Technical Stack — What We're Built On

Full Transparency

Every component. Every vendor. Every layer.

This page documents every piece of technology running AI Screening Tools. No black boxes. IT evaluators, technical buyers, and deployment partners can read exactly what is used and why it was chosen. If your IT department needs to evaluate the stack before a procurement decision — this is the right page. The full ai agent architecture — from voice call to retrieval augmented generation document search to n8n ai agent workflow automation — is documented here layer by layer.

11
Docker containers
6
product areas
1,536
embedding dimensions
30
languages supported
4,190
jobs indexed live
22
MCP tools available

Voice AI Stack

Three vendors. One seamless call.

Every inbound and outbound call Maya handles runs through this three-part pipeline. Retell AI manages the call session. Deepgram transcribes the caller in real time. GPT-4o-mini generates the response. Azure Cognitive Services speaks it back. The full call latency from voice input to spoken response is under two seconds.


AI Models

Three models. Each doing one job it's best at.

No single AI model handles everything. GPT-4o-mini runs conversation and classification. claude-sonnet-4-6 runs candidate CV screening. Voyage AI embeds documents and queries for semantic search. Each is selected for the specific task it performs best — costs and capabilities differ substantially across these three roles.

Conversation + Classification
OpenAI GPT-4o-mini
Powers every Maya text response on WhatsApp, Viber, LINE, website chat, and the decision layer of voice calls. Also runs LLM-based job category classification at ingestion and at search time across 125 subcategories in 13 countries. Chosen for speed and cost at volume. Does not make hiring decisions — that is claude-sonnet-4-6's role.
Semantic Embedding
Voyage AI voyage-large-2
1,536-dimensional embeddings. Every document chunk, job listing, and policy clause is vectorised once at ingestion. The same model embeds every user query at search time — vector space consistency across the entire corpus is guaranteed. One-time cost at ingestion only. No per-query embedding cost after the corpus is loaded. State of the art for semantic retrieval accuracy in enterprise document search.

Data Layer

Three databases. Each purpose-built for its role.

Vector similarity search, graph-structured category knowledge, and session memory are three fundamentally different data problems. Using the right tool for each produces a measurably better result than forcing all three into one system.

Session Cache + Memory
Redis 7
Self-hosted, in-memory
LINE conversation memory — full session history, 30-minute inactivity TTL, max 20 messages (10 exchanges). Rebuilt on every incoming message from the session start. Also caches Neo4j graph query results to eliminate repeated traversal on common category lookups. Cache hits return in microseconds. Package: redis>=5.0.0 in requirements.txt.

Backend API

FastAPI Python 3.11+ — modular router architecture.

All business logic runs through a single FastAPI application. Two Maya instances run simultaneously: one for JobFreelanceThai and one for aiscreeningtools.com.

API Framework
FastAPI + Python 3.11+
8 routers handling admin, graph database, scheduling, analytics, screening, AIVA routines, email ingestion, and core API functions (registration, jobs, chat, profile, Maya AI, health, LINE, Brevo). Settings managed via pydantic-settings.
Job Ingestion Scheduling
APScheduler 3.10+
4 active pipelines: Jooble daily 04:00 UTC (13 countries, 2,363 jobs), Careerjet daily 03:00 UTC, JobsDB email/IMAP daily auto (1,827 jobs), prune at 02:30 UTC (30-day minimum age before deletion), chat purge 02:00 UTC. JFT container only runs scheduling — aiscreeningtools.com container does not run duplicate ingestion. Endpoints: /api/ingestion/status and /api/ingestion/trigger for manual trigger.
Rate Limiting
slowapi 0.1.9+
Applied to 13+ endpoints — 3 to 20 requests/minute per IP depending on endpoint sensitivity. Real IP via cf-connecting-ip Cloudflare header, not X-Forwarded-For (which can be spoofed). Admin endpoints additionally require JWT verify_user_token with admin role check.
Email + Notifications
Brevo Transactional API
All registration welcome emails, AIVA screening result delivery, newsletter welcome emails, and admin alerts. Sent via BackgroundTasks at the FastAPI layer — zero latency impact on the API response. Template-based HTML emails, not hardcoded strings.
Workflow Automation
n8n (self-hosted)
Used as logistics layer only: daily email triage, partner billing reminders, weekly AIVA funnel report, activation verification, daily job count health check. NOT used for AI screening or decision-making — that runs directly through FastAPI + AI models.
Social + Messaging API
LINE Messaging API
Webhook endpoint with HMAC-SHA256 signature verification. Pipeline: Message → conversation history → embedding → semantic search → GPT response → LINE Reply → save to memory. 5,000 char per reply limit.

Infrastructure

11 Docker containers. Traefik auto-SSL. One server.

Everything runs on a single Hostinger KVM 4 server in Malaysia. Traffic path: Internet → Cloudflare → Traefik → Docker container. Traefik handles SSL termination automatically via Cloudflare DNS challenge — no manual certificate rotation.

Reverse Proxy + SSL
Traefik v2.11
Auto-SSL via Cloudflare DNS challenge. Domain routing: jobfreelancethai.com → JFT frontend · aiscreeningtools.com → hub frontend · maya.jobfreelancethai.com → JFT Maya API · api.jobasean.com → hub Maya API. jobasean.com → 301 → aiscreeningtools.com (permanent redirect, handled by Traefik redirectregex middleware).
DNS + CDN + DDoS
Cloudflare
DNS for all domains. DDoS mitigation. Bot traffic filtering. Cloudflare Turnstile on all 4 registration forms. Cloudflare Redirect Rule: jobft.co → 301 → jobfreelancethai.com (no server change required). Real visitor IP passed via cf-connecting-ip header to the FastAPI rate limiter.

Media + CDN

Video, images, and documents — never served from the main server.

Video Hosting
Bunny CDN
Hosts all candidate video profiles and product demo videos. Embedded on pages via Bunny Stream iframe. CDN delivery — video traffic never hits the main server. Candidate 3-minute video profile upload triggers the Bunny CDN ingest API. Screening demo videos are stored here and referenced by video ID in page HTML.
Image Hosting
ibb.co (ImgBB)
All logo and product images served from ibb.co CDN by absolute URL. No images are served from the main server application.
Document Ingestion
Jina AI Reader + IMAP
JobsDB email ingestion: Gmail IMAP daily auto-fetch. Job description pages fetched via Jina AI reader API (supports 3 JobsDB page formats). URL normalisation applied: /job/ → /th/job/. Fetch_saved_job_description() handles Format A (standard nav), Format B (clean-start), and Format C (Thai employer pages). SightEngine scans all profile photos before storage.

Security

Six protection layers — all deployed since March 2026.

Bot Protection
Cloudflare Turnstile
All 4 registration forms require Turnstile verification before submission. External form submissions always require Turnstile.
Authentication
JWT — verify_user_token()
All protected endpoints use token verification. Admin endpoints require a separate admin token stored in the browser (separate from user JWT, separate login surface). JWT issued at login, validated on every protected API call. The service key is server-side only — never in the browser.
CORS
Locked to 6 origins
FastAPI CORS middleware operates on an explicit allowlist of approved origins only. All other origins receive a CORS rejection — no wildcard, no open CORS. Cross-origin job detail requests use URL query param passing rather than credential sharing.
Input Sanitization
sanitize_text() + DOMPurify v3
All user-supplied text fields pass through sanitize_text() server-side — strips HTML tags, normalises whitespace, truncates to field limits. Rich text fields (job descriptions via Quill.js v2) are sanitized client-side with DOMPurify v3 (CDN) before submission. Prevents XSS and HTML injection on both input and output display paths.
HTTP Security Headers
6 Maya + 5 nginx
Maya API middleware: X-Content-Type-Options · X-Frame-Options DENY · X-XSS-Protection · Referrer-Policy · Permissions-Policy · Strict-Transport-Security. nginx adds: Content-Security-Policy · X-Content-Type-Options · X-Frame-Options · HSTS · Referrer-Policy. nginx bot-blocker active on common attack paths.
Photo Scanning
SightEngine API
All candidate-uploaded profile photos are scanned before storage. Flags nudity, violence, and NSFW content. Runs server-side — candidates never see the scan result. Photos rejected by SightEngine are discarded with a generic upload error shown to the user. Verified badge on candidate profiles requires photo upload — SightEngine is the gate before the badge is issued.

This page documents the AI Screening Tools technical stack for IT evaluators, technical buyers, and deployment partners. Voice AI runs on three vendors: Retell AI for call infrastructure (SIP termination, Caller Choice transfer logic, inbound and outbound call session management), Deepgram for real-time speech-to-text (native models for Filipino, Thai, and Vietnamese — not accent-adapted English), and Azure Cognitive Services for text-to-speech (140+ languages, fil-PH and th-TH neural voices with natural prosody). AI models are task-separated: GPT-4o-mini handles Maya conversation and LLM-based job category classification across 125 subcategories; claude-sonnet-4-6 runs all CV screening — 0–100 score, HIRE/INTERVIEW/HOLD/REJECT decision, 5 assessment dimensions; Voyage AI voyage-large-2 produces 1,536-dimensional embeddings for semantic document retrieval at sub-50ms query time — one-time ingestion cost only, no per-query fee after the corpus is loaded.

The data layer uses three purpose-built databases: Supabase PostgreSQL 16 with pgvector for vector similarity search, Neo4j for graph-structured category knowledge covering 125 subcategories across 13 countries, and Redis for session memory and caching. The FastAPI Python 3.11+ backend runs a modular router architecture across two Maya container instances — one for JobFreelanceThai, one for aiscreeningtools.com. The MCP server at api.jobasean.com/mcp exposes 22 ai agent tools including screen_candidate, batch_screen, social_profile_scan, and set_social_keywords — listed on Smithery. Security layers: Cloudflare Turnstile on all registration forms, JWT authentication on all protected endpoints, strict CORS allowlist, server-side and client-side input sanitization, HTTP security headers across both API and nginx layers, and SightEngine API for video and photo moderation before any content reaches the employer inbox.

The full ai agent architecture runs on a Hostinger KVM server in Malaysia — traffic path: Internet → Cloudflare → Traefik v2.11 auto-SSL → 11 Docker containers. Bunny CDN hosts all candidate 3-minute video profiles; ibb.co CDN serves all product images. n8n handles ai agent workflow automation for operations: daily job ingestion pipelines, partner billing reminders, and weekly AIVA funnel reports. Deployment partners configure all ai agent tools through Claude conversations — no coding required, every technical step is handled via natural language. This ai agent platform serves any organisation that hires, manages knowledge, or communicates with customers — Philippine BPO operators across BGC, Makati, Cebu, Clark, Davao, and Iloilo; Indian ITES and BPO companies in Bangalore, Hyderabad, Chennai, and Pune; finance BPO, healthcare BPO, legal process outsourcing, and knowledge process outsourcing operations across Southeast Asia and South Asia.

The full stack is running live, right now.

Test semantic search on 4,190 real jobs at jobfreelancethai.com, screen a candidate free on any call center role, or ask Maya a technical question about the architecture.

See Live Search Demo → Try AIVA Free