A SaaS with compliance built in
Fleet and workshop management for private owners and professionals: work orders with configurable workflows, multi-member workspaces, warehouse, equipment and a GDPR-aware document vault. Built solo from a written specification, on a milestone contract.
The challenge
A data-heavy product holding people's vehicles, documents and business records, where GDPR, file safety and per-resource permissions can't be bolted on later. The contract demanded specification-level fidelity and verifiable quality.
Architecture: the upload pipeline
Fail-closed by design: files never transit the backend, and nothing is downloadable until proven clean.
What made it work
- GDPR as endpoints, not paperwork: data export, deletion requests, consent management and processing restriction as first-class APIs; retention crons, audit logging with sensitive-key scrubbing, legal hold.
- Layered authorization: RBAC roles plus per-resource ABAC sharing, workspace multi-tenancy, public share tokens.
- Search done properly: PostgreSQL full-text with weighted generated columns and trigram matching for plates and VINs: measured p95 of 12-20 ms.
- Quality that gates: ~2,900 tests, E2E against a real database in CI, accessibility and design-token contrast checks that fail the build on regression.
Outcome
Built in milestones, with coverage far above the agreed target: 93-95% against 70%. The planned infrastructure is serverless containers with managed SQL.