Genuine multi-tenancy
A single installation serves several institutions, each with its own database schema and its own object store. One institution’s data never shares a table with another’s.
A records management system built to last another twenty years
Orpyca is the modern reimplementation of Orfeo, the records management system born in 2002 at the Colombian Superintendency of Public Utilities, which has been running in institutions across Latin America for two decades.
The archival logic was kept: registered records, case files, retention schedules, routing workflows. Everything else changed. Where there was a PHP monolith on a shared database, there are now eleven independent services, per-institution isolation, an audit trail nobody can alter, and an artificial intelligence layer that respects information classification.
An audit trail that cannot be altered
Every audit entry chains the hash of the previous one, and the database engine rejects any update or delete through triggers. It is not a procedural promise: it is a system constraint.
The registration number is the identity
The unique consecutive number is assigned atomically and never changes. It survives export and import between different systems.
Clearance-based access control
Beyond roles, each user holds a clearance level and each document a security level. Nobody reads above their level or writes downwards, and when in doubt the system denies.
11 independent services
| Service | Port | Responsibility |
|---|---|---|
| API gateway | 8080 | Single entry point: validates the token, rate-limits traffic and aggregates the interface documentation. |
| Authentication and security | 8001 | Federated identity, database-resolved roles, the user–role–unit relationship, clearances, immutable audit and custody of personal signing material. |
| Institutions and organisation | 8002 | Institutions, unit tree, catalogues, parameters, working-day calendar and the Institutional Archives Plan. |
| Documents | 8003 | Inbound, outbound and internal registration; metadata, drafts, annulment, quick replies, petitions, email ingestion, postal mail and package export and import. |
| Archive | 8004 | Case files, classification scheme and retention schedule, electronic index, transfers and the physical archive with its inventory. |
| Storage | 8005 | Object store with checksums, versioning and preservation: archival packages, preservation metadata, write-lock and long-term format validation. |
| Workflow | 8006 | Routing, rules engine, append-only history, returns and sequential approvals. |
| Notifications | 8007 | Email, deadline alerts and signed outbound webhooks to third-party systems. |
| Electronic signature | 8008 | Native and advanced signature in XAdES formats, with time stamping and certificate status validation. |
| Agents and assistant | 8009 | Exposes the system as tools for artificial intelligence agents and hosts the conversational assistant. |
| Knowledge | 8011 | Semantic search over the documentary holdings with permission pre-filtering and answers that cite their source. |
What it is built with
- Services
- Python with FastAPI, async end to end
- Database
- PostgreSQL 15 with pgvector, one schema per institution
- Queries
- Direct SQL, no object-relational mapping layer
- Interface
- SvelteKit, with the token always server-side and never reachable from the browser
- Files
- S3-compatible object store with write-lock
- Events
- Redis Streams, with consumer groups and a dead-letter queue
- Identity
- Keycloak with OpenID Connect
- Deployment
- Docker Compose or Kubernetes
What Orpyca does not do
No system does everything. These are the most frequently asked-about absences, stated before you find them yourself.
No text recognition in images
If you digitise a document, the system stores the image, verifies its integrity and validates the format, but does not extract the text. Content search works on what exists as text, not on what was scanned. If you need that, it has to be handled before uploading the file.
No mobile app
The interface adapts to a phone screen and works from the browser, but there is no native iOS or Android application, and none is being built.
No antivirus on upload
The system restricts which file types are accepted and checks that a PDF really is a PDF, but does not scan files for malicious code. If your institution receives attachments from the public, that belongs at the perimeter.
The interface is Spanish only
The technical documentation is bilingual, but the application is not: every screen is in Spanish. There is no language switcher.
No simultaneous document editing
The text editor is one user at a time. Two people cannot draft the same letter at once the way they would in a shared cloud document.
Corporate identity needs configuration
The identity server shipped with the system can be connected to the institution’s directory, but that federation is neither configured nor tested out of the box: it is installation work.
Documents are not deleted, by design
The law does not allow deleting a registered official communication. What exists is two-step annulment, with a stated reason and a supervisor’s approval, preserving the number and the trail. If you expected a delete button, there is none and there will not be.