A SaaS with compliance built in
Fleet and workshop management for private owners and professionals: work orders with configurable workflows, multi-member workspaces, warehouse, equipment and a GDPR-aware document vault. Built solo from written specification; deployment phase in progress.
The challenge
A data-heavy product holding people's vehicles, documents and business records — where GDPR, file safety and per-resource permissions can't be bolted on later. The contract demanded specification-level fidelity and verifiable quality.
Architecture — the upload pipeline
Fail-closed by design: files never transit the backend, and nothing is downloadable until proven clean.
What made it work
- GDPR as endpoints, not paperwork: data export, deletion requests, consent management and processing restriction as first-class APIs; retention crons, audit logging with sensitive-key scrubbing, legal hold.
- Layered authorization: RBAC roles plus per-resource ABAC sharing, workspace multi-tenancy, public share tokens.
- Search done properly: PostgreSQL full-text with weighted generated columns and trigram matching for plates and VINs — measured p95 of 12–20 ms.
- Quality that gates: ~2,900 tests, E2E against a real database in CI, accessibility and design-token contrast checks that fail the build on regression.
Outcome
Functionally complete through its third contractual milestone with coverage far above the agreed target (93–95% vs 70%); the deployment milestone is in progress on a serverless container + managed SQL target.