Technology

Serverless Infrastructure

Second Aid runs on serverless, globally distributed infrastructure provided by AWS and Cloudflare, two of the world's largest cloud and network providers. There are no application servers to overload, and no origin server is involved in serving support.

Static-first delivery

Second Aid is an SPA: one HTML file provides access to every exercise in each of its 10+ languages. The entire application is pre-built as static assets at build time rather than rendered on request.

No servers on the support path

Using Second Aid requires no server-side compute or database queries: every asset is served from a global CDN, then runs client-side on the user's device.

Independent reporting

Anonymous usage reporting runs on a separate, auto-scaling serverless pipeline, fully decoupled from the support path.

With no servers to provision, scale or maintain, Second Aid performs the same for every user, however many are using it at once.

Architecture

Second Aid operates as two fully decoupled paths. The support path delivers the application to every user; the reporting path records anonymous, aggregate usage asynchronously and plays no part in delivering support.

The support path has no runtime dependencies beyond the CDN, so its availability and capacity are determined by the CDN alone.

Estimated Capacity

Because the support path involves no origin compute or database, Second Aid's capacity is bounded only by the CDN itself. That network serves tens of millions of HTTP requests per second worldwide, and is built to absorb traffic surges of over 100 million requests per second directed at a single website.

A first visit to Second Aid requires a single load of a small number of cached static assets; every exercise is then rendered client-side, with no further page requests. On that basis, the architecture can serve an estimated over one million new users per minute, using only a fraction of the network's capacity, while returning users load Second Aid directly from their devices.

Surge Readiness

Demand for immediate support is not constant. A national emergency, major incident or large-scale event can multiply usage almost instantly, nationally or globally. Second Aid requires no advance capacity planning, pre-warming or scaling events for such surges: with every asset already cached at the edge, a surge is served in exactly the same way as normal traffic.

Offline Operation

The support experience does not depend on a continuous connection to central systems. Second Aid is a PWA: once loaded, its service worker serves the application and exercises from the device cache, so they can continue to work even if connectivity is interrupted.

Security & Protection

All traffic passes through enterprise-grade network protection before it reaches Second Aid's systems, including:

• Network- and application-layer DDoS mitigation.
• A WAF that blocks common attack patterns.
• Automated bot management and rate limiting.
• Encryption in transit using current TLS standards.

Because the support path serves only cached static assets, no application server or database is exposed to users, keeping the attack surface to a minimum.

Anonymous by Design

Second Aid prevents user tracking at two levels. On the device, it uses zero cookies and no persistent identifiers, so a returning user cannot be recognised. In the database, no record of any individual visit, session or user exists at all.

Aggregate counters, not event logs

Each anonymous report increments a counter, such as the number of times an exercise was completed, rather than creating a new record. No database row ever represents a person, a device or a single use.

Time buckets

Counts are grouped into 10-minute intervals, recorded in both UTC and local time, so activity cannot be traced to a precise moment or sequenced into an individual's history.

Coarse location only

Location is recorded only at country and regional level, never as an address, precise position or network identifier.

Built for mass scale

Because uses are counted rather than stored, the database grows with the number of time intervals, not the number of users: one million uses in an interval occupy the same space as one. Tables are partitioned by month, keeping queries fast as the database grows over years of use.

Cached summaries

Public and organisational summaries are pre-computed on a schedule and served from the CDN, so reads never place load on the database.

Organisations receive aggregate reporting only, never individual data.

National & Global Readiness

Together, these design choices allow Second Aid to be deployed across an entire nation, or several, without additional infrastructure. A national programme can make Second Aid available to its whole population from day one, with the same performance for the first user as for the millionth.