Case studies

Software engineering case studies, measured in uptime, latency and load.

Selected work in healthcare, security, HRTech, retail and AI: the problem, what we changed and the measurable result.

Security · ID protection

White-label identity protection platform, built from zero and GDPR / ISO 27001 compliant.

We built a white-label product that monitors the dark web and public registries for exposed personal data (emails, passports, cards, driver licenses, ID and phone numbers) for both consumers and businesses. It covers monitoring, alerts, a user account, a partner API and an admin console, on a microservice architecture. Data is encrypted and never stored in plain text, with isolated access to it.

  • GDPR
  • ISO 27001
  • Microservices
  • White-label
  • Encryption
Ask about this case →
7M
personal data items monitored for ~1M users
Security · Zero-trust & certification

Live production platform moved to zero-trust with no downtime, and ISO 27001 certified.

To meet security compliance and pass ISO 27001 certification, we migrated an existing identity protection platform to a zero-trust model: verification on every request, least-privilege access, network segmentation, service isolation and protected administrator access. The move was gradual and without stopping the system. The audit raised findings, we fixed them, and the client passed the audit and certification.

  • Zero-trust
  • ISO 27001
  • Audit logging
  • Zero downtime
Ask about this case →
ISO 27001
audit and certification passed
Security · Identity & access

Sign-in and access control that holds up across products: SSO, OIDC, MFA and roles.

Built on many projects, for end users, client staff and partners, mostly from scratch and sometimes replacing an older scheme in a live system: SSO, OAuth / OIDC, MFA, role management, session handling and alternative sign-in methods on shared services, with access separated between partners and clients in multi-tenant products. The hard parts are consistent: migrating users without losing their access, edge cases in the role model, and session security.

  • SSO
  • OAuth / OIDC
  • MFA
  • RBAC
  • Multi-tenant
Ask about this case →
Security · Data protection

Sensitive data and secrets: encryption, erasure and a secure CI/CD pipeline.

On several projects with millions of records we encrypted, masked and anonymized sensitive data in production, implemented the right to erasure and retention policies, and kept sensitive data out of analytics, logs and copies. We also set up secure secret storage, injection at build and deploy time, and automated rotation of passwords, tokens and certificates. The hard parts: finding every place data lives, searching and filtering encrypted data, and finding secrets already leaked into logs and git history.

  • Encryption
  • Masking
  • Right to erasure
  • Secrets rotation
  • CI/CD
Ask about this case →
Security · Abuse protection

Keeping bots, credential guessing and API abuse out of public platforms.

On many projects we protected public sites, registration flows and partner APIs against bots, mass registrations, password guessing and API abuse, using rate limiting, bot detection and a mix of our own rules and managed edge protection from cloud and CDN vendors. The result was less fraud, lower load on the systems and no irrelevant bot data in them.

  • Rate limiting
  • Bot detection
  • WAF
  • Credential stuffing
Ask about this case →

Facing a similar problem? Let's talk specifics.

Book a Technical Consultation →