Skip to main content
AIVO Logo
Architecture & Scale SaaS Multi-Tenant & GitOps 2021 - 2025

IDPosition — Multi-Tenant Enterprise SaaS & Dedicated Scaleway Infrastructure

Transformation of a technical POC into an enterprise multi-tenant SaaS platform operated on Kubernetes (Scaleway) for Orange, Dior, FDJ, Vinci, and BNP. Dedicated client subdomains, Scaleway API, Cloudflare , dedicated DBs and S3 buckets, end-to-end encryption, and mobile/tablet apps.

100% Isolated
Dedicated DBs & S3 Buckets
3M+ Records
Active Data Volume
99.9%
Uptime Availability
Stack : Symfony 6 (PHP 8.2) Vue.js 3 Kubernetes (Scaleway) PostgreSQL (1 Dedicated DB / Client) Object Storage (1 S3 Bucket / Client) Cloudflare DNS & WAF API Keycloak (SAML v2 / OIDC) RabbitMQ ArgoCD & GitOps Capacitor Mobile App
Impact & Performance

50+ Dedicated client subdomains, DBs & S3 buckets API-provisioned with end-to-end encryption and 3M+ active records

1. Context & Genesis: From Technical POC to CAC 40 SaaS Scale

The IDPosition project stemmed from an ambitious engineering challenge: transforming an initial proof-of-concept (POC) written in procedural PHP into a high-performance, multi-tenant enterprise SaaS platform, highly available, ultra-secure, and capable of satisfying strict contractual and regulatory security requirements from CAC 40 corporations such as Orange, Dior, FDJ, Vinci, BNP Paribas, HEC, and Université de Lorraine.

As CTO and solution architect, Nicolas Baud led the complete overhaul of the information system to enable the management, reservation, lifecycle tracking, and traceability of equipment using RFID/QR tags on millions of assets.

+-----------------------------------------------------------------------------------+
|                     IDPOSITION MULTI-PLATFORM ECOSYSTEM                           |
+-----------------------------------------------------------------------------------+
|  [ Vue.js 3 Web Console ]   [ Java Inventory Tablet ]   [ Capacitor Mobile App ]  |
+-----------------------------------------------------------------------------------+
                                          |
                                          v (Dedicated Client Subdomain)
+-----------------------------------------------------------------------------------+
|               CLOUDFLARE WAF & DNS API (End-to-End Encryption TLS 1.3)            |
+-----------------------------------------------------------------------------------+
                                          |
                                          v (Keycloak SSO / OIDC & SAML v2)
+-----------------------------------------------------------------------------------+
|                       CENTRAL SAAS API (Symfony 6 / PHP 8.2)                      |
|                  < HEXAGONAL ARCHITECTURE / PORTS & ADAPTERS >                    |
+-----------------------------------------------------------------------------------+
      |                                  |                                  |
      v                                  v                                  v
+------------------+           +--------------------+           +-------------------+
| SCALEWAY API     |           | RABBITMQ (WORKERS) |           | KEYCLOAK REALMS   |
| (1 DB + S3/Client)           | (Exports/Imports)  |           | (OIDC / SAML v2)  |
+------------------+           +--------------------+           +-------------------+

2. Dedicated Client Subdomains & Cloudflare DNS Automation (End-to-End Encryption)

To satisfy enterprise brand identity and strict data isolation constraints, every corporate client was provisioned with its own custom subdomain.

Cloudflare API Automation & E2EE Security:

  • Automated Subdomain Provisioning: Upon onboarding a new enterprise tenant via the SaaS API, an automated provisioning workflow instantly created dedicated DNS records in Cloudflare via the Cloudflare API.
  • Unified Connection Across Web, Tablet & Mobile: The Vue.js 3 Web console, the Java inventory Tablet app, and the Capacitor mobile app connect directly and exclusively to the client’s dedicated subdomain API endpoint.
  • End-to-End Encryption (E2EE): Strict TLS 1.3, DDoS WAF rules, hardened security headers, and encrypted certificates ensuring absolute privacy between field devices and central APIs.

3. Total Multi-Tenant Isolation: 1 Dedicated DB & 1 S3 Bucket per Client (Scaleway API)

To satisfy strict security requirements and contractual agreements with CAC 40 clients, simple table or schema-based logical isolation was insufficient.

Automated Provisioning via Scaleway API:

  • One Dedicated PostgreSQL Database Instance per Client: Every new enterprise tenant onboarding automatically triggered the provisioning of a physically isolated PostgreSQL database instance via the Scaleway API.
  • One Dedicated S3 Object Storage Bucket per Client: Media, asset photos, and associated documents were stored in a dedicated per-client S3 bucket with unique encrypted access keys.
  • Contractual Isolation & Maximum Security: Zero client data resided on a shared database. Offboarding an enterprise account or conducting a GDPR compliance audit occurred with total containment.

4. Hexagonal Architecture (Ports & Adapters)

To guarantee long-term maintainability, scalability, and prevent vendor lock-in or framework coupling, Nicolas BAUD architected the API in Symfony 6 / PHP 8.2 following strict Hexagonal Architecture principles.

Decoupled Core Domain Logic:

  • Core Domain Layer: Pure business logic (Asset management, movements, location transfers, depreciation schedules, reservation slots), completely independent of frameworks and databases.
  • Primary / Driving Ports: Inbound interfaces consumed by the Vue.js 3 Web Console, inventory tablets, and mobile applications via their respective subdomains.
  • Secondary / Driven Ports: Outbound persistence (Doctrine / PostgreSQL / Scaleway API), message queuing (RabbitMQ), identity federation (Keycloak), and S3 object storage.
+------------------------------------------------------------------------------------+
|                IDPOSITION HEXAGONAL ARCHITECTURE (SYMFONY 6 / PHP 8.2)             |
+------------------------------------------------------------------------------------+
|  DRIVING ADAPTERS : Vue.js Web Console | Java Tablet App | Capacitor Mobile App    |
|                                         |                                          |
|                                         v                                          |
|  CORE DOMAIN      : Asset Management, Movements, Spaces & Reservations             |
|                                         |                                          |
|                                         v                                          |
|  DRIVEN ADAPTERS  : Scaleway API (1 DB+S3/Client) | RabbitMQ | Keycloak Realm     |
+------------------------------------------------------------------------------------+

Figure 1: Hexagonal Architecture diagram with per-client subdomain routing and end-to-end encryption.

5. Business Workflows & State Machines (Symfony Workflows)

+------------------------------------------------------------------------------------+
|               ASSET LIFECYCLE & WORKFLOW STATE MACHINE                             |
+------------------------------------------------------------------------------------+
|  [ Pending ] ---> [ In Service ] ---> [ Transfer / Return / Donation / Discard ]   |
|  MOVEMENTS  ---> [ Receipt ]    ---> [ Preparation ] ---> [ Verified Delivery ]    |
+------------------------------------------------------------------------------------+

Figure 2: Asset lifecycle state machine workflow in IDPosition.

6. Fluid Web Interface

The Vue.js 3 user interface offers dynamic data views, instant multi-criteria filtering, and maximum responsiveness.

Demo 1: Smooth navigation and item filtering.

Demo 2: Custom view management.

7. Permissions, Custom Fields & Validation Engine (Workflows & Approvals)

Fine-grained authorizations, data flexibility, and business configuration were custom-engineered within IDPosition via a powerful 3-pillar engine:

graph LR
    subgraph User ["Authenticated User"]
        U["Nicolas (Paris Site Manager)"]
    end

    subgraph Layer1 ["Layer 1: Right Profile (Actions)"]
        D1["Allows: Edit Accounting Fields"]
        D2["Subject to Manager Approval"]
    end

    subgraph Layer2 ["Layer 2: Access Profile (Data Scope)"]
        A1["Scope: Paris HQ Site"]
        A2["Buildings: A & B exclusively"]
    end

    U --> Layer1
    U --> Layer2
    Layer1 --> AuthCheck{"Authorization & Approval Engine \n."}
    Layer2 --> AuthCheck
    AuthCheck -->|"Action Granted -> Submitted to Validator B, C, or D \n."| Exec["Manager Validation Pending \n."]

Figure 4: Dual-Layer Permissions Engine, Custom Fields & Approval Workflows.

1. Dual-Layer Permissions Model (Rights x Scope)

  • Right Profiles (Functional Permissions): Defines what functional actions the user can perform (e.g. create assets, validate movements, export reports, edit forms).
  • Access Profiles (Data Visibility Scope): Defines what data scope the user can view (e.g. only assets in Building A, or the entire national inventory).

2. Custom Fields, Field Families & Hierarchical Groupings

  • Custom Fields & Configurable Validation Rules: Dynamic creation of custom business fields with configurable validation rules applied by field families (object typology, location, or grouping).
  • Configurable Field Visibility per Profile: Fine-grained field visibility controls based on user roles (e.g. User A accesses accounting/financial fields, field operators only see operational data).
  • Tailored Hierarchical Asset Groupings: Flexible asset grouping trees adaptable to each client’s organizational structure (e.g. grouping by HR department, or for a storage warehouse company, grouping by client with sub-groupings by asset type).

3. Change Request & Validation Engine (Manager Approval Workflow)

  • Field Operator Modification Approvals: Modifications submitted by field operators are queued and notified to their manager for review and approval prior to permanent database commit.
  • Multi-Validator Assignment: A permission profile assigned to a field team (e.g. 10 field technicians) can require approval from 1 or more designated validators. Example: User A edits accounting fields on an asset; the action is automatically routed to User B, C, or D for mandatory validation.

8. Mobility Ecosystem & Offline-First Inventory Queue

To address field constraints (inventories conducted in basements, underground storage rooms, or remote facilities without network coverage), the IDPosition ecosystem includes two dedicated mobile applications connecting directly to the client’s subdomain.

1. Java Inventory Tablet App & Anti-Duplicate Queue

  • Hardware Inventory Tablets: Provided to enterprise clients running a native Java scanning application (optical / RFID readers).
  • Offline-First & Deduplication Queue: Data collected in offline zones is stored locally. Upon API reconnection to the client’s subdomain, an async deduplication engine analyzes timestamps and serial numbers to ingest batches without generating duplicate entries or inventory conflicts.

2. Capacitor Cross-Platform Mobile App & Google Play Store

  • Capacitor Mobile app: Lightweight mobile app developed for maintenance staff and facility managers.
  • Google Play Store Publishing: Complete management by Nicolas of Google Play Store certification and release pipelines.
  • Quick Field Actions: Barcode scanning, asset renaming, location re-assignment, and quick status toggles.
  • Unified SSO Auth: Seamless authentication using enterprise SSO or IDPosition Keycloak accounts across Web, Tablet, and Mobile.

9. RabbitMQ Async Queue & Batch Processing

CPU-intensive and I/O-heavy operations (complex PDF report generation, Excel exports exceeding 100k rows, image resizing and bulk uploads) are offloaded outside the HTTP request lifecycle.

sequenceDiagram
    autonumber
    actor User as Web / Mobile User
    participant API as Symfony 6 API
    participant MQ as RabbitMQ Broker
    participant Worker as Async Worker (PHP/Node)
    participant Storage as Dedicated Scaleway S3 Bucket

    User->>API: Request 100k row Export (PDF/Excel)
    API->>MQ: Publish Message Event (task_export_data)
    API-->>User: HTTP 202 Accepted (Task ID T-9842)
    MQ->>Worker: Consume Message
    Worker->>Worker: Asynchronous document generation
    Worker->>Storage: Store file in tenant's dedicated S3 Bucket
    Worker->>API: Update Task Status (Completed + Download Link)
    User->>API: Notification / File Download

Figure 5: Asynchronous heavy task queue workflow powered by RabbitMQ.

10. Key Business Takeaways & Results

Through this architectural overhaul designed and led by Nicolas BAUD, the IDPosition platform established itself as an enterprise SaaS benchmark for performance and reliability.

Key Metrics & Business Achievements:

  • 50+ Dedicated client subdomains, DBs & S3 Buckets provisioned via Scaleway & Cloudflare APIs with end-to-end encryption.
  • 3,000,000+ Data Records processed with sub-100ms API response times.
  • 100% Audit Compliance across CAC 40 corporate and banking security reviews (BNP Paribas, FDJ, Vinci, BPCE …).
  • Zero Downtime Deployments leveraging ArgoCD and rolling Kubernetes updates.

Need a Similar Solution?

Let's discuss how we can engineer a custom solution for your organization.

Discuss Your Project

Case Study Summary