Skip to main content
NEXUZ

Rutledge Group · Recruitment, training & care · 2025–26

MyRutledge

A 131,000-line operations platform running recruitment, learning, safeguarding, finance and governance for a multi-branch group.

  • React 19
  • TanStack Start
  • Cloudflare Workers
  • Supabase
  • PostgreSQL RLS
  • Capacitor

How it is put together

MyRutledge architectureWHO SIGNS INTHE PLATFORMENFORCED LAYERBranch staffLearnersHead officeRecruitment & peopleLearning & coursesFinance & reportingRow-level access rulesEncrypted personal dataAppend-only audit trail
One authenticated platform over a single Postgres database, with every read and write scoped to the signed-in role. Dashed outlines mark data under enforced access control.

Connected presence

One platform, one public site.

MyRutledge runs the internal operations; the Rutledge Group site handles the public face. They share branch context, job and course data, and the same operational truth — without the public site ever touching safeguarding or PII.

Two connected instrumentsMyRutledgePeopleLearningRecruitmentFinanceGovernanceSecurityRutledge GroupPublic siteJob searchTrainingBranchesAdminEmail
Operations platform on the left, public web presence on the right. The bridge carries data both ways — jobs, enquiries, learner records and branch context.

Context

Rutledge operates recruitment, training and domiciliary care across 18 branches. The operational surface is enormous: staff and learner records, apprenticeship delivery, safeguarding cases, placements, invoicing and a live regulatory obligation over all of it.

The platform now stands at roughly 131,500 lines across 197 route files, 204 components and 136 server-function modules, on 176 forward-only migrations — built and maintained by one architect.

Problem — A recruitment, training and domiciliary care group running critical operations — including safeguarding and learner data — across disconnected systems, spreadsheets and inboxes, with no defensible audit position.

Approach

How it was built.

  1. 01

    Make the invariants machine-enforced

    Compliance rules that live in a document get broken quietly. Here they are enforced in code: roles sit in a dedicated user_roles table behind a SECURITY DEFINER has_role() check, with a database trigger enforcing which of the 20 roles may stack, and 100% RLS coverage with GRANT, RLS and policies written into every table migration.

  2. 02

    Tier the data, then prove how it was handled

    PII is tiered T0–T3 as column comments. T2 and T3 are masked server-side and revealing a value writes an audit row; T3 is encrypted with pgcrypto AES-GCM so a record can be crypto-shredded on retention expiry.

  3. 03

    An audit trail you can actually rely on

    audit_events is append-only and hash-chained, verified nightly and deep-reconciled weekly. Divergence auto-freezes the chain and raises a SEV1. A single writeAudit() path is enforced by a structural lint, so there is no way to write history off the record.

  4. 04

    Nothing that only an engineer can do

    AC-00: no behaviour may be SQL-only, env-only or deploy-only. Every capability has an audited admin surface, so the business can run the platform without waiting on a developer.

  5. 05

    A ship gate, not a code review

    bun run regression is the release contract: typecheck, seven structural contract lints, a prerender build, a performance budget gate and an end-to-end smoke run against real seeded users. If the gate fails, nothing ships.

What was built

  • People — staff and learner strict separation, org tree, leaver lifecycle, dedupe soft-merge
  • Learning — apprenticeships, safeguarding case management with DSL gating, retention purge with crypto-shred
  • Recruitment — vacancies through to placements
  • Comms — threaded messaging, external outbox, attachment allow-list
  • Finance — invoices, aging, read-only Xero sync
  • Governance — policy and DPA register, one-click evidence pack, go-live gate across 19 signals, 507-item feature review register
  • Security — findings triage, audit-chain guard, SEV1 incidents, break-glass, CSP triage
  • Admin — feature flags, ops console, 40 role presets, cutover console
  • SJC-v1 scheduled job contract — apikey auth, Zod validation, withJob(), job_run audit, idempotency keys, kill-switch, runbook and ops tile per job
  • Egress allow-list, raw fetch banned in server files, CSP with Trusted Types, persistent-window rate limiting, timing-safe HMAC webhooks that fail closed

Outcome

One auth-gated operations platform covering people, learning, recruitment, comms, finance, governance and security, with compliance invariants enforced by the code rather than by policy documents.

Ownership

Aligned to UK Cyber Essentials Plus, ISO 27001 practice, UK-GDPR and DfE/ESFA expectations, with RPO under 15 minutes and RTO under 4 hours, a DPIA, threat model, subprocessor register and rehearsed DR drills. Delivered on a remix-per-customer model — one database per customer, branded separately. Shared tenant_id multi-tenancy was rejected outright to keep safeguarding data isolated.

All workNext: ONE Personal Wellness

Next step

Tell me what the business runs on today.

No pitch deck, no discovery fee. If something off the shelf would genuinely serve you better, I will say so before either of us spends money.

Message on WhatsAppzbarnett@nexuz.uk

Prefer to write it down? Send a full enquiry with what you are trying to build.