A multi-facility senior-care operator ran its concierge team — resident and family concerns, admissions, discharges, daily tasks — on a low-code proof of concept. The thinking was right and the workflow was right. What it could not do was carry a real resident's record, because it had no users, no permissions, no audit trail, and nothing standing between one facility's data and another's.
A proof of concept is allowed to skip everything that makes software safe to run a business on. That is what makes it fast, and it is exactly the gap between a convincing demo and a tool a regulated operation can actually adopt.
The proof of concept had already done the hard thinking — the screens, the data, the way a concierge actually works a call. The specification was written in two halves for that reason: reproduce the workflow the team already knows, faithfully, and then add everything a demo is allowed to skip. Staff who had used the prototype needed no retraining.
Resident data is protected health information, and that was a decision on day one rather than a hardening pass at the end. It is why facility isolation lives in a global query scope instead of in controllers, why credentials mask themselves unless deliberately revealed, and why the automatic logoff is three coordinated layers rather than a session timeout.
An externally-facing facility portal with hard per-facility isolation and shared ticket threads, a rebuilt reporting suite with server-rendered charts and scheduled delivery, and full-screen wallboards for facility lobbies — carrying aggregate figures only, never a resident's name.
One navy edge, a quiet field of data, and red only when someone is waiting.
The design system is one document with one idea in it. Brand colour at full strength on the sidebar and nowhere else; red reserved exclusively for outstanding work, which is what makes red mean something at four o'clock on a busy shift. A second saturated surface was tried and pulled back for competing with the data. The stated anti-reference is the wall-of-grey clinical system everyone in care already dreads.
Not in a policy document. In the places where a developer, on a deadline, would otherwise have to remember — which is the only version of compliance that survives contact with a busy month.
Facility isolation is a single global scope applied to every facility-owned record, and it can only ever narrow a query — never widen one. Internal staff see across the portfolio; a facility user sees exactly their facilities; a facility user linked to nothing matches nothing, rather than everything. Because it only narrows, it is safe to leave on by default, and a job that genuinely needs to cross facilities opts out in the open.
Facility credentials are encrypted at rest and hydrated into an object that redacts itself when printed, logged or serialized to JSON. There is no way to leak one into a response or a log line by accident — reading it takes an explicit, permission-gated, audited call. The safe path is the default path, so security doesn't depend on everyone remembering.
HIPAA requires termination on inactivity but names no duration. Three layers: a rolling idle timeout, an absolute session cap, and a countdown warning about a minute out. The subtle part is that the browser heartbeats while idle so a graceful sign-out — with an explanation and a validated return link — beats the server session simply expiring underneath you.
Scheduled reports render in a background worker where no browser exists, so a chart drawn by the client could never reach them. The same server-computed series is drawn as SVG on the server and embedded as an image, because the PDF engine drops inline SVG but rasterises SVG images — a constraint that in turn keeps the charts to plain shapes. A small chain of constraints, followed honestly.
Lobby screens run on their own revocable, rotatable read-only links, exempt from the idle and absolute timeouts that govern everyone else — which is safe precisely because the surface shows aggregate, de-identified figures and no PHI at all. The security model let a real product requirement through instead of blocking it.
The first decision was one cloud, one compliance agreement. The second moved the database to a provider with self-serve compliance and branching. The third reversed that, on analysis: the compliance tier made the costs a wash, while the split meant two clouds, two agreements and a database outside the network boundary — and branching is a developer convenience, not client value. Both decisions are still in the repository; the reversal wasn't quietly deleted.
Handing an operator a system that holds their residents' information is not a moment for optimism. Two sweeps ran against a full working dataset before launch — one asking what is broken, one asking what was promised and never built.
48 findings, verified against a seeded working set of 33 facilities and several thousand tickets rather than by reading code. External facility accounts were appearing in internal staff pickers — which would eventually have routed a resident's name to an account outside the organisation. A report's own default date range took 456 seconds and six gigabytes to produce a PDF; after a row cap, 21 seconds and a tenth of the memory.
Eight were fixed the same night — and five of those eight were regressions introduced hours earlier. That is the argument for auditing before launch rather than trusting the last green test run.
Two were rejected as wrong. One proposed fix would have broken a bug fix the client had asked for while securing nothing, because the same payload was already broadcast publicly by design — the real defect was a misleading comment. Three others were fixed more broadly than written, once the same bug turned up in code paths the sweep had missed. Two were deferred deliberately, with the reason recorded in the code.
An audit is only worth something if you are willing to argue with it. A list of findings accepted wholesale is a list nobody read closely.
This is prototype to production work in healthcare software, and the posture behind it is the same one that carries a team through a compliance review.
Send us what you've built and what it has to hold — regulated data, real users, other people's information. We will tell you what has to change before it can carry that, what can stay exactly as it is, and what the rebuild costs.