Orpyca is the modern reimplementation of Orfeo, the records management system born in 2002 at the Colombian Superintendency of Public Utilities, which has been running in institutions across Latin America for two decades.
The archival logic was kept: registered records, case files, retention schedules, routing workflows. Everything else changed. Where there was a PHP monolith on a shared database, there are now eleven independent services — plus an optional speech-transcription one —, per-institution isolation, an audit trail nobody can alter, and an artificial intelligence layer that respects information classification.
A single installation serves several institutions, each with its own database schema and its own object store. One institution’s data never shares a table with another’s. A suspended institution loses day-to-day operation, but its public portal stays readable and the preservation of its records does not stop.
Every audit entry chains the hash of the previous one, and the database engine rejects any update or delete through triggers. It is not a procedural promise: it is a system constraint.
The unique consecutive number is assigned atomically and never changes. It survives export and import between different systems.
Beyond roles, each user holds a clearance level and each document a security level. Nobody reads above their level or writes downwards, and when in doubt the system denies.
| Service | Port | Responsibility |
|---|---|---|
| API gateway | 8080 | Single entry point: validates the token, rate-limits traffic and aggregates the interface documentation. |
| Authentication and security | 8001 | Federated identity, database-resolved roles, the user–role–unit relationship, clearances, immutable audit and custody of personal signing material. |
| Institutions and organisation | 8002 | Institutions, unit tree, catalogues, parameters, working-day calendar and the Institutional Archives Plan. |
| Documents | 8003 | Inbound, outbound and internal registration; metadata, drafts, annulment, quick replies, petitions, email ingestion, postal mail and package export and import. |
| Archive | 8004 | Case files, classification scheme and retention schedule, electronic index, transfers and the physical archive with its inventory. |
| Storage | 8005 | Object store with checksums, versioning and preservation: archival packages, preservation metadata, write-lock and long-term format validation. |
| Workflow | 8006 | Routing, rules engine, append-only history, returns and sequential approvals. |
| Notifications | 8007 | Email, deadline alerts and signed outbound webhooks to third-party systems. |
| Electronic signature | 8008 | Native and advanced signature in XAdES formats, with time stamping, certificate status validation and renewal of the archive time-stamp on long-term signatures. |
| Agents and assistant | 8009 | Exposes the system as tools for artificial intelligence agents and hosts the conversational assistant, which today uses Anthropic’s Claude API and strips restricted material before sending anything. |
| Knowledge | 8011 | Semantic search over the documentary holdings with permission pre-filtering and answers that cite their source. |
| Speech transcription | 8012 | Optional and off by default: turns what is dictated to the assistant into text, inside the institution and without a graphics card. Meant for sentences, not long recordings. |
No system does everything. These are the most frequently asked-about absences, stated before you find them yourself.
If you digitise a document, the system stores the image, verifies its integrity and validates the format, but does not extract the text. Content search works on what exists as text, not on what was scanned. If you need that, it has to be handled before uploading the file.
Search by meaning, precedents and drafted answers with citations can run inside your infrastructure. The conversational assistant cannot: today it talks to Anthropic’s Claude API, so it needs a key from that provider and an internet connection, and without one it stays off. Restricted content is stripped before anything is sent.
The interface adapts to a phone screen and works from the browser, but there is no native iOS or Android application, and none is being built.
The system restricts which file types are accepted and checks that a PDF really is a PDF, but does not scan files for malicious code. If your institution receives attachments from the public, that belongs at the perimeter.
The technical documentation is bilingual, but the application is not: every screen is in Spanish. There is no language switcher.
The text editor is one user at a time. Two people cannot draft the same letter at once the way they would in a shared cloud document.
The identity server shipped with the system can be connected to the institution’s directory, but that federation is neither configured nor tested out of the box: it is installation work.
The law does not allow deleting a registered official communication. What exists is two-step annulment, with a stated reason and a supervisor’s approval, preserving the number and the trail. If you expected a delete button, there is none and there will not be.
