Rutledge Group · 2025-26
MyRutledge
The operations platform being built for an 18-branch care, training and recruitment group: recruitment, learning, safeguarding, finance and governance behind one sign-in.
- React 19
- TanStack Start
- Edge runtime
- Managed Postgres
- Row-level access control
- Native mobile wrapper
Private platform · sign-in only · pre-release
The brief
What had to change.
A recruitment, training and domiciliary care group running critical operations, including safeguarding and learner data, across disconnected systems, spreadsheets and inboxes, with no defensible audit position.
Rutledge operates recruitment, training and domiciliary care across 18 branches. The operational surface is enormous: staff and learner records, apprenticeship delivery, safeguarding cases, placements, invoicing and a live regulatory obligation over all of it.
The platform now stands at roughly 131,500 lines of application code on a forward-only migration history, built and maintained by NEXUZ under one lead architect.
One platform, one public site.
The Rutledge Group site already handles the public face. Once MyRutledge goes live it will run the internal operations, sharing branch context and job and course data with the site, without the public site ever touching safeguarding records or personal data.
Approach
How it was built.
Make the invariants machine-enforced
Compliance rules that live in a document get broken quietly. Here they are enforced in code: roles are held separately from user profiles and checked server-side, the combinations a person may hold are constrained by the database itself, and every table ships with access rules from its first migration.
Tier the data, then prove how it was handled
Personal data is classified by sensitivity tier. The most sensitive fields are masked server-side, revealing a value writes an audit record, and the top tier is encrypted at rest so a record can be destroyed irrecoverably when retention expires.
An audit trail you can actually rely on
The audit log is append-only and tamper-evident, reconciled on a schedule. Divergence freezes it automatically and raises a top-severity incident. A single write path is enforced by an automated structural check, so there is no way to write history off the record.
Nothing that only an engineer can do
No behaviour may be database-only, environment-only or deploy-only. Every capability has an audited admin surface, so the business can run the platform without waiting on a developer.
A ship gate, not a code review
One release command is the contract: typecheck, structural contract checks, a full prerender build, a performance budget gate and an end-to-end smoke run. If the gate fails, nothing ships.
What was built
10 parts, one system.
People
staff and learner strict separation, org tree, leaver lifecycle, dedupe soft-merge
Learning
apprenticeships, safeguarding case management with gated access, retention purge with irrecoverable deletion
Recruitment
vacancies through to placements
Comms
threaded messaging, external outbox, attachment controls
Finance
invoices, aging, read-only accounting sync
Governance
policy and data-protection registers, one-click evidence pack, a multi-signal go-live gate and a full feature review register
Security
findings triage, audit-chain integrity checks, incident handling and policy review
Admin
feature flags, ops console, role presets and a cutover console
A scheduled-job contract
every job authenticated, validated, audited, idempotent and individually controllable, with a runbook and ops tile
Server-side network, content and rate controls, with inbound integrations verified and failing closed
What it will change
Once live, the group will run recruitment, learning, safeguarding, finance and governance from one sign-in across 18 branches. The evidence pack for a regulator, funder or auditor is one click away, and the compliance rules hold because the software enforces them.
Ownership
Aligned to UK Cyber Essentials Plus, ISO 27001 practice, UK-GDPR and DfE/ESFA expectations, with tight recovery objectives, a DPIA, threat model, subprocessor register and rehearsed DR drills. Delivered on a remix-per-customer model: one database per customer, branded separately. Shared multi-tenancy was rejected outright to keep safeguarding data isolated.
Next step
Tell us what the business runs on today.
No pitch deck and no discovery fee. If something off the shelf would serve you better, we will say so before either of us spends money.
Or email zbarnett@nexuz.uk