AH Original · Case study 03

OneCompliance

Private2025 – NowEnterprise SaaS · Mobile

A multi-tenant compliance platform whose interface is generated from metadata, built on Angular and AWS serverless, with a native Flutter field app for consultants.

Private platform. Client under NDA. Web views are recreated with demo data; mobile captures come from the app’s own screenshot tests.

Role: Full-stack · web & mobile
Stack: Angular · Flutter · AWS
Year: 2025 – Now

Compliance platform web workspace showing a data table, toolbar and navigation — compliance workspace

Flutter mobile home dashboard with weekly time chart and recent entries — field app · iOS / Android

Type: Enterprise compliance SaaS
Role: Full-stack · web & mobile
Stack: Angular · Flutter · AWS
Access: Private · under NDA

01. The platform

Five regulations, one workspace.

Data protection, information security, anti-money-laundering, whistleblowing and internal audits each carry their own registers, controls, documents and deadlines. This platform holds them in a single multi-tenant workspace: consultants switch between the companies they serve, and every company sees only its own data.

02. The web application

An interfacethat is mostly configuration.

Most screens are never written by hand. Each table, form, filter and tab comes from a JSON definition the backend serves and executes, so a new compliance module arrives as configuration rather than new frontend code.

Product and client names withheld at the client’s request.

Compliance platform: Generated table, toolbar and navigation — Generated table, toolbar and navigation

03. Rebuilding the surface

A redesign that touched every generated screen.

Because hundreds of screens share the same components, the rollout went one component at a time with behaviour held intact: toolbar, navigation drawer, breadcrumbs, search, inputs, pickers, dialogs and file upload. Each generated screen then picked the new design up automatically.

Inline row editing with one save across the table
Two-step select-all: this page, or every match
Currency, percentage and number inputs per locale
Design system rolled out without regressing generated screens

Compliance platform: Row editing, select-all and total rows — Row editing, select-all and total rows

Compliance platform: Tabbed record form beside advanced search — Tabbed record form beside advanced search

Compliance platform: Translations management and user profiles — Translations management and user profiles

04. The field app

The whole platform, in a pocket.

Consultants spend their days at client sites, so hours and mileage were recorded on a desktop long after the fact. The Flutter client I worked on calls the same endpoints as the web app and reads the same view metadata, so lists, filters and permissions stay consistent without a second API.

Roughly 14,000 lines of Dart
Timer that stays in sync with sessions started on the web
Trips survive an app restart
Unit, widget and screenshot tests across every flow

Compliance platform: Weekly time chart, recent entries and time reports — Weekly time chart, recent entries and time reports

Compliance platform: One-tap trip with calculated driving distance — One-tap trip with calculated driving distance

Compliance platform: Meeting timers, company switch and three languages — Meeting timers, company switch and three languages

Compliance platform: Side menu, assigned work and company tasks — Side menu, assigned work and company tasks

Compliance platform: Record forms and metadata-driven filters — Record forms and metadata-driven filters

Compliance platform: Sign-in, TOTP challenge and MFA-required screen — Sign-in, TOTP challenge and MFA-required screen

05. Backend, AI & security

Less typing, stronger sessions.

A vision model reads identity documents, validates the machine-readable zone and fills the record in; a second pipeline pulls data out of other documents with OCR. Alongside it, MFA enrolment and sign-in tracking moved long-standing users onto multi-factor auth without locking anyone out.

Machine-readable-zone validation on identity documents
OCR pipeline with normalisation and temp-file cleanup
Self-service onboarding via invitation or company code
Cross-region failover with a tested recovery runbook

Compliance platform: Vision model reading a specimen ID document — Vision model reading a specimen ID document

Compliance platform: Authenticator setup and code verification — Authenticator setup and code verification

06. Architecture

One contract, two clients.

The mobile app has no API of its own. Both clients enter through the same authorised gateway, so validation, permissions and row actions behave identically, and a configuration change made for the web reaches the phone without a new release.

Clients
Angular web · Flutter app
API Gateway
Authorised JWT entry
Lambda
Node.js & Python
Data
PostgreSQL · DynamoDB · S3
AI services
Bedrock vision · Textract

07. Resilience

Built to survive a bad day.

A secondary AWS region carries identity backup and restore, password sync and region-aware deployment scripts, exercised against a written runbook rather than assumed to work.

MFA: TOTP on web and mobile
2: AWS regions
3: UI languages
0: Mobile-only endpoints

08. Technologies