ISMS CompliancePlatform

I owned all of it: the architecture, the separation of the domains into services, the front end, and the deployment layer.

The services deploy and fail independently. An API gateway is the single ingress point, authenticating requests and translating them into NATS subjects; backend services never expose themselves directly. Each service owns its own bounded context and publishes domain events (user.created, project.updated, file.uploaded) that other services subscribe to. The analytics and ops domains are pure consumers — they hold no write path of their own and rebuild their state entirely from the event stream.

Infrastructure is declarative end to end: NATS JetStream, MongoDB (replica set via the Community Operator), Redis, MinIO, an antivirus engine, and Ingress NGINX all managed through helmfile, with Skaffold providing hot-reload development against a live cluster.

Decisions, answered: event-driven over REST between services, because decoupled services absorb each other's downtime instead of cascading it. The gateway translates HTTP into NATS rather than proxying, so everything internal speaks one protocol and gets buffering and replay for free. The support domain keeps local read models, because a ticket query should never block on another service — the cost is reconciliation, paid deliberately. MinIO over S3 directly, because sensitive documents stay inside the cluster boundary while the S3 API keeps storage swappable.

Information security management systems are document-heavy, evidence-heavy, deadline-driven work, and most organizations run them on spreadsheets and shared drives. This platform turns that into tracked work: standards decompose into projects, projects into tasks and required documents, and every action leaves an audit trail. Multi-tenancy means a consultancy can run many client organizations from one deployment without their data ever touching.

The engagement started agile: weekly meetings, progress reviewed. Over time the client handed me the decisions and I led the build my own way, with a casual session when a design changed or a feature was added. By the final iteration the brief had widened beyond ISO tooling toward general project management, and the platform's workspace reflects that. The weekly reviews stopped because they stopped being needed.

The front end has no knowledge of the microservices or the broker. It talks only to the gateway, which means services can be split, merged, or rewritten without a single front-end change. This is what the extra complexity buys.

The support domain needs user and project data to render a ticket, but calling the user and core domains synchronously would couple all three — one slow service degrades the other two, and any outage cascades. The system instead has it subscribe to user.* and project.* events and maintain its own local read model. It answers every query from local state and never blocks on another service.

The cost is eventual consistency, which has to be designed for up front: events must be idempotent, ordering can't be assumed, and a service restarting needs to catch up on everything it missed. That last requirement is why NATS runs in JetStream mode with a persistent FileStore — with a memory store, a pod restart silently loses the event log and consumers desynchronize permanently. That failure never shows up in development, and it can't be repaired in production.

Twelve modules: Dashboard, Projects, Tasks, Documents, Meetings, Audits, Teams, Trainings, Templates, Support, Directory, Organization. Dark and light themes, and an EN/AR language toggle.

The Documents module is where the domain expertise shows. It models real ISO 27001 artefacts — ISMS scope and boundaries, risk assessment methodology, statement of applicability mapping Annex A controls, access control procedures, incident management and business continuity plans — typed as Core Document, Methodology, Procedure, Plan, Guideline or Record, each moving through Draft → Review → Approved/Rejected. That taxonomy comes from four years inside the standard.

Three primary flows: authentication and organization setup with 2FA and CASL-based abilities; document management from upload through virus scan, object storage and versioning; and audit management — create an audit, assign controls, attach evidence, export the report.

Alongside the architecture, a Docker build overhaul: multi-stage production builds, layer-cache mounts for npm, non-root container users, and Node 20. Measured result — incremental builds dropped from 120 seconds to 1.2 seconds, production images shrank 60–70%, and the frontend image shrank roughly 90% by serving through nginx instead of Node.

The platform's architecture was sound and its infrastructure ambition exceeded the environment available to run it. Given the same brief again, the right call is probably a modular monolith with the event boundaries drawn but not yet distributed — same design thinking, a fraction of the operational cost, and it would have shipped.