Architecture Overview

A high-level look at how Xiru works under the hood.

Platform Components

┌──────────────────────────────────────┐
│         Xiru Frontend                 │
│         (shiru.io)                    │
│         Next.js 16 (App Router)       │
│                                      │
│  ┌──────────┐  ┌──────────┐         │
│  │  Public   │  │  Admin   │         │
│  │  Routes   │  │  Routes  │         │
│  └──────────┘  └──────────┘         │
└──────────────┬───────────────────────┘
               │
       ┌───────▼──────────┐     ┌─────────────────┐
       │   Xiru API       │────▶│   Database       │
       │   (REST)         │     │   PostgreSQL     │
       └───────┬──────────┘     └─────────────────┘
               │
       ┌───────▼──────────┐     ┌─────────────────┐
       │  Blockchain RPCs  │     │  Sumsub (KYC)   │
       │  (6 EVM chains)   │     │  Verification   │
       └──────────────────┘     └─────────────────┘

The admin panel is part of the same Next.js application — it uses a separate route group (/admin) protected by role-based access control.

Authentication

Email Flow

Email + Password → API verifies → 6-digit PIN sent → User enters PIN (30-min expiry) → JWT issued

Wallet Flow (SIWE)

Connect Wallet → Request nonce → Sign message (free) → API verifies signature → JWT issued

Both methods produce a JWT stored in localStorage that authenticates all subsequent requests. Tokens refresh automatically in the background.

Security

Measure	Detail
HTTPS	All communication encrypted in transit
JWT tokens	Auto-expire, cleared on logout or 401
SIWE	Industry-standard wallet auth (EIP-4361)
Input validation	Frontend and backend validation on all inputs
No key access	Xiru never has access to your wallet’s private keys
Role-based access	Admin features restricted to authorized users
Token refresh	Proactive (30s before expiry) + reactive (on 401)

Supported Chains

Chain	Chain ID	Type
Ethereum	1	L1 Mainnet
Arbitrum	42161	L2 Optimistic Rollup
Polygon	137	Sidechain
Optimism	10	L2 Optimistic Rollup
Base	8453	L2 Optimistic Rollup
BNB Chain	56	L1

Data Privacy

• User data encrypted at rest in PostgreSQL
• KYC documents handled per regulatory requirements
• Wallet addresses are public blockchain data — not private
• Account deletion removes all stored personal data
• No tracking cookies beyond essential session management