# Suloro Cloud — Full Machine Specification & Architecture

## Organization Overview
- **Product Name**: Suloro Cloud
- **Company Name**: Suloro
- **Website**: https://cloud.suloro.com
- **Console**: https://console.cloud.suloro.com
- **Support**: support@suloro.com

## Architecture & Subsystems

### 1. Suloro Identity API & SSO
- Service endpoint: `identity.suloroapis.com`
- Stateless token assertion and cryptographic verification
- Token verification: Cryptographically signed RS256 / Ed25519 tokens with public key discovery
- Zero-config OAuth 2.0 federation with verified identity claims (sub, email, name, picture)
- No cross-site tracking cookies; privacy-preserving session architecture

### 2. Pricing & Marginal Billing Structure
- **Free Monthly Quota**: 0 to 50,000 Monthly Active Users (MAU) is 100% free forever with no base subscription fee.
- **Marginal Band 1**: 50,001 to 100,000 MAU at $0.0055 per MAU.
- **Marginal Band 2**: 100,001 to 1,000,000 MAU at $0.0046 per MAU.
- **Marginal Band 3**: 1,000,001 to 10,000,000 MAU at $0.0032 per MAU.
- **Marginal Band 4**: Above 10,000,000 MAU at $0.0025 per MAU.
- **Billing Mechanics**: Invoiced and collected automatically in arrears at the end of each calendar month. Supports global currencies with daily exchange rate lock.

### 3. Project Isolation & Hierarchy
- Permanent 12-digit project numbers (e.g., 783921049281)
- Lowercase permanent project identifiers
- 30-day recovery window for soft-deleted projects
- Unique project IDs remain permanently reserved after purge

### 4. Domain & App Store Governance
- Web: DNS TXT records (`suloro-site-verification=...`), HTML verification file (`/suloro-verification.html`), or root `<meta name="suloro-site-verification" content="...">`.
- Android & Native: SHA-256 certificate fingerprints bound to package names across Play Store, Indus Appstore, Apple App Store, Samsung Galaxy Store, and Amazon Appstore.

### 5. International Compliance & Privacy Standards
- **Jurisdictions**: Unrestricted access across 195+ countries; zero country block policy.
- **Regulations**: Fully aligned with India Digital Personal Data Protection Act 2023 (DPDP), European Union GDPR, UK Data Protection Act, and California CCPA/CPRA.
- **Contractual Age**: Adult-only platform contract (18+ years required for console access).
- **Data Rights**: User-accessible data export, personal details correction, and permanent account/project purge.