Architecture

Control the voice, the compute, and the path your content takes.

Auritus is a local-first, AWS-backed narration pipeline. It gives a publisher one embed while leaving deployment and model decisions with the team that operates it.

High-level flow

From a readable page to private playback.

Your page carries one script tag. Auritus reads the page text, audio is rendered on demand and returned as private audio behind a short-lived link, and a reader listens to it on the same page.

AWS deployment

A cloud fallback that does not replace local control.

The job API records work behind a DynamoDB conditional claim. A local worker can claim and synthesize first. If the job remains pending, Step Functions hands it to an AWS Batch GPU worker. The first valid claim wins.

Audio objects are private by default. The API returns a short-lived delivery URL after the requesting site key is checked. Origin registration and enforcement are planned work and are not represented here as current controls.

The page asks for audio. A single conditional claim means only one worker ever wins it. Your own GPU claims it first; AWS Batch renders it only if no claim arrives before the timeout. Either path produces private audio, returned to the page as a short-lived link.

Operator identity

Choose the login experience your team needs.

The product standardizes operator access through Cognito while making the status of each upstream identity choice explicit. Whichever option you pick, the worker ends up holding a one-hour token that renews itself and cannot call AWS APIs — never an IAM access key. The security page walks through all three options and the token lifecycle in detail.

Identity options diagram showing native Cognito users as the current path, Google as configuration-required, and IAM Identity Center as a future SAML option.

Supported (built-in)

Native Cognito users

Simple, native user pool credentials managed directly within your AWS account with no external IdP required.

Supported (SSO)

Google Workspace

Federated OIDC sign-in via Google Cloud OAuth. Supported across both web console and CLI browser authentication.

Supported (SAML 2.0 / SSO)

AWS IAM Identity Center

Enterprise SAML 2.0 federation connecting directly to AWS SSO (IAM Identity Center), Okta, Entra ID, or Ping.

Secure-by-design workstream

What is true today, and what is still being designed.

The current implementation has private audio, short-lived delivery, job-claim coordination, and cloud spend limits. Runtime origin enforcement and production-grade JWT validation are not complete. The broader threat model and control evidence are also unfinished. We will publish controls with their implementation and review evidence, rather than treating a diagram as proof.

Read the security model