Climate tech · Australia
AWS CDK across 18 DynamoDB tables and two Cognito pools, COPPA-grade consent for school programmes, QR-verified rideshare with scheduled settlement, fail-closed audit exports, and a React portal plus React Native app, hardened for a live pilot.
A climate programme for employers and schools. Organisations register with one or more sites; employees, parents, students and teachers join with a code, set up a commute profile and log trips in the mobile app. The app shows emissions avoided against a baseline, lets people share rides, and in school mode handles parental consent and school-zone rules. Portal admins see organisation and site reporting, data-quality checks, intervention scenarios, and two exports: a management CSV and an auditor-ready Audit Pack. The programme is coordinated from Western Australia and sits inside a wider ecosystem with a children's book and rewards.
The client had the programme, the partners and a design, and needed the software built from nothing: backend, portal and app. The non-negotiables were correctness and defensibility. Trip totals feed emissions claims, so rollups had to stay right under concurrent writes. Exports go to auditors, so a wrong number was worse than no export. Students are children, so consent and personal data had to be handled to COPPA and GDPR standards. We own all three codebases and have taken the platform from its first milestone through a two-week production-hardening pass ahead of a live pilot.
How the system is layered, from the people using it down to the data and the services it depends on.
The choices that made the difference, and why we made them.
Students can't participate until a guardian approves; the backend enforces the gate, the app only displays the state. Guardian email addresses are encrypted with KMS. Deleting a user removes the record, the commute profile, consent records and the Cognito identity, so no orphaned personal data remains. The authoritative behaviour lives in a system-logic document that the app and portal must conform to.
Drivers create trip groups, passengers request and are matched on route, and every accepted passenger scans one shared QR code at pickup. That scan records co-presence, the strongest evidence the platform collects, with the caveat stated explicitly in the audit method note. A settlement job runs every 30 minutes with early-settlement, no-start-ride and solo-fallback rules, and raw records are never deleted, only superseded.
Each trip updates per-user, per-site and per-organisation rollups in one DynamoDB transaction, so dashboards never scan raw logs and never show a half-updated day. The Audit Pack re-derives daily totals independently, stops if they diverge from the rollups, and only then produces a hashed 13-file package by presigned URL. A self-invoking Lambda runs it past the gateway's synchronous timeout.
Beyond charts, the portal has a reporting-integrity card, a data-quality page with integrity checks, a verification ladder and audit notes, an interventions page with scenario modelling and method notes, and a governance log of settings changes. It's the difference between a dashboard and something you can hand to an auditor.
Ahead of the pilot we stood up a separate production stage from the same CDK app, turned on point-in-time recovery, retain policies and deletion protection on every table, rehearsed a restore (a 10-item table back in under five minutes, checksum-identical), tuned Lambda timeouts and memory, ran a 3,000-request load check with bursts to 60 concurrent, wired 16 alarms to the client's inbox, and put a CSRF header and security headers in front of the portal.
Tell us what you're building. You'll get a straight answer on scope, timeline and cost, usually within one business day.