Skip to content
Projects

Software and AI systems I've built

Real projects with architecture details and technical decisions. The summary for decision-makers, the full depth for technical teams.

Case Studies 04
Project 01 · Result
700+

Organizations use the portal in production. In use since 2025, with no security incidents.

Data portal for a state funding program

Independently built as a working student at ISG GmbH: 700+ users, in production since 2025

PHP 8.2 Laravel 12 Livewire 3 Alpine.js Bootstrap 5 MySQL PhpSpreadsheet PHPUnit

Problem

A state funding program (ESF Plus Baden-Württemberg) needed a secure web application for grant recipients to submit contact details and route them to the responsible funding bank. Usable without an IT background, fully GDPR-compliant.

Challenge

Sensitive public-sector data had to be protected without making the interface more complicated for administrative staff without an IT background. I built the application alone over three years and brought it into production.

Architecture Decisions

Service-layer architecture with thin controllers

Role-based access control (RBAC)

Defense-in-depth: protection against path traversal and spreadsheet injection

Audit-proof logging, automated tests before every deployment

Project 02 · Result
6 Signals

Multi-dimensional scoring: CPV · Semantics · Location · Contract value · Certification · Experience

Automatically finding relevant tenders

A product of my own (tender.current56.de), close to launch

TypeScript Next.js PostgreSQL + pgvector Claude Docker GitHub Actions

Problem

Companies spend hours every week manually searching for relevant public tenders. Most matching contracts get overlooked in the process, especially smaller ones that expensive providers usually ignore.

Challenge

I'm building the platform entirely myself: from data sourcing through AI scoring to the interface and operations. Core functionality is done; the final steps before launch are underway.

Architecture Decisions

Daily pipeline: Scout (TED API v3 + BKMS) → Normalize → Match → Notify

6-signal scoring: CPV, semantics, location, value, certification, experience

Eligibility check via Claude for natural-language requirements

Hexagonal architecture, multi-tenant from the ground up, semantic search (pgvector)

Daily Pipeline

Project 03 · Status
3 Roles

Planners, teachers, and admins each see only their own surface.

Tutorial scheduling for a university department

A self-built proof-of-concept, currently in progress

Next.js 16 React 19 TypeScript Prisma PostgreSQL dnd-kit Better Auth Playwright

Problem

A department plans tutorial staffing by hand today, in spreadsheets: who's teaching which group, who's overloaded, who's double-booked. Every change means follow-up emails and an outdated view for everyone else.

Challenge

I'm building a board where planners drag teachers onto fixed weekly slots. Double-bookings are flagged instantly, every open window updates live, and teachers see their workload and open tasks in their own view.

Architecture Decisions

Pure domain logic (conflicts, workload, calendar) separated from I/O and unit-tested

Real authentication with role-based access: each role sees only its own surface

Live updates via Server-Sent Events, every open window stays in sync in real time

Full test pyramid: unit, integration, and end-to-end tests before every commit

Project 04 · Status
45 Test suites

Automated tests cover logic, persistence, and encryption.

Health tracking with real encryption

A mobile app in active development, privacy by design

Expo SDK 54 React Native 0.81 TypeScript expo-sqlite @noble/ciphers Jest

Problem

Tracking health data over weeks and months usually means a generic notes app with no real protection. For sensitive longitudinal data, that isn't enough.

Challenge

I'm building a local-first app: entries are stored on the device, sensitive fields are additionally encrypted with AES-256-GCM, and the key stays in the device's secure hardware storage. No server ever sees the raw data.

Architecture Decisions

Strict layer separation: pure logic, persistence, and view communicate only through clear interfaces

Field-level encryption (AES-256-GCM) of sensitive data, key held in the device's secure enclave

Repository pattern with a swappable adapter, so logic is fully testable without a real device

GDPR export and erasure designed in from the start, not bolted on afterward

Have a similar challenge?

Briefly describe your situation. In a short, no-obligation call, I'll tell you whether I can help.

Book your initial call