Architecture overview

Questa guida non è ancora stata tradotta nella Sua lingua.

This page gives you a mental model of how LegalCloud works, from the moment you save a document in the dashboard to the moment a visitor reads it on your website.

The high-level picture

LegalCloud is composed of three parts:

┌──────────────────────────────────────────────────────────────────┐
│  Dashboard  (https://dash.legalcloud.info)                        │
│  - Where you edit documents, sites, resources, members and       │
│    API tokens, and where you read analytics.                     │
└──────────────────────────────────────────────────────────────────┘
                              │
                              │ (reads and writes through the API)
                              ▼
┌──────────────────────────────────────────────────────────────────┐
│  API  (https://api.legalcloud.info)                              │
│  - Documents, sites, resources, statistics and API tokens.       │
│  - Serves the public pages `/d/{hash}`.                          │
└──────────────────────────────────────────────────────────────────┘
                              │
                              │ (public page or REST API)
                              ▼
┌──────────────────────────────────────────────────────────────────┐
│  Your site  (WordPress, Odoo, custom app, etc.)                  │
│  - Shows the document: iframe, server-side render, or plugin.    │
└──────────────────────────────────────────────────────────────────┘

The whole platform runs on Cloudflare's global network, so documents are served from a location close to each visitor.

What happens when you save a document

You click Save in the dashboard.
The dashboard sends the document to the API (POST /api/documents or PATCH /api/documents/{id}).
The API checks your permissions and the limits of your plan, validates the data and stores the document. When the content changes, the previous version is kept in the history.
The dashboard shows the updated document.

What happens when a visitor reads a document

A visitor loads your page, which contains an iframe pointing to https://dash.legalcloud.info/d/{hash} (or your server fetches the document through the API).
LegalCloud checks that the document is published for the site that embeds it, that the visitor's country is allowed and, if required, that a valid access token was sent.
The page is rendered in the language you requested and sent to the visitor.
The visit is recorded for your analytics (country, source and site).

Data flow for plugin updates

The WordPress plugin checks for new versions from WordPress itself (the standard "update now" notice). New plugin versions are published in the Downloads area of the dashboard.

Security model

TLS on every request.
Authentication with API tokens (Authorization: Bearer), with scopes that limit what each token can do.
Rate limits and quotas per plan: responses carry X-Quota-* and X-RateLimit-* headers and the API answers 429 when a limit is exceeded.
Input validation on every write.
Access rules per document: allowed countries, token required, and assignment to specific sites.
Content security policy in the dashboard.

Next steps

Ultimo aggiornamento: 2026-10-27