Self-hosted secrets and privileged-access management platform spanning 30 doctypes and 92 endpoints.
Encryption core: per-secret AES-256-GCM data keys wrapped by a pluggable KEK provider, Argon2id master passphrase with seal/unseal, and ciphertext-only persistence so plaintext never reaches the database or logs.
Append-only hash-chained audit with anchoring and monitorable verification.
Default-deny row-level RBAC, maker-checker approvals, PAM checkout and lease with rotation, dynamic secrets and scoped machine tokens.
Three-plane encrypted backup platform: a Frappe control plane with a React PWA, an outbound-only Python agent per server, and pluggable object storage.
Fail-closed client-side age encryption, SSE-KMS, prefix-scoped STS credentials and hashed agent tokens, so the portal holds no site data or standing cloud keys.
Incremental backups with GFS retention, tiered storage with archive-aware restores, and cross-provider replication with RTO-measured DR drills.
Three platforms spanning ISO/IEC 20000-1 service management, ISO/IEC 27001:2022 certification, and policy and SOP governance.
ISMS registers: 5×5 risk assessment, a 93-control Statement of Applicability, CAPA, internal and external audits, management review and BCP with RTO/RPO testing.
Six workflow state machines with segregation of duties, nine-role record- and field-level permissions, and CAB change control.
Policy and SOP lifecycle: sequential e-signature approval gated by emailed one-time codes, per-employee attestation issuing individually watermarked copies, and SharePoint storage over Microsoft Graph with a non-downloadable PDF viewer.
A queueing model of the pattern, not a recording of production. Push the arrival rate past what the workers can drain and watch the tail latency go vertical — that cliff at ρ = 1 is the whole reason capacity is planned against p99 rather than average throughput.
Utilisation0%
Queue depth0
p500.0ms
p990.0ms
Shednone
Other things I’ve built
TechBird·2026
Mailbird: Multi-Tenant Enquiry Platform
Multi-tenant enquiry service where each client website carries its own email routing, captcha, CORS and template configuration. Async delivery through the Frappe email queue with retry sweeper, webhook fan-out and rate-limited guest APIs.
Frappe v16PythonJinjaMariaDBTurnstilereCAPTCHA
TechBird·2024
FCM Push Notification Service
Configurable Firebase Cloud Messaging app for Frappe with zero-config browser registration. Rule engine maps DocType and action to recipients, with Jinja templates and batched multicast sends of up to 500 tokens.
Subscription platform with a self-serve trial flow and a centralised admin panel, improving onboarding completion and product adoption. Ran on AWS with CI/CD pipelines, hardened through VAPT.
JavaScriptPythonFrappeAWS
Academic·Aug 2021 - May 2022
Fitness Pro: Future of Fitness with AI
Android application that monitors user health and tracks workout data, with real-time workout detection using PoseNet and TensorFlow. Published in GIJET.