templates and document payloads can be retrieved from Microsoft SharePoint, with planned support for additional providers such as Azure Blob Storage to support cloud-native deployments.
Secure License Validation
REFRACT PDF uses lightweight encrypted validation with HMAC-based verification to ensure authorized usage without transmitting sensitive document data outside the customer environment.
Deterministic Rendering Pipeline
Documents are processed through a multi-stage rendering pipeline that normalizes structure, resolves styles, validates layout safety, and produces consistent PDF output across dynamic datasets.
Enterprise Integration Ready
REFRACT PDF is designed to integrate easily with systems like Microsoft Dynamics 365 and Microsoft Power Automate, enabling automated document generation directly within business workflows.
Data Flow: How It Works
REFRACT PDF renders documents entirely within the customer's cloud environment using native services from Microsoft Azure. The following steps describe how a document request moves through the REFRACT PDF rendering system.
Trigger & JSON Payload
Your system (Dynamics 365, Power Apps, or any HTTP client) calls the REFRACT PDF rendering endpoint with the document data as a JSON payload.
License Validation
The engine performs a lightweight encrypted license check against the REFRACT PDF licensing service using metadata only. No document content is transmitted.
Template Retrieval
The rendering engine retrieves the .rpkg template file from your SharePoint assets library using Managed Identity - no stored credentials required.
Optional Batch Dispatch
For large workloads, jobs are queued for asynchronous processing via the built-in workflow queue.
Local Rendering
The PDF is generated entirely in memory inside the customer's Azure environment.
Document Delivery
The completed PDF is returned to the calling system or saved back to SharePoint.
Architecture Diagram
Canonical architecture diagram and Mermaid source (interactive):
The Portal is stateless - document bytes are streamed from customer-controlled storage via the Dispatcher; notifications carry metadata only.
flowchart TB subgraph EC["Entry Channels"] PP["Power Platform<br/>Power Apps<br/>Power Automate"] D365["Dynamics 365 (CRM & ERP)<br/>• Dynamics 365 Sales<br/>• Business Central<br/>• Finance & Operations"] SP["SharePoint / SPFx<br/>REFRACT Lifecycle UI"] PORTAL["REFRACT eSign Portal<br/>(External Signers)"] end subgraph CUSTOMER["Customer Azure Environment"] ENTRA["Microsoft Entra ID<br/>Authentication & Authorization"] DISP["REFRACT Dispatcher Function App<br/>• Gateway Routes (/gateway/*)<br/>• Direct API Routes (/api/*)<br/>• OAuth / JWT Validation<br/>• REFRACT PDF Rendering Engine<br/>• Workflow & eSign Orchestration"] BUS["Customer Azure Service Bus<br/>Priority Queues<br/>Workflow • eSign • Delivery • Notification • Audit"] PROC["Processor Function Apps<br/>REFRACT Workflow<br/>REFRACT eSign<br/>REFRACT Delivery<br/>REFRACT Audit<br/>REFRACT Lifecycle"] ENTRA --> DISP DISP --> BUS BUS --> PROC end subgraph SHARED["REFRACT Platform Shared Services (Refract Logic)"] LIC["Licensing API - licenseKey + tenantId only"] NOTIFY["REFRACT Notification API - metadata only"] ACS["Azure Communication Services - Email/SMS"] NOTIFY --> ACS end PP --> ENTRA D365 --> ENTRA SP --> ENTRA PORTAL -. "Portal ↔ Dispatcher" .-> DISP DISP -. "License Validation" .-> LIC PROC -. "Workflow / Delivery / eSign Notifications" .-> NOTIFY PORTAL -. "Invitation Emails / Signer Notifications" .-> NOTIFY
Licensing & Governance
We manage global governance through our centralized subscription portal:
{
"tenantId": "client-uuid-1234",
"apiKey": "vpdf_live_xxxxxxxx",
"action": "verify_and_log",
"usageMetadata": { "type": "invoice_gen", "region": "US-South" }
}API Key Security
Never expose your apiKey in client-side code or commit it to version control. Use Azure Key Vault or environment variables to manage secrets securely.
See the Architecture in Action
Explore the interactive playground to trace a live document request through the full No-Egress pipeline.
Capabilities & Features
A comprehensive overview of REFRACT PDF's document rendering capabilities, enterprise features, async workflows, and monitoring tools - all in a single self-hosted engine.
REFRACT PDF Rendering Pipeline
REFRACT PDF processes every template through a deterministic multi-stage rendering pipeline ensuring layout stability, visual consistency, and secure document generation, structured across 12 sequential stages from structure normalization to final PDF output.