Case study - From an app that worked to an app ready for regulated data
The owner of a small practice had built a real, working internal app with an AI tool. It was not ready to hold regulated data with real customers on it. Here is how it went from that to a secure deployment running in cloud accounts in your name. Details are anonymized at his request.
The starting point
The client runs a small business and had built an internal workflow app that their staff use for forms and documentation. They built the working version themselves with Perplexity, and it did exactly what they needed in testing.
What was missing is what is almost always missing. A working app is not the same as one that can safely hold regulated records with customers on it.
Before any real data went live it needed control over who could reach what, a log of who did what, passwords held somewhere safe rather than in the code, and backups restored once to prove they worked. Then all of it written down.
The approach
I ran the project in the same three milestones I use on every deployment, with the client approving each one before we moved to the next.
- 01 Review & plan
- I read through the existing app, confirmed I had the access I needed, and delivered a written plan covering the exact Azure services, moving the data across, and every security setting. The client approved it before any work started.
- 02 Test deployment & validation
- I built everything the app needed on a private test address, written down as it was built so the whole setup could be rebuilt exactly. He signed in, confirmed it behaved the way it did on his own computer, and signed off.
- 03 Launch and handover
- I put it live, he confirmed he could reach it, and I handed over a written record covering every part of the system.
When the plan changed mid-project
The milestone process exists to keep surprises out. Something unexpected still comes up in almost every project, and what matters then is what you do about it. My job was to get him a working app, so I did the extra work rather than invoicing a change order for it.
While he was testing, he realized he had missed a feature he needed: letting users sign documents electronically. Rather than treat it as out of scope, I helped him add it.
He had built it in a new AI conversation that knew nothing about his existing app, so the code it produced did not fit what was already there. We worked through it together on a call and got the feature in properly.
Releasing it was simple, because updates were already automated. The change went to the test address on its own, we checked it there, and only then did it go live.
Helping owners add new features to an app an AI tool built, without breaking what already works, is exactly what a live session with me is for.
What was built
Everything the app runs on was defined in code and built in the client’s own Azure account:
- Hosting on Azure App Service. The app served over HTTPS only, on properly configured Azure infrastructure.
- A managed PostgreSQL database. Kept off the public internet, with backup and a tested restore.
- Staff sign in with their work accounts. Their existing Microsoft account, plus a second step that cannot be skipped.
- Passwords held in a locked store. Every password and key held in a locked store, none left in the code.
- Monitoring and a record of access. A single searchable record of what the app did and who accessed what.
- A clean switch to live. Test accounts and demo logins removed before it went live, with no test data left behind.
The result
He now has an app ready to hold regulated data, running entirely in cloud accounts in your name. Access is controlled and logged, every password is held in a locked store, backups are tested, and all of it is written up in a handover he can give to anyone.
They went from an app built with an AI tool to one running on accounts in their name, holding regulated data, without anyone on their side having to learn cloud infrastructure.
Twenty minutes, and no pitch.
I'll tell you what I'd fix first in what you've built, and why. No pitch.