flowchart TB subgraph APP["Application Network — sees only student_key"] direction LR GW["Gateway"]:::app PR["Stream Processor"]:::app CH["Analytics Store (ClickHouse)"]:::app NE["Graph Store (Neo4j)"]:::app GW --> PR --> CH PR --> NE end subgraph VNET["🔒 vault-net — no published host port"] direction LR ID["Identity Service"]:::vault VDB["Vault Database"]:::vault ID --- VDB end PR -->|"resolves salted key only, never the raw mapping"| ID classDef app fill:#2a9d8f,stroke:#1f7a6f,color:#fff,font-size:13px classDef vault fill:#e9a23b,stroke:#b8791f,color:#222,font-size:13px linkStyle default stroke:#999,stroke-width:2px