The infrastructure layer
powering Terret Nexus
at enterprise scale

When Nexus deploys a playbook to 542 reps across 3,140 active deals, that's a fan-out of thousands of per-deal state machines that need to run reliably, update CRM records, queue Slack messages, and fire pre-call briefs on a precise schedule. This is exactly what Workers + Durable Objects were built for.

• Durable Objects — one per active deal. Holds the current state of that deal's Nexus playbook, which rep actions are outstanding, and the next brief delivery time. Strongly consistent, co-located with the edge, zero external database calls for hot-path state.
• Cloudflare Workflows — durable, retryable execution for the multi-step pipeline: ingest call → transcribe → analyze with LLM → extract patterns → update playbook → queue brief. If any step fails, Workflows retries from that step — no dropped calls, no lost analysis.
• Workers — the edge compute that powers the Nexus API, handles CRM webhook ingestion from Salesforce/HubSpot, and serves real-time brief requests with sub-50ms response times.

Terret's Revenue Graph is built on data — call recordings, transcripts, CRM snapshots, voice-of-customer quotes, and playbook artifacts. At 312K+ calls per quarter, the raw audio and transcript storage alone is multi-terabyte. Every time that data feeds back into an LLM pipeline, S3 egress charges compound.

• R2 — $0 egress for call recordings, transcripts, and generated PDF assets (playbooks, briefs). When the LLM pipeline reads a call transcript to analyze it, that read is free. S3 at this volume generates meaningful egress bills that disappear entirely on R2.
• D1 — serverless SQLite for the structured revenue graph: deals, rep performance metrics, pattern indexes, playbook state. Globally replicated, query directly from Workers with zero connection overhead — no RDS to manage, no VPC to configure.

Terret's CTO (Amit) published research on Role-Based Access Control policy analysis and anomaly detection — he has a deep personal background in security. The platform holds confidential deal intelligence for Carta, Grafana Labs, and Cloudflare itself. The CRO at Carta explicitly called out infosec in his testimonial: "we put Terret through the paces on the infosec front, and they passed with flying colors."

• Cloudflare Access — Zero Trust access to Terret's internal tooling, staging environments, and admin interfaces. No VPN required for the engineering team; every access request is authenticated and logged. Device posture checks ensure only managed machines can reach sensitive internal services.
• Cloudflare Tunnel — secure outbound-only connections from Terret's infrastructure to Cloudflare's network. No inbound firewall rules to manage, no exposed public IPs on database or internal service hosts.
• WAF + Bot Management — protection for app.boostup.ai's API surface against scraping, credential stuffing, and application-layer attacks. Especially relevant for the Nexus Q&A interface which is publicly reachable and processes revenue queries that could be probed.

For lower-stakes inference tasks — call transcript classification, entity extraction (extracting competitor names, objection categories, deal stage signals from transcripts), and embedding generation for semantic search across the Revenue Graph — Workers AI offers serverless GPU inference with pay-per-token pricing and no cold starts.

• Embedding generation — convert call transcripts and deal notes into vector embeddings for semantic search across the Revenue Graph. Run Whisper for STT directly in Workers AI, eliminating a third-party transcription vendor.
• Classification at scale — tag objection types, competitor mentions, and deal signals across 312K+ calls using smaller open-source models (Llama 3.1 8B) at a fraction of GPT-4o cost — routed through AI Gateway for full observability.
• Vectorize — Cloudflare's vector database for semantic search across Terret's call and deal archive. Powers the "find calls where reps mentioned pricing in minute 1" type queries that Nexus runs at analysis time.

Terret's attack surface is meaningful: app.boostup.ai is a public-facing SaaS app that processes enterprise deal intelligence, and the Nexus Q&A interface accepts natural language queries against live customer revenue data. The REST API ingests CRM webhooks from Salesforce, HubSpot, and other revenue tooling — all of which are high-value targets for credential stuffing, scrapers, and application-layer abuse.

Cloudflare's application security stack sits in front of all of this at the network edge — before traffic ever reaches Terret's origin — with no performance penalty to legitimate users.

Terret's platform has a hard real-time delivery requirement: pre-call briefs reach 500+ reps 30 minutes before each meeting. That delivery window is simultaneously the highest-traffic moment (everyone opens their brief at the same time) and the highest-stakes moment (a slow or failed delivery directly impacts a rep's call prep). The CDN layer is the infrastructure that makes this SLA survivable under load.

Cloudflare's CDN runs across 330+ cities on an anycast network — meaning a rep in London, Chicago, and Singapore all hit a local PoP, not a single US-east origin. Response times for cached brief assets drop from 300–600ms (cross-continental origin) to under 30ms (local PoP).