Write your system in Mermaid, drag the boxes into the arrangement that actually explains it, and keep both in one file. Nothing is uploaded — the diagram never leaves your browser.
Auto-layout stops helping somewhere around ten boxes. Move one node and the engine rearranges the
rest, destroying the visual hierarchy you built on purpose. Here, dragging a box pins it. The pinned
coordinates are written into the same .mmd file as %% comments, which every
Mermaid renderer ignores — so the file still renders natively on GitHub, and your positions survive
the next time anyone opens it.
Delete the comment block and you are left with an ordinary Mermaid file. Nothing is trapped in a proprietary format.
Pick components from a palette of twenty primitives — services, workers, datastores, caches, queues, gateways, load balancers, auth providers — and the tool records what each box is, not just how it looks. Group them into trust zones to mark what is public and what is not.
From there it can check the design: a datastore with no replica, one database shared by several services, a queue nobody reads, a hop that every route depends on, a service exposed with no gateway in front of it, persistent state sitting in a public zone. Every check runs locally and explains itself.
No account, no upload, no API key. The parser, the layout engine, the checks and the renderer all run in your browser as WebAssembly. Your architecture is often the most sensitive document your team has — it should not need a vendor security review to draw it.