Skip to main content

Architecture Overview

BCMLogic Next is an AI-native Governance, Risk, and Compliance (GRC) platform for regulated enterprises in the European Union. It is the successor to the BCMLogic 5.x product line, built around three core modules:

  • Continuity — Business Continuity Management aligned with ISO 22301: Business Impact Analysis (BIA), Disaster Recovery planning, Maximum Acceptable Outage (MAO), tabletop exercises.
  • ERM — Enterprise Risk Management aligned with ISO 31000: risk register, Key Risk Indicators (KRI), AI-assisted root cause analysis.
  • Vendor (TPRM) — Third-Party Risk Management aligned with DORA Article 28, NIS2, and Register of Information requirements: vendor onboarding, assessment, monitoring, concentration risk.

The platform is EU-hosted, API-first, and headless. It is designed to be consumed both through the BCMLogic Next web application and through external systems — GRC consoles, security tools, business automation, AI agents.

Architecture at a Glance​

                    Your application / agent
                              |
                              | HTTPS, OAuth 2.0
                              v
                    +---------------------+
                    |     API Gateway     |
                    |  - Auth (OIDC)      |
                    |  - Tenant resolve   |
                    |  - Rate limiting    |
                    |  - Request routing  |
                    +----------+----------+
                               |
                 +-------------+-------------+
                 |                           |
            /v1/core/*                  /v1/ai/*
                 |                           |
                 v                           v
      +-------------------+     +----------------------+
      |    Core API       |     | Intelligence Service  |
      |                   |<----|                       |
      | Transactional     |     | AI orchestration,    |
      | CRUD, domain      |     | RAG, report gen,     |
      | logic, audit      |     | document analysis.   |
      | trail, source     |     |                      |
      | of truth.         |     | Stateless w.r.t.     |
      |                   |     | business state.      |
      +-------------------+     +----------------------+

One gateway, two backends. From a client perspective there is a single base URL and a single authentication flow. Routing is based on the URL prefix: /v1/core/* reaches Core API, /v1/ai/* reaches Intelligence Service.

Backend-to-backend communication. Intelligence Service does not access Core API's database directly. It calls Core API endpoints as internal tools and subscribes to Core API events through a message broker. This is invisible to external developers.

In This Section​

PageWhat it covers
The Two-API ModelWhich API to call for which use case — read this first
Core APIModules, resource conventions, mutations, versioning
Intelligence ServiceAI endpoints, knowledge sources, citations, streaming
Cross-cutting ConcernsErrors, pagination, rate limiting, webhooks, tracing
Data Model and TenancyResource identifiers, relationships, audit trail
Authentication and AuthorizationOAuth 2.0 flows, scopes, token rotation
API LifecycleStability levels, versioning, deprecation policy
Architecture Decision RecordsThe decisions that shape the public API surface

Status: Draft, May 2026. The platform is in active development; some endpoints are not yet generally available. See API Lifecycle for stability guarantees.