I build access control, authentication, and audit logging for startup backends. I’ve built it twice. One runs in production at a company in Paris.
| 2026-05-02 09:14:02 | maria | orders.card_last4 | read | 15m | 3f9a1c |
| 2026-05-02 09:15:41 | maria | orders.card_last4 | read | 15m | b7e204 |
| 2026-05-02 11:02:11 | alex | users.email | export | 4h | c1d8f7 |
| 2026-05-02 11:47:55 | system | grant:alex | revoke | — | 9a02be |
I replaced shared, permanent database credentials with access that is scoped, time-limited, and logged — who reached what data, and when. It runs in production there today.
Node · NestJS · TypeScript · PostgreSQL · Docker
The same idea, taken further: rules down to the field and row, access that expires on its own, and a chained audit log where altering any past entry shows. Queries run sandboxed — real production data, never the production credentials.
Next.js · TypeScript · PostgreSQL · Redis · Docker · Kubernetes
scalple.com — watch it live
Small, scoped, fixed-price work, part-time, as a subcontractor. Bounded jobs, not a retainer.
The thing most teams put off until it breaks. Field- and record-level rules, scoped and expiring access, logs you can actually audit.
Login, identity providers (Entra ID, Google Workspace), single sign-on wired in correctly.
Dockerized services, pipelines, push-to-production on Linux / Nginx / Kubernetes.
Node/TypeScript, Go, PostgreSQL. APIs and services.