Hollowgate Capital
A compliance-grade internal platform for a 200-person investment firm.
Industry
Finance & Insurance
Timeline
16 weeks
Team
3 engineers, 1 security reviewer
Category
Enterprise Application
Where things stood
Hollowgate's compliance team spent weeks per quarter manually assembling access logs and approval trails for audits, because none of their internal tools tracked who did what in a way that held up to scrutiny.
How we got there
Role-based access from day one
Modeled permissions around Hollowgate's actual org chart and compliance boundaries before building any feature on top of it.
Immutable audit logging
Logged every read and write to sensitive records in an append-only store, so an audit trail can't be edited after the fact, only appended to.
Security review before launch
Brought in a third-party security review ahead of go-live rather than after, given the platform's access to client financial data.
What changed
Weeks → days
Time to assemble a compliance audit trail
200
Employees on the platform at launch
100%
Actions on sensitive records logged
Tech stack
Next.js
Renders role-scoped dashboards so employees only ever see data their permissions allow.
TypeScript
Enforced access-control types at compile time given the platform's compliance stakes.
PostgreSQL
Backs the append-only audit log every sensitive-record action writes to.
AWS
Hosts the platform within the security and compliance boundary a 200-person investment firm requires.
SSO/SAML
Ties platform access to Hollowgate's existing corporate identity provider.
Redis
Caches permission checks so role-based access doesn't slow down every page load.
“Compliance sign-off used to take weeks of back-and-forth. With audit logging and role-based access built in from day one, it takes days.”
Grant Wilhelm
COO, Hollowgate Capital
