Planet-scale,
one small space at a time

The deployment architecture, in detail. The full design, with the numbers.

Most chat platforms are one giant shared system: one database with everyone’s rows in it, one fleet sized for the busiest second of the busiest day, one blast radius. Eleven inverts that. There is no big system, just a very large number of very small ones.

The unit: one process per space

Every space is its own operating-system process running its own copy of the server — one static ~18 MB binary with the web frontend, an embedded SQLite engine, WebSockets, and automatic TLS compiled in. Its entire state is one database file of ciphertext. A whole running space — app, database, everything — costs about 23 MB of memory.

Isolation is a process boundary the kernel enforces, not a tenant_id column. A bug in one space’s process has no path to another space’s data, because they share nothing: no tables, no caches, no message bus. And each space can run a different version of the software, which keeps deployment boring.

The glue: a thin router

In front of the instances sits a deliberately thin router: it terminates TLS (certificates issue themselves via Let’s Encrypt, including a wildcard for instant new spaces) and proxies each hostname to its instance over a local unix socket. That’s the whole job. Since message bodies are already ciphertext, the router sees exactly what the instances see: nothing readable.

No Kubernetes, no service mesh, no sidecar fleet, no observability tier burning a node pool. The "control plane" is a few small, single-purpose programs — a provisioner that creates spaces, an activator that wakes them — each of which is the same order of size as an instance.

The trick: sleep as a first-class state

Group chats are bursty — quiet most of the day, alive at dinner time. So an idle space doesn’t idle: its state streams continuously into object storage (as the ciphertext it already is), and after enough quiet its process simply exits. Zero memory, zero CPU. The space’s cost while asleep is a few megabytes of storage — a space’s entire encrypted history is typically 1–16 MB.

The first request to a sleeping space — a message, a member opening the app — wakes it: the router holds the request, the activator restores state and starts the process, and the answer arrives about a second later. A single-writer lease in object storage guarantees that exactly one live process ever owns a space’s state, so waking and sleeping are safe to race.

Deploys: versioned, boring, reversible

Instances run side-by-side versions of the binary. A new release canaries on one instance while the rest hold; then the fleet rolls one instance at a time, health-checked, with automatic rollback on failure. A swap drains in-flight requests while the router briefly holds new ones, so members see nothing. Self-hosted boxes follow the same signed release feed on the channel they choose — you can watch versions roll across the live fleet on the status page.

The arithmetic of billions

This design scales by multiplication. At any moment only ~5–20% of spaces are awake. Projected at a million spaces (~10 million members): roughly 100,000 warm processes × ~25 MB ≈ 2.5 TB of active RAM, around a thousand provisioned vCPUs, ~15 TB of parked ciphertext — a handful of racks, not a data centre. Nothing about the model changes between ten spaces and a million; there’s just more of the same small thing. The experience never degrades with scale, because your space never shares a process, a database, or a noisy neighbour with anyone.

Today’s whole production fleet — every space, the router, all the sibling services, and the AI helpers — measures about 550 MB of RAM at a load average of 0.21 on two small CPUs. We publish those numbers and keep measuring as we grow.

What it costs to run

An infrastructure that sleeps when its members do, runs compiled code in tiny processes, and can’t compute over your conversations barely draws power. The planet page does the full carbon arithmetic (~30× against a conventional stack), and The Eleven Factors is the philosophy written down.

Related: the nerdy stuff for the cryptography, and self-hosting for running all of this yourself.