← Back to overview
Design + Build Full-stack Architecture EU-hosted
In testing · staging live · production next

Rebuilding a compliance platform from the ground up

The first version of Nitra Academy I built on low-code (Zoho Creator), the right call to get a working system live fast, and it has run in production for years. But Nitra outgrew it: new features were slow to build, and multi-tenant security was hard to enforce on someone else's terms. So I made the architecture call to leave low-code, and I'm rebuilding the platform from scratch as an EU-hosted, multi-tenant web app, data model, backend, security, infrastructure, and the migration, one person. It's deployed to a staging environment and in testing now; production and the data migration are next.

13
Modules rebuilt to parity
EU
Data residency, by design
1
Person: design → deploy

Why leave low-code

Low-code was the right tool for version one, and I'll defend that choice, it got Nitra a real, working system in weeks, not a year, on a budget that ruled out enterprise software. But at their scale two limits became structural. New functionality was slow and awkward to build inside the platform's model. And the thing that matters most for a multi-tenant compliance platform, strict, enforceable data isolation between client companies, depended on what the platform offered, not on what I could guarantee. Owning the stack fixes both.

The architecture

I chose a stack around three constraints: EU sovereignty of personal data, low maintenance, and something I can keep evolving myself. It's a single TypeScript codebase, no separate API server, on a Postgres database where the tenant isolation is enforced in the database:

The biggest security win over the low-code original: data isolation is now enforced by Postgres itself, explicit and testable, not scattered across form rules I couldn't fully control.

What I built

The MVP is deliberately scoped to parity, do exactly what the current platform does, then extend. That's companies and multi-company user roles, a course catalog, session planning with map geocoding, individual and bulk enrolment, attendance and scoring with automatic pass/fail, certificates in four types with automatic generation and public verification, compliance reminders, audit logging, role-specific dashboards, and a global command-palette search, all behind role-based access enforced by RLS. The design side isn't separate from the build: it runs on a Nitra design-token system and a shared component library I designed and coded in the same repo.

The migration

Replacing a system that's live and holds people's certifications isn't a big-bang switch, it's a plan. I mapped the existing data model out of the live app, wrote a repeatable import that transforms and validates it (record counts, unique VAT and email checks, recomputed certificate expiry, Belgian date handling), and laid out a phased cutover: build to parity, migrate data into staging, run a short parallel period with the old system read-only as a safety net, then switch DNS and freeze the old platform, with a rollback and a fresh backup held for months. Down to the user communication: what each audience is told, and when.

Why it matters for how I work

This is the clearest proof of what “design and build” means at full depth. One person made the call to leave low-code, designed the data model and the interface, wrote the backend and the row-level security, set up the infrastructure and the pipelines, and planned the migration and the cutover. When the same brain owns the whole chain, the decisions stay coherent from the schema to the screen.

Nitra Academy 2.0 is in active development for Nitra, via Valderas. It's currently in testing on a staging environment; production deployment, data migration from the old platform, and moving users across are the next steps.