01 Overview 02 Deployment 03 Data 04 Security 05 Compliance 06 AI Accountability 07 Requirements 08 Continuity 09 Integrations 10 Implementation ▸ For IT Officers 11 FAQ 12 Contact
Public Document — Share Freely v1.1  ·  2026-04-25  ·  novagov.tech/tech-brief.html

NovaGovAI
Technical Architecture & Compliance Brief

This document gives government IT officers, COA representatives, NPC compliance teams, and procurement staff a complete technical picture of NovaGovAI: how it is deployed, how data is handled, what security controls are in place, how AI accountability works, and what happens if the vendor relationship ends. It is designed to answer the questions that cause govtech adoptions to stall.

Government IT Officers COA Representatives NPC Compliance Teams DICT Infrastructure Staff BAC / Procurement Officers LGU Planning Offices
This document is currently under technical review by government procurement offices in the Philippines. Questions from other reviewing teams are incorporated into the FAQ as they arise.
01 — Overview

What NovaGovAI Is

NovaGovAI is a web-based AI decision support platform for Philippine local government units. It is licensed software — not a cloud subscription where your data is stored on someone else's servers. The platform runs on the LGU's own infrastructure or government-certified cloud. Zentarai Labs provides the software license, setup, and support. Your data stays under your control.

Technology Stack
Frontend: Standard HTML/CSS/JS — runs in any modern browser, no software installation on end-user devices
Backend API: Python (FastAPI) — deployed on LGU or DICT GovCloud infrastructure
Database: PostgreSQL — hosted within the LGU's own controlled environment
Key Facts
Access: Browser-based — Chrome, Firefox, Edge, Safari (desktop and mobile)
Client install: None required on any staff device
Offline mode: Cached data accessible without internet (see Section 08)
Languages: English, Filipino, Cebuano
02 — Deployment Architecture

Three Deployment Options

Choose the model that fits your LGU's infrastructure and compliance requirements. In all three options, the LGU retains full ownership of its data and can migrate between options at any time.

🖥️
LGU Self-Hosted
Installed on your own LGU server or government data center. Your IT team controls the full stack. Air-gap deployment available for environments without internet access.
  • Managed byLGU IT department
  • Data locationLGU premises
  • InternetOptional (for map tiles)
  • COA postureFull LGU ownership
  • Setup time3–5 business days
🔧
Zentarai Managed
Hosted and maintained on Philippine-based servers by Zentarai Labs. Ideal for LGUs without dedicated IT staff. Full data portability guaranteed — migrate to self-hosted at any time.
  • Managed byZentarai Labs
  • Data locationPH-based servers
  • InternetRequired
  • COA postureRequires DPA with COA
  • Setup time2–3 business days
Data portability guarantee: All three options support full data export in open formats (PostgreSQL dump, CSV, JSON) at any time. No proprietary formats. No lock-in. Your data is yours — unconditionally.
03 — Data Architecture

What Data Flows Where

NovaGovAI handles two types of data: public government feeds (read-only, no PII) and LGU operational data (stored only in the LGU's own deployment). In self-hosted and DICT GovCloud deployments, Zentarai Labs has zero access to LGU operational data.

External Data Feeds — Public Sources, Read-Only, No PII
PHIVOLCS Seismic Feed
Real-time earthquake data overlaid on LGU hazard map. Public API.
Read-only
PAGASA Weather API
Typhoon tracks, rainfall, storm signal levels. Public API.
Read-only
NDRRMC Disaster Feed
National disaster alerts and response status. Public API.
Read-only
MGB Geohazard Maps
Landslide and flood susceptibility data. Public dataset.
Read-only
DILG / SGLG Data
LGU governance performance metrics. Aggregated public data.
Read-only
DHSUD / CLUP Registry
Land use compliance status and zoning data. Public registry.
Read-only
LGU Operational Data — Stays Inside Your Deployment
Citizen Reports & Requests
Stored in the LGU's PostgreSQL database. Not transmitted to Zentarai Labs.
LGU-only
Staff Accounts & Access Logs
Stored locally. Role-based access control. Full audit log exportable.
LGU-only
Budget & AIP Simulation Data
LGU budget inputs remain within the LGU database. No external transmission.
LGU-only
CLUP Documents & Zoning Files
Uploaded and processed within the LGU instance. Not shared externally.
LGU-only
Zentarai Labs Never Accesses (Self-Hosted / DICT GovCloud)
  • Citizen personal information (name, address, contact details)
  • Staff login credentials or authentication tokens
  • LGU budget figures or Annual Investment Plan data
  • Internal CLUP documents or zoning maps
  • Citizen report content or attachments
  • Any record stored in the LGU's database instance
For Zentarai Managed deployments, a Data Processing Agreement (DPA) is signed before setup. The DPA defines the exact and limited scope of Zentarai's system access (maintenance and monitoring only) and is available to COA upon request.
04 — Security & Data Protection

Security Controls

The following controls are implemented on all NovaGovAI deployments. For self-hosted deployments, server-level controls are the responsibility of the LGU IT team; Zentarai provides configuration guidance and documentation.

🔒
Encryption in Transit
HTTPS/TLS 1.3 enforced on all connections. HTTP is automatically redirected to HTTPS. No data travels over unencrypted connections.
🗄️
Encryption at Rest
Database files are encrypted using OS-level disk encryption on managed deployments. Self-hosted LGUs are provided configuration instructions for enabling PostgreSQL encryption.
👤
Role-Based Access Control
Each staff member has a unique account with defined permissions. Roles include: Mayor/LCE, Planning Officer, LDRRMO, Front Desk, and Read-Only. Sessions expire after 30 minutes of inactivity.
🛡️
Content Security Policy
Strict CSP headers block unauthorized script execution and cross-site injection (XSS) attacks. All allowed external sources are explicitly allowlisted. No inline script injection is possible.
🚫
No Advertising or Tracking
No third-party advertising networks, no analytics beacons, no social media tracking pixels on any LGU-facing application pages. Staff activity is not shared with any third party.
🔍
Vulnerability Disclosure
Security issues can be reported to landon@zentarailabs.com. All security reports receive a response within 24 hours and remediation within 72 hours for critical issues.
⚠️ AI Query Transparency — Required Disclosure
The NovaGovAI AI Query Console sends query text to a third-party language model for processing. This is standard practice for AI-powered applications and is disclosed here in full.

Which AI model: NovaGovAI uses Anthropic Claude (claude-sonnet-4-6) for AI Query processing. Anthropic is a US-based AI safety company. Their data handling policies are publicly available at anthropic.com/privacy.

What is sent to Anthropic Claude: The text of the question entered by the official, plus relevant context from public data sources (e.g., current PHIVOLCS readings, LGU SGLG score, CLUP status). This context comes from the same public government feeds listed in Section 03.

What is never sent to Anthropic Claude: Citizen names, addresses, contact information, report content, staff identities, budget figures, or any record from the LGU database. The model processes only the question + public data context.

For strict data isolation requirements: AI Query features can be fully disabled during onboarding at the LGU's request. All other platform functionality — hazard maps, CLUP tracking, citizen reporting, SGLG dashboard, budget simulation — operates with no connection to Anthropic or any third party and remains fully available.
05 — Legal & Regulatory Compliance

Compliance Posture

NovaGovAI is designed around Philippine legal and regulatory frameworks from the ground up — not adapted from a foreign platform afterward.

Framework How NovaGovAI Addresses It Status
RA 10173
Data Privacy Act
LGU data stored within LGU-controlled environment. PII processed only within authorized LGU systems. Data subjects retain all rights. DPA executed for Managed deployments. NPC-compliant data handling by design. Compliant
RA 12254
CLUP Mandate
Platform built specifically for RA 12254 compliance workflows. DHSUD checklist integrated. Generates RA 12254-ready gap reports for submission. AI drafts required sections; planning officer reviews and finalizes. Aligned
RA 10121
DRRM Law
Real-time integration with PHIVOLCS, PAGASA, NDRRMC, and MGB supports all DRRM planning mandates. Hazard overlay maps support LGU LDRRMO functions and contingency planning requirements. Aligned
RA 11032
EODB Act
Citizen reporting and service tracking module supports EODB and ARTA reporting. SLA tracking and resolution data is exportable for ARTA submissions. Automated escalation enforces response time standards. Aligned
DILG SGLG
Governance Standards
SGLG dashboard tracks all seven assessment areas. Real-time scoring updated as LGU data changes. AI coaching on gaps before the national assessment period. Aligned
COA Audit
Commission on Audit
All AI queries, outputs, and decisions are timestamped and cited to source. Full audit log exportable in PDF and CSV on demand. No AI output is applied without a human approval step. System architecture documentation available to COA on request. Audit-Ready
DICT GovCloud
Gov't Cloud Policy
DICT GovCloud deployment is available and recommended. LGU retains full ownership of the GovCloud instance. Zentarai provides the software license only — not the cloud infrastructure. Supported
RA 9184
Gov't Procurement
Founding Partner Program (Year 1 free) does not require BAC process — no government funds are expended. Year 2 license agreements are structured to fit within standard procurement thresholds. See FAQ Section 11. Addressed
DICT Accreditation: NovaGovAI is not yet formally DICT-accredited as a software product. It is designed to DICT technical standards and is deployable on DICT GovCloud. Formal DICT software accreditation is on the 2026 roadmap. Founding Partners on DICT GovCloud are covered by DICT's own infrastructure accreditation.
06 — AI & Human Accountability

Who Is Responsible When AI Is Involved

This is the most important section for COA reviewers and government officials. NovaGovAI is a decision support tool. It never makes binding official decisions. The accountability framework is designed to be clear, auditable, and legally defensible.

1
🤖
AI Surfaces Data
NovaGovAI analyzes public data feeds, compliance records, and platform data. It generates recommendations, flags risks, and answers questions.
AI action
2
👤
Official Reviews
A qualified government official reviews every AI output. The system requires explicit acknowledgment before any recommendation can be acted upon.
Human required
3
✍️
Official Decides & Signs
The official approves, modifies, or rejects the recommendation. The official's identity, decision, and timestamp are recorded. The official's signature is on the order — not the algorithm's.
Official accountable
07 — System Requirements

Infrastructure Specifications

Specifications for self-hosted or DICT GovCloud deployments. Requirements scale with concurrent users and citizen report volume. Zentarai handles the full installation — LGU IT provides server access only.

ComponentMinimumRecommended
CPU2 vCPU4 vCPU
RAM4 GB8 GB
Storage50 GB SSD100 GB SSD
Operating SystemUbuntu 22.04 LTS or RHEL 8+ (Linux required for backend API)
DatabasePostgreSQL 14 or higher
RuntimePython 3.10 or higher
Network bandwidth10 Mbps25 Mbps (for external data feeds)
Concurrent usersUp to 20Up to 50 (on recommended spec)
End-user browserChrome 110+, Firefox 110+, Edge 110+, Safari 16+. No plugins required.
End-user deviceAny device with a modern browser — desktop, laptop, tablet, or smartphone. No installation required.
Ports required80 (HTTP, redirects to HTTPS), 443 (HTTPS), 5432 (PostgreSQL — internal network only, never exposed publicly)
LGU IT team time required: Zentarai Labs handles the full installation and configuration during onboarding. LGU IT staff only need to provision the server and provide SSH access. Estimated LGU IT involvement for initial deployment: 2–4 hours total.
08 — Reliability & Business Continuity

What Happens If Things Go Wrong

This section addresses the questions government IT departments are most concerned about but least likely to ask directly: vendor failure, internet outages, and data loss. We answer them directly.

Scenario: Zentarai Labs closes
Your platform keeps running.
For self-hosted and DICT GovCloud deployments, Zentarai's operational status has no effect on your running instance. Your database and application are on your servers. Founding Partners also receive application source code in escrow for continued independent operation.
Scenario: Internet goes down during a typhoon
Recently loaded data stays accessible.
Map tiles and alert feed data cached in the browser remain visible without internet. For full offline resilience during disaster events, the self-hosted option on a local LAN allows staff inside the LGU building to access the full platform with no internet dependency.
Scenario: Server crashes, data is lost
Daily backups retained for 30 days.
Managed deployments: automated daily database backups stored separately, retained 30 days. Weekly backups retained 6 months. Recovery time objective (RTO): 4 hours. Recovery point objective (RPO): 24 hours. Self-hosted: Zentarai provides backup configuration as part of setup.
Uptime & SLA Commitments

Zentarai Managed deployments: 99% uptime target, measured monthly. Scheduled maintenance notified 48 hours in advance and performed outside business hours (10PM–6AM). Unplanned downtime response within 4 hours.

DICT GovCloud and Self-Hosted: Uptime is determined by DICT/LGU infrastructure. Zentarai provides application monitoring tools and responds to application-level issues within 4 hours during business days.

For Managed deployments ending: Full database export in open formats (PostgreSQL dump, CSV, JSON) delivered within 14 days of any service termination. No fees for data retrieval. No proprietary formats.

09 — External Data Integrations

Government Data Connections

All external connections pull from public Philippine government sources. These are outbound, read-only connections. NovaGovAI does not write to, modify, or share data with any external agency system.

AgencyData TypeConnectionPII
PHIVOLCSSeismic events, volcano bulletinsPublic RSS/JSON feedNone
PAGASAWeather advisories, typhoon tracks, rainfallPublic APINone
NDRRMCDisaster alerts, situation reportsPublic feedNone
MGBGeohazard maps, landslide susceptibilityPublic GIS datasetNone
DILG / SGLGLGU governance scores, assessment resultsPublic registryNone
DHSUDCLUP compliance status, zoning guidelinesPublic registryNone
OSM / NAMRIABase maps, roads, administrative boundariesPublic tile serversNone
Existing LGU systems: NovaGovAI complements existing systems (eNGAS, HRMIS, local accounting software) — it does not replace them. Data from existing systems can be imported via CSV. Custom API integrations with specific LGU software are available as a configuration option. Discuss requirements during the technical kickoff call.
10 — Implementation Process

From Agreement to Live in 30 Days

Zentarai Labs handles all technical configuration. LGU staff involvement is limited to onboarding and training sessions. The implementation timeline below applies to all Founding Partner LGUs.

On Software Bugs

Like all software, NovaGovAI has bugs. We do not claim otherwise. When your team finds an issue: report it to landon@zentarailabs.com with a description of what happened. Critical bugs (platform inaccessible, data not saving) are acknowledged within 4 hours and patched within 24 hours. Non-critical issues are logged, prioritized, and resolved in the next update cycle. You will receive confirmation when the fix is deployed. Founding Partners receive direct access to the engineering team's issue tracker so you can see the status of reported bugs in real time — no chasing for updates.

For the IT Officer

We Know What This Decision Costs You

This section is not for the institution. It is for the individual reading this document — the IT officer who will have to recommend, defend, and be accountable for what happens next.

Your Position, Honestly Considered

We understand that recommending a new platform creates personal accountability for the IT officer who approved it. If something goes wrong, you are the person answering for it — not the vendor, not the Mayor's office. You.

That is why we have structured this program the way we have. Full data export at any time, at no cost. No BAC-violating commitments. COA-ready audit logs from Day 1. Source code in escrow for all Founding Partners. Year 2 pricing committed in writing before Year 1 ends. If something goes wrong with NovaGovAI, the paper trail is designed to protect you — not us. Every commitment in this document exists because we took seriously that you are a person with a career, not just a procurement checkpoint.

Known Limitations — What NovaGovAI Does Not Do
NovaGovAI does not replace trained planning staff. It reduces the analytical workload and surfaces information faster. It does not replace the professional judgment, local knowledge, or legal accountability of your Municipal Planning and Development Officer.
AI recommendations are only as good as the underlying data. If your LGU's existing CLUP records are incomplete or outdated, the platform will flag this and work with what exists — but it cannot manufacture accurate data from inaccurate inputs. We proactively notify LGUs when data quality issues may affect recommendation reliability.
Real-time hazard alerts require internet connectivity. Without internet, the platform operates on cached data only. For typhoon-vulnerable LGUs, we strongly recommend the self-hosted on-LAN option to ensure full access during disaster events regardless of internet status.
NovaGovAI is not yet formally DICT-accredited. It is deployable on DICT GovCloud and built to DICT standards, but the formal software accreditation process is underway in 2026. If your LGU requires formal DICT software certification before adoption, we will advise you honestly on the timeline.
How to Present This to Your LCE — Talking Points

If your Mayor or Administrator asks for a summary, these are accurate points you can use directly in an internal memo or verbal briefing:

No budget required for Year 1. The Founding Partner Program is free for 12 months. No BAC process is needed because no government funds are expended.
Our data never leaves our servers. Under the self-hosted or DICT GovCloud deployment, LGU data stays on LGU infrastructure. Zentarai Labs cannot access it.
COA can audit everything. Every AI query, every recommendation, every official action is logged with a timestamp and user identity. The complete audit log is exportable on demand.
The AI does not make official decisions. Every AI recommendation requires a named government official to review and approve it. The official signs every action — not the algorithm.
If the vendor closes, we keep our data and the software keeps running. Source code goes into escrow for Founding Partners. Our instance runs independently regardless of Zentarai Labs' operational status.
Year 2 pricing is committed before Year 1 ends. No surprise costs after we depend on the platform. Pricing is locked in writing during the first year.
If your LCE, administrator, or legal officer has questions not covered here, contact landon@zentarailabs.com. We are available for a direct call with LGU leadership or legal counsel at any point in the review process.
11 — Frequently Asked Questions

Questions We Know You Have

These are the questions that government IT officers, COA representatives, and procurement staff ask most often — and sometimes don't ask because they expect a non-answer. We answer them directly here.

12 — Technical Contact

Questions & Technical Inquiries

For technical questions, security review requests, NPC compliance inquiries, or to schedule a call with the engineering team — contact us directly. All technical inquiries receive a response within one business day.

Technical Point of Contact
Landon Little
Founder & Lead Engineer, Zentarai Labs
landon@zentarailabs.com
For formal technical reviews or COA coordination, include
"Technical Review Request" in your subject line.