gn-apex logo
Apex
Sovereign Enterprise OSv2.0 Released

Fifteen tools,
quietly became one.

Consolidate 10–15 disconnected SaaS subscriptions into one cohesive operating environment. Headless hosting, billing, WhatsApp automation, analytics, and vertical engines—engineered natively.

System catalog — rev. 09

Eight subsystems.
One control plane.

Every module below runs on the same account, the same billing line, and the same login — infrastructure, payments, communications, and AI, without the seams.

01

Core infrastructure & edge mesh

Anycast DNS / 300+ POPs / PULSE sync

Domain, hosting, and CDN under one zone file — DNSSEC by default, SSL issued automatically, schemas compiled to typed Postgres models on push.

<300msglobal propagation
Domain & DNS automation

Instant registration, Anycast DNS console, automated DNSSEC rollover, 1-click transfers.

PULSE protocol

Sub-second global cache invalidation — mutations propagate across every edge node instantly.

Dynamic schema CMS

Visual block builder compiling JSON schemas into typed DTOs, auto WebP/AVIF transforms.

Bring your own storage

Pre-signed direct uploads to Cloudflare R2 or MinIO, plug-and-play S3 bucket support.

  • Instant domain search — .co.tz, .com, 40+ TLDs
  • 99.9% uptime SLA, financially backed
  • Zero-config SSL/TLS, auto-renewing
  • Media pipeline — WebP/AVIF transcode on upload
edge routing engine● operational
$ npx @nexushub/client deploy
anycast dns propagated — 300+ locations
schema compiled — @nexushub/client → postgres
tls 1.3 auto-ssl — 99.9% uptime verified
Open full dossier
02

Omnichannel communications

WhatsApp Cloud API / mail / SMS gateway

Every inbound thread — WhatsApp, SMS, corporate mail — lands in one desk with shared assignment and SLA timers, instead of three logins.

3channels, one inbox
  • Multi-agent WhatsApp desk, 24-hour SLA windows
  • ApexMail — DKIM, SPF and DMARC provisioning
  • Twilio and local carrier SMS ingress
  • Calendar sync across Google and Microsoft 365
WhatsApp Business API v1924H ACTIVE
Corporate mail — SPF/DKIM/DMARCVERIFIED
Open full dossier
03

Telemetry & Sentry ingestion

Cookie-less / Rust ingest / real-time

A Rust ingestion layer replaces analytics tags entirely — no cookies, no consent banners, and the dashboard updates as it happens.

10,000+events / second
  • Click, scroll and rage-click heatmaps
  • Dark-social clipboard share telemetry
  • Real-user Core Web Vitals monitoring
  • Automated technical SEO auditing
Open full dossier
04

Payments & fiscal compliance

TRA e-signature / QR receipts / escrow

Tax authority signatures attach automatically at checkout. Every receipt carries a verifiable QR code — zero physical EFD hardware required.

100%TRA-signed receipts
  • Direct TRA VFD signatures — QR codes & Z-reports
  • M-Pesa, TigoPesa, Airtel and card settlement
  • Milestone escrow, automated 70/30 splits
  • Selcom and Flutterwave, auto-reconciled
TRA VFD uplink engineconnected
checkout › selcom gateway › z-number signature issued
Open full dossier
05

Gora AI — grounded agent

Live DB reads / zero hallucination

The agent reads your actual database through parameterized queries and vector-matched context — it answers from what's true right now.

0invented answers
  • Multi-channel — WhatsApp, web, SMS, mail
  • Visual canvas — if-this-then-that triggers
  • Sovereign token caps per organization tier
  • Vector semantic embeddings, always grounded
autonomous execution loop● operational
1.inbound — "what is my child's outstanding tuition?"
2. rag read — StudentFee 150,000 TZS · control #99482
3. action — payment link dispatched via WhatsApp
Open full dossier
07

Security & Nexus Shield™

Brand sentry / FIDO2 / PCI DSS Tier 1

Certificate-transparency scanners watch for phishing clones of your domain around the clock. Sign-in is biometric, not a password field.

PCI-1encrypted at rest
  • Domain typosquatting & clone detection
  • WebAuthn biometric and passkey support
  • Certificate transparency stream sentry
  • PCI-DSS Level 1 and GDPR DSAR compliant
AES-256 encryptedactive WAF
Open full dossier
08

B2B visitor intelligence

Corporate de-anonymization, <500ms

Identifies the company behind an anonymous site visit through ASN and routing analysis, and routes the alert before the visitor leaves the page.

<500msidentification
  • MaxMind ASN and IP2Location enrichment
  • Firmographic revenue profiling
  • Slack and WhatsApp instant account alerts
  • Intent scoring on page-level engagement
dispatched abm alertjust now

Vodacom corporate LAN detected browsing /enterprise-pricing. Intent score 88/100.

Open full dossier
09

Developer CLI & talent escrow

npx nexus init / milestone split

A real toolchain — local emulators, schema migrations, and a vetted developer marketplace paid out against completed milestones.

70/30milestone split
  • Vetted talent marketplace, dispute workflows
  • Dynamic schema — typed tables, admin panels, REST
  • Webhook sandbox with HMAC-verified replay
  • Full REST API and rate-limited retry loops
nexus cli v2.4typescript first
$ npx nexus init --template enterprise
✓ schema validated · prisma compiled · edge pops ready
Open full dossier
06

Industry vertical suites

Pre-configured, not built from scratch — four turnkey operating systems

Academic intelligence

End-to-end academic, fleet, and fee management for modern institutions.

Admissions & 360° profiles

Digital enrollment lifecycle with transcripts and historical logs.

Automated report cards

One-click PDF generation calculated directly from teacher grade inputs.

NECTA exam reconciliation

Automated batch import and sync with national examination indexing.

Live school fleet GPS

Real-time bus tracking for administrators and parents, with boarding logs.

Automated fee billing & SMS

Mobile money fee collection with automated balance reminders.

Parent & student portals

Dedicated portals for grades, attendance alerts, and timetables.

Every subsystem above ships in every plan — no à la carte tiers.
See full pricing
Technical Deep-Dive

Architecture, module by module.

Select a pillar to see exactly what replaces the fragmented SaaS tools underneath it.

Module 01 //Edge & CMS

Global edge content mesh & dynamic schema runtime

Monolithic CMS architectures create latency bottlenecks and brittle single points of failure. The substrate distributes your entire digital surface across 300+ Anycast edge locations with sub-300ms cache invalidation and dynamic schema-to-table compilation.

Fragmented Legacy Stack

Isolated domain registrars, brittle S3 permissions, and bloated CMS instances running 40+ plugins prone to zero-day exploits.

Unified Platform Substrate

A unified edge fabric — DNSSEC Anycast routing, automated SSL, sub-second cache purges, and dynamic schema-to-table compilation.

Global edge nodes
300+
Anycast mesh POPs
PULSE cache purge
<300ms
global invalidation
Uptime guarantee
99.99%
multi-zone SLA
Schema engine
Real-time
JSON → typed Postgres
Native Execution Trace
01
Visual edit / API push

Content modified via dashboard or CLI schema update.

02
Schema commit

Relational record validated and committed to Postgres cluster.

03
PULSE broadcast

Eviction signal purges 300+ Anycast edge caches in <300ms.

Subsystem Capability Breakdown

Domain control plane & DNSSEC

Instant availability, automated DNSSEC rollover, registrar sync.

Manage TLDs with visual zone editing, transfer locks, and automated apex-to-subdomain routing with zero-touch SSL issuance.

DNSSEC cryptographyAuto SSL provisioningBulk zone operationsTransfer lock sentry

Dynamic schema headless CMS

Visual block composition with automated TypeScript DTO compilation.

Visual diff histories, scheduling pipelines, and one-click staging-to-production promotion without migration boilerplate.

Visual diff inspectionMulti-version historyScheduled releasesAuto DTO compilation

Media vault & transcoding engine

Pre-signed direct upload ingress with automated asset optimization.

Upload high-resolution media to isolated buckets. Pipelines generate next-gen WebP/AVIF images and adaptive video automatically.

AVIF/WebP compressionVideo transcode pipelinePre-signed upload URLsBring-your-own bucket

PULSE low-latency sync protocol

Sub-second global cache invalidation for real-time applications.

When data mutates in primary Postgres clusters, PULSE broadcasts eviction signals across every edge cache in under 300ms.

300ms cache evictionStorage sync engineZero edge stale timeStateless headers
edge propagation mesh
300+ pops active
$ npx @nexushub/client deploy
zone propagated — 300+ locations, <300ms
tls 1.3 auto-ssl, dnssec locked
Stack.Manifestv70.0

The Infrastructure Ledger

Every engine, protocol, and API running in production — from sub-millisecond Rust ingestion to sovereign local payment rails. Nothing decorative, nothing theoretical.

Live in production
70/ 9 domains
App Router
Next.js
Edge Web App Platform
React 19
React
Component-Driven UI Layer
Strict Mode
TypeScript
Type-Safe Application Layer
Null-Safety
Dart
Flutter Client Language
Microservices
NestJS
Modular Backend Suite
Sub-ms Ingest
Rust
Sentry Core Engine
Python 3.12
FastAPI
Async AI/ML Microservices
Python
Data Intelligence & NLP
iOS & Android
Flutter
Cross-Platform Mobile
Observables
RxJS
Reactive Event Streams & SSE
SQL
PostgreSQL
Primary ACID Ledger
Prisma ORM
Type-Safe Data Layer
NoSQL
MongoDB
Telemetry Timeseries
XADD/XREAD
Redis Streams
Distributed Event Queues
Redis Adapter
Socket.io
Real-Time WebSocket Pub/Sub
Redis Queue
BullMQ
Async Worker Orchestrator
Tag Cache
Cloudflare D1
Distributed Edge SQLite
27-char
KSUID
K-Sortable Unique IDs
Global CDN
Cloudflare
300+ Edge POPs & SaaS SSL
Cloudflare R2
Zero-Egress Object Vault
Private Vault
MinIO
Sovereign S3 Vault
Cloudinary
BYOS Asset Management
Docker
Multi-Stage Containers
Edge Runtime
OpenNext
Next.js → Cloudflare Adapter
Service Worker
PWA
Installable Offline Web App
LLM Orchestrator
Aider
AI Pair Engineering
Automated
GitHub Actions
CI/CD & Libsodium Secrets
Social Sync
Meta Graph API
Facebook & Instagram Sync
LinkedIn API
B2B Content Syndication
Hot Leads
Slack API
Block Kit Threat Alerts
Type-Safe
Zod
Runtime Schema Validation
Optimistic Lock
cron-parser
Multi-Timezone Cluster Scheduler
Two-Way Chat
Meta WhatsApp
Official Cloud API
Carrier Grade
Twilio
Carrier SMS & Voice
IMAP / SMTP
Mailcow
Sovereign Dovecot/Postfix
Amazon SES/SNS
Easy DKIM & Bounce Webhooks
Transactional
Resend
High-Fidelity Email API
OAuth2 Sync
Google Workspace
Gmail API & Pub/Sub
M365
Microsoft Graph
Outlook & M365 Inboxes
Sovereign
UnifiedPush
De-Googled VAPID Alerts
VAPID
Web Push
RFC 8292 VAPID Browser Alerts
Multi-Tenant
ImapFlow
Streaming Master-User IMAP Sync
simpleParser
mailparser
MIME / RFC 822 Email Parser
Tanzania & EA
M-Pesa API
Direct Mobile Settlement
M-Pesa / Tigo / Airtel
Selcom Pay
Local Aggregation Gateway
Flutterwave
Pan-African Card Gateway
Stripe
Global Card Infrastructure
TRA Approved
TRA VFD
E-Fiscalization Compliance
Biometric
WebAuthn
FIDO2 Hardware Passkeys
Geo-Velocity
MaxMind GeoIP2
Impossible Travel Defense
.co.tz / .com
reseller.co.tz
ccTLD & gTLD Registrar
Tanzania Gov
NECTA Engine
National Index Parser
otplib
TOTP 2FA
RFC 6238 One-Time Passwords
Multi-Tenant
JWT
JWT Rotation
Refresh Token Reuse Detection
At-Rest
AES-256-CBC
Zero-Trust PII Encryption
Cell-Rate
Governor Rate-Limiter
Token-Bucket DDoS Shield
CSP/HSTS
Helmet
HTTP Security Headers
360° Export
GDPR DSAR Engine
Art. 15 Data-Subject Export
Deep-Link
Domain Connect
Auto DNS Provider Detection
Crawler ID
Woothee / UA-Parser
Bot & Device Classification
Transcoder
FFmpeg
EBU R128 & H.264 FastStart
A4 Compiler
Puppeteer
Headless Chromium PDF
Zero-Cache
Sharp
WebP / AVIF Optimizer
SEO Matrix
Search Console
Automated Keyword Telemetry
Link Preview
Cheerio
HTML Parser & SEO Crawler
WebGL
Canvas GPU
Hardware-Accelerated Rendering
Z-Score
Linfa & Ndarray
Rust Statistical ML Engine
Rust
DashMap
Lock-Free Concurrent Cache
nestjs-pino
Pino
Async Structured JSON Logger
Tokio
Tracing (Rust)
Distributed Async Context Tracing
< 5ms
P95 Telemetry Latency
300+
Global Edge POPs
100%
Data Sovereignty
Zero-Trust
FIDO2 Passkeys Ready

Ready to Unify Your Digital Operations?

Eliminate vendor fatigue. Join hundreds of schools, NGOs, agencies, and high-growth retailers powered by GN-APEX.