Home Overview Install Guide Support
Azure IP Co-sell

BulkForge
Reference Architecture

BulkForge is a hybrid Azure solution: a hosted SaaS control plane orchestrates outbound communication jobs while a customer-deployed agent in the subscriber's Azure subscription executes delivery. Delivery credentials never leave the customer tenant.

Architecture diagram

┌─────────────────────────────────────────────────────────────────────────────┐ │ Customer Azure AD (Microsoft Entra ID) │ │ Users sign in to BulkForge dashboard via Entra SSO │ └──────────────────────────────────┬──────────────────────────────────────────┘ │ OAuth / OIDC ▼ ┌─────────────────────────────────────────────────────────────────────────────┐ │ Publisher Azure subscription (AgeeBgee Solutions) │ │ ┌──────────────────────┐ ┌──────────────────────┐ ┌────────────────┐ │ │ │ Azure App Service │ │ Azure App Service │ │ Azure SQL │ │ │ │ (Next.js dashboard) │◄──►│ (Control-plane API) │◄──►│ Database │ │ │ │ bulkforge-engine-* │ │ job dispatch, audit │ │ jobs, engines, │ │ │ └──────────┬───────────┘ └──────────┬───────────┘ │ subscriptions │ │ │ │ │ └────────────────┘ │ │ │ Marketplace SaaS webhook │ HTTPS poll / report │ └─────────────┼───────────────────────────┼───────────────────────────────────┘ │ │ │ Azure Marketplace │ Agent ID + Agent Key (no secrets) │ transact / fulfill │ ▼ ▼ ┌─────────────────────────────────────────────────────────────────────────────┐ │ Customer Azure subscription │ │ ┌──────────────────────┐ ┌──────────────────────┐ ┌────────────────┐ │ │ │ Azure Key Vault │◄───│ Azure Functions │ │ Azure Storage │ │ │ │ Postmark tokens │ │ Flex Consumption │ │ deployment pkg │ │ │ │ ACS connection str │ │ Customer Agent │ │ + runtime │ │ │ │ (managed identity) │ │ .NET 10 isolated │ └────────────────┘ │ │ └──────────────────────┘ └──────────┬───────────┘ │ │ │ │ │ Deployed via Azure Marketplace │ outbound email API │ │ (BulkForge Install v3 ARM template) ▼ │ │ ┌──────────────────────┐ │ │ │ Postmark API │ │ │ │ and/or │ │ │ │ Azure Communication │ │ │ │ Services Email │ │ │ └──────────────────────┘ │ └─────────────────────────────────────────────────────────────────────────────┘ Optional integrations: Power Automate / Logic Apps → Workflow Trigger API (HTTPS + API key)

Azure services by zone

Publisher (control plane)
  • Azure App Service — dashboard UI and orchestration API
  • Azure SQL Database — jobs, engines, subscriptions, audit metadata
  • Microsoft Entra ID — customer sign-in (OAuth)
  • Azure Marketplace — SaaS billing and fulfillment
Customer tenant (execution)
  • Azure Functions — Flex Consumption agent (.NET 10)
  • Azure Key Vault — Postmark and ACS credentials
  • Azure Storage — agent deployment and runtime
  • Managed Identity — Key Vault secret access (RBAC)
Delivery & automation
  • Azure Communication Services — optional email channel
  • Postmark — optional email channel
  • Power Automate / Logic Apps — workflow trigger via REST API

Data boundaries

  • Delivery credentials (Postmark server token, ACS connection string) are stored only in the customer Key Vault.
  • Recipient lists and message bodies flow from the agent directly to Postmark or ACS — not persisted in full on the control plane.
  • The control plane stores campaign metadata, job status, per-recipient delivery outcomes, and subscription entitlements.
  • All agent ↔ control plane communication uses HTTPS with agent-scoped API keys.