System Design

Multi-Region Active-Active

Design the multi-region active-active architecture for a global app like Shopify.

Functional requirements

• Users anywhere in the world sign in, view their account, browse the catalog, and place and track orders, served from a region near them.
• Every region accepts both reads and writes for the users it serves; no region is a read-only replica.
• When a region becomes unavailable, its users are moved to another region automatically and keep using the app, including placing orders, without signing in again or losing their account.
• A user's writes in one region become visible in every other region within a bounded, published lag (e.g., under 5 seconds).
• Operations that must happen exactly once globally, such as charging a card or decrementing shared stock, stay correct even when two regions receive competing requests for the same order.

Non-functional requirements

• p99 latency under 200ms end to end for reads and same-region writes from every continent; no common-case request waits on a cross-region round trip.
• Availability over consistency for a user's own data: profile, cart, and browsing state may be stale in a remote region for a few seconds, but an acknowledged write must never vanish after a failover.
• Strong consistency for money and stock: an order is charged and stock decremented exactly once globally; rejecting or delaying such an operation beats doing it twice.
• Durability: an acknowledged write survives the permanent loss of the region that accepted it, with an RPO of at most 5 seconds for user data and zero for completed payments.
• Regional failover completes within 5 minutes without operator action; data for users in some jurisdictions must stay resident in a designated region.

Scaling & constraints

• 50 million daily active users: 40% in North America, 35% in Europe, 25% in Asia-Pacific, served from 3 regions with a 4th planned.
• Peak of 300,000 requests per second globally at a 10:1 read:write ratio; peak is 2.5x the daily average and regional peaks are offset by about 8 hours.
• Inter-region round trips: 70ms US to Europe, 150ms US to Asia-Pacific, 180ms Europe to Asia-Pacific; cross-region transfer costs about $0.02 per GB.
• About 50 KB of data per user (profile, addresses, preferences, cart) across 200 million user records, ~10 TB total; orders are ~2 KB each at 20 million per day.
• A full region outage happens about once a year and lasts 1-4 hours; a degraded region (packet loss, 5-10x latency) happens monthly; failover drills run quarterly.
• About 3% of users are mid-session (active cart or checkout) when a failover hits; 5% of users travel and are served from a region other than their home in any month.

Out of scope

• Payment processor integration; assume a charge API that accepts an idempotency key.
• CDN and static asset delivery.
• Fraud, abuse, and account security.
• Analytics, reporting, and data warehousing.