Technical Architecture · Prepared for Google for Startups review

Proposed production architecture on Google Cloud

ReeferVision is an AI-first monitoring and automation platform for marine reef systems — beginning with serious reef keepers and designed to expand into commercial coral aquaculture. This page describes the proposed production platform that Google Cloud credits would help us build and validate. It is separate from the lightweight public website and pilot-interest form that support validation today. Where something is roadmap rather than running, we say so.

status: pre-launch · founder reef-tank pilot underway · edge and data foundation in development · updated July 2026

System overview

Architecture at a glance

Three zones: an edge hub at each aquarium, a Google Cloud pipeline for ingestion, storage, and ML, and client apps for the people who own the tanks. Telemetry flows up over authenticated HTTPS; graded alerts and bounded, signed automation commands flow back down. Safety-critical actions remain on the hub so flood protection works without connectivity.

EDGE · PER TANK GOOGLE CLOUD CLIENTS Probes & sensors pH · temp · level · flow · leak Camera module frames every 15 min ReeferVision Hub 72 h buffer · HTTPS/TLS local safety + command verifier Actuators return pump · doser · ATO Cloud Run authenticated HTTPS API Pub/Sub event backbone Cloud Storage frames · datasets BigQuery history + BQML forecasts Vertex AI vision training batch / online inference Cloud Run alert grader · command API Cloud KMS command signing key Firestore app state FCM push alerts Mobile app Firebase Auth · dashboards Web dashboard Firebase Hosting telemetry + frames signed command polling

Beta transport: hub → authenticated HTTPS → Cloud Run → Pub/Sub. Cloud Run is not an MQTT broker. If the fleet later requires persistent bidirectional MQTT, a separate broker tier on GKE, Compute Engine, or a managed MQTT provider will be introduced without changing the downstream event pipeline.

Service mapping

Google Cloud services and what each one does

ServiceRole in ReeferVisionWhy this service
Cloud RunHTTPS ingestion, alert grading, and command APIs. Stateless containers validate device signatures and schemas, publish accepted events, orchestrate inference, and expose command polling.Request-based autoscaling suits a small beta fleet. The beta transport is HTTPS; raw MQTT would require a separate broker tier.
Pub/SubDurable event backbone. Shared topics for telemetry, frames, model results, and commands fan one event out to independent consumers.At-least-once delivery keeps pipeline stages decoupled. Events carry immutable IDs for deduplication; optional ordering uses the tank ID as the ordering key.
BigQueryHistorical telemetry warehouse. Readings are partitioned by observation time and clustered by organisation, tank, and sensor. BigQuery ML builds per-tank baselines and short-horizon forecasts.SQL-first analysis lets a small team validate useful statistical models before moving only workloads that need custom ML into Vertex AI.
Cloud StorageFrame archive and training datasets. Short-lived, object-specific signed URLs let hubs upload camera frames without receiving broad bucket credentials.Lifecycle rules control retention and cost; object events can queue new frames for inference and annotation.
Vertex AICoral-vision training and inference. Transfer learning on consented, annotated beta frames; model registration, evaluation, batch scoring, and online endpoints where latency justifies them.Managed training and serving reduce MLOps overhead. Evaluation is separated by tank and time window to prevent neighbouring frames inflating accuracy.
FirestoreCanonical live app state. Latest readings, active alerts, maintenance state, and command acknowledgements sync to authorised clients in real time.Firestore serves current product state; BigQuery remains the system for complete high-frequency history.
Firebase AuthHuman identity. Owner, technician, and facility-operator sign-in, with tokens used by the API and Firestore Security Rules.User authentication is kept separate from hub identity so people and hardware have different privileges and revocation paths.
FCMUser notification channel. Sends a compact graded-alert notification containing an alert ID to iOS, Android, and web clients.FCM prompts the app to fetch the canonical Firestore alert; it is never the safety-control or automation-command channel.
Firebase HostingWeb dashboard delivery. CDN-backed hosting for the future authenticated dashboard's static assets.Keeps client delivery simple while Cloud Run remains responsible for trusted backend logic.
Secret ManagerServer-side secrets. Third-party API keys, webhook credentials, and other secrets used by trusted cloud workloads.Hub private keys stay on the device, preferably in secure hardware; they are not distributed from Secret Manager.
IAMLeast-privilege cloud access. A separate service identity and narrowly scoped role for each pipeline stage.A compromised service should not gain broad access to telemetry, users, models, storage, or signing operations.
Cloud KMSCommand signing. Protects the asymmetric cloud signing key used for bounded automation commands.The hub verifies the signature, expiry, command ID, and local safety envelope before acting; the private cloud key is not exposed to application code.
Monitoring / LoggingOperational evidence. Structured logs, metrics, uptime checks, SLOs, and alerts for hub silence, ingestion latency, backlog, model failures, and unacknowledged commands.A monitoring product must detect when its own data path is unhealthy, while excluding device secrets and unnecessary personal data from logs.

Data flow

Life of a reading

  1. Capture. The hub polls probes on a 10-second cycle and the camera every 15 minutes. Every event receives an observation timestamp, sequence number, and immutable event ID before entering a durable 72 h ring buffer.
  2. Authenticate and ship. Batched telemetry goes to Cloud Run over TLS with a per-device signature. The API validates device status, timestamp, sequence, replay protection, and schema. Frames use short-lived signed Cloud Storage upload URLs.
  3. Fan out safely. Accepted events publish to shared Pub/Sub topics. Independent, idempotent consumers write history to BigQuery, update Firestore live state, and queue frames for inference; a duplicate event ID cannot create duplicate state.
  4. Infer. BigQuery ML forecasts resampled numeric parameters and exposes prediction intervals. Vertex AI batch or online inference scores frames against the tank's photographic baseline; the serving mode is selected by latency and cost.
  5. Decide. A Cloud Run grading service combines readings, forecast confidence, image scores, equipment state, and recent interventions into watch / warn / act alerts with a trend chart, frame, and probable cause.
  6. Persist, then notify. The canonical alert is written to Firestore first. FCM sends the phone a compact alert ID; the app then retrieves the current alert and evidence from Firestore.
  7. Command and acknowledge. For an allowed act-grade event, the hub polls for a KMS-signed command carrying an ID, expiry, and permitted action. It verifies the command, applies local limits, acts, and sends an acknowledgement. MQTT can replace polling later without changing downstream services.
  8. Fail safely. Flood, ATO, pump, and dosing rules run locally. The buffer protects against connectivity outages up to its 72 h capacity, subject to hub health; cloud inference improves detection but is never the single point of protection.
Design constraint · edge safety Anything that can flood a floor or kill livestock must not depend on connectivity. Pump stop, ATO lockout, dose limits, watchdogs, and safe default states execute on the hub. A cloud command is a bounded request, not unconditional actuator access: the hub independently checks its signature, age, allowed range, and current local state. We treat the cloud as the brain, not the brake pedal.

ML approach

Honest model roadmap

We are pre-launch. The roadmap below is staged so the product is useful from day one with statistics, and the AI deepens as the beta fleet generates training data — every annotated frame and labelled incident from beta tanks feeds the next model iteration.

Phase 1 · now

Statistical baselines

Per-tank baselines and drift detection in BigQuery ML: resampled pH and temperature cycles, dosing rhythms, evaporation curves, prediction intervals, and sensor cross-validation. No deep learning is required to deliver the first useful warnings.

Phase 2 · beta

Coral vision model

Transfer learning on a vision backbone, fine-tuned with consented, annotated frames from beta tanks: polyp extension, colour shift, and tissue recession against each colony's history. Validation holds out whole tanks and time windows; success is measured by precision, recall, calibration, and false alerts per tank-week.

Phase 3 · fleet

Fleet anomaly signatures

Opt-in, anonymised cross-tank learning: equipment failure signatures (heater oscillation, pump wear), bad-batch detection for consumables, and richer priors for every new tank's cold start.

Credit utilisation Program credits would go primarily to Vertex AI training and evaluation for Phase 2, Cloud Storage for the longitudinal image dataset, BigQuery and BigQuery ML for fleet telemetry and forecasts, and Cloud Run / Pub/Sub for beta ingestion and alerting. Credits let founder capital go into calibrated sensors and camera modules for participants while the data and model platform is validated on Google Cloud.
8,640telemetry batches per tank per day at one batch every 10 seconds
96camera frames per tank per day at one frame every 15 minutes
864k + 9,600daily telemetry batches and frames at a 100-tank planning envelope

These are workload units, not a claim that 100 tanks are already deployed. The application cost model will combine the beta ramp with measured event size, average frame size, retention, training frequency, and chosen Vertex AI serving mode.

Beyond the hobby

Where this scales

The same pipeline monitors a 200 L living-room reef and a 40-raceway coral aquaculture facility — the difference is fleet size, not architecture. Commercial coral farming, public aquaria, and reef-restoration nurseries all run the same loop: water chemistry, livestock health, equipment, intervention. Shared Pub/Sub topics carry organisation and tank identifiers; BigQuery partitions history by observation time and clusters it by organisation, tank, and sensor. A facility is therefore many authorised tanks under one organisation, without creating a topic or table for every tank or re-platforming the core pipeline.