Architecture
Every request is routed to the right customer, domain, and database.
The public site, licensing services, hosted platform, and tenant data are separated so each layer can do one job well without turning WordPress into the application server.
1
WordPress site
Public campaign page, connector, license activation, protected admin doorway
License + domain
2
License API
Validates entitlement, domain limits, activations, plan, and plugin update access
Validated route
3
Hosted platform
Resolves the tenant and runs the giveaway, raffle, administration, and community application
Tenant connection
4
Customer tenant database
Stores that customer's campaigns, entries, referrals, users, chat, payments, email state, and settings
A
Administrator access
A logged-in WordPress administrator enters through a signed, short-lived gateway route that resolves the correct tenant before the console is loaded.
D
Domain isolation
The licensed public domain is matched to its tenant route, preventing one customer site from selecting another customer's database.
U
Independent updates
WordPress connector releases, hosted platform deployments, and tenant schema migrations are versioned separately.
WordPress connector
Your website stays the front door.
The TG Giveaway connector links a licensed WordPress site to Tactical Guardian without moving the campaign application into WordPress itself.
01
License and domain activation The connector validates the saved license against the website domain and reflects the assigned Lite or Pro entitlement.
02
Public campaign page It creates or repairs the configured WordPress campaign page and loads the hosted campaign experience inside that page.
03
Protected administrator gateway It creates the WordPress-only admin doorway used to request a signed tenant session for the hosted console.
04
Licensed plugin updates Pro installations receive eligible connector releases through the normal WordPress update experience.
Tenant database
Campaign data stays isolated by customer and domain.
Tactical Guardian runs the application centrally while each licensed domain connects to its own MySQL tenant database. The platform registry stores the route; the operational data stays in that tenant database.
1
Create a dedicated database
Create a blank MySQL database and a database user through the hosting provider. Existing Tactical Guardian databases can be attached without rebuilding their schema.
2
Connect it in the customer portal
Enter the host, port, database name, username, password, licensed domain, and public site URL. The portal tests the connection before saving it.
3
Initialize once, reconnect safely
A new blank database receives the tenant schema once. Reconnecting an existing tenant only re-establishes the route and does not rewrite its data.
One tenant route per licensed domain
Giveaways · Raffles · Entries · Referrals · Chat · Payments · Email · Settings
Platform console
The operating center behind every campaign.
The hosted console brings campaign creation, entries, moderation, analytics, communications, administration, and system controls into one tenant-aware workspace.
Campaign builder
Task management
Entry registry
Referral analytics
Winner workflows
Admin permissions
Audit logs
Campaign operations
Build, run, protect, and measure every campaign.
The platform supports the full operational workflow for free-entry giveaways and paid raffles, including participant activity before, during, and after the campaign.
Create campaigns, configure entry tasks, question-entry experiences, task values, timers, completion rules, and campaign-specific content.
Run paid raffle flows with tenant-level payment settings, payment confirmation, donation records, raffle entries, and winner verification.
Generate referral links, award referral entries, trace referred participants, review referral analytics, and identify inconsistent entry records.
Operate campaign chat with replies, mentions, reactions, pins, reports, moderator roles, timeouts, bans, trust scoring, and admin actions.
Review fraud logs, banned access attempts, CIDR suggestions, bot scans, inconsistent entries, deleted records, and cleanup workflows.
Manage email templates, automation, newsletters, suppression lists, send jobs, delivery logs, campaign analytics, and winner communications.
Payments
Paid raffle transactions route into the correct tenant.
Payment configuration belongs to the tenant operating the raffle. Tactical Guardian keeps provider credentials, raffle records, payment events, and campaign data tied to that tenant instead of mixing customer transactions together.
S
Stripe
Tenant-level keys and webhook settings support payment confirmation and raffle transaction processing.
P
PayPal
Tenant-level PayPal credentials and webhook configuration support the corresponding raffle payment path.
Transaction path
ParticipantStarts a paid raffle entry
↓
Payment providerProcesses the transaction
↓
Tenant routeResolves the correct campaign database
↓
Raffle recordUpdates payment and entry state
Payment webhooks are server-to-server endpoints. The platform verifies and routes the event before updating tenant raffle records.
Updates
Three release paths, each controlled independently.
Tactical Guardian separates connector releases, hosted platform deployments, and tenant database migrations so each layer can be updated and recovered without treating the entire product as one package.
WordPress connector
Versioned plugin packages are built by the Updates service and offered to eligible Pro installations through WordPress update checks.
SourceVersioned plugin package
DeliveryWordPress update flow
EntitlementPro license
Hosted application
Platform builds are validated, packaged, deployed through the Updates Command Center, and can retain a rollback target for the previous deployment.
SourceHosted platform release
DeliveryDeployment agent
RecoveryControlled rollback
Tenant schema
Schema migrations advance tenant databases separately from platform files and can record version state as changes are applied.
SourceVersioned migration
DeliveryTenant DB update path
ScopePer tenant
Security & access
✓
✓
✓
✓
✓
Tenant routing is validated before application data is opened.
Tactical Guardian uses layered checks around licensing, domains, tenant resolution, administrator access, database credentials, and platform routes.
License and domain checks
Connector requests are matched to the license and permitted domain before tenant access is granted.
Signed administrator gateway
Administrator access uses short-lived signed gateway tickets rather than exposing a raw tenant-selection URL.
Encrypted tenant credentials
Customer database credentials are stored in the platform registry in encrypted form and resolved server-side.
Tenant isolation
The platform opens the database assigned to the resolved tenant and does not fall back to another customer's route.
Operational controls
Maintenance mode, administrator permissions, audit logs, banned-user tools, fraud logs, bot scanning, and moderation controls protect ongoing campaigns.
Support
Account, licensing, tenant connection, billing, and platform support in one portal.
The Tactical Guardian customer portal is the central place to manage licenses, licensed domains, hosted tenant connections, account details, upgrades, and support requests.
Review plan status, domain allowance, WordPress activations, and the tenant attached to each licensed domain.
Connect a new tenant database, test connection details, or reconnect an existing tenant without rebuilding its schema.
Review plan access and move from Lite to Pro when additional platform entitlements are required.
Open and track support requests for platform behavior, tenant connections, billing, licensing, updates, or account access.
01 / 10