Skip to content
Back to portfolio

DevOps & Infrastructure

Live in production

ThinClient OS + Fleet Manager

Locked-down Debian RDP appliance with a cloud fleet manager

Visit live site
  • Zero-desktop hardened OS
  • TPM-sealed full-disk encryption
  • Remote wipe & crypto-erase
  • Self-healing auto-reconnect

Overview

A production-grade Linux appliance that boots straight into a full-screen Windows RDP session — no desktop, no shell, no login prompt — backed by a self-healing watchdog and an infinite reconnect loop. On machines with Secure Boot and a TPM 2.0 chip the whole disk is encrypted (LUKS2, AES-256) with the key sealed in the machine's own TPM, and the encrypted install has been attack-tested against disk theft and boot tampering. Lost or stolen machines are wiped remotely, crypto-erasing the disk on encrypted installs. Optional per-account policy adds lock-screen password rules with a three-strike lockout, Windows-server certificate pinning, USB-storage and clipboard blocking, and memory hardening. New machines can be required to wait for administrator approval (on by default for new accounts), operating-system security patches can roll out through canary machines, and signed kernel updates roll back on their own if they fail to start. It ships as a reproducible ISO with a graphical installer and pairs with a Next.js fleet manager that provisions, monitors, secures and remotely controls the machines and the AWS, Azure and VPS Windows servers they connect to.

The problem

Managing desktops shouldn’t cost this much time and money.

01

Hardware you keep replacing.

Every few years the PCs slow down and get replaced, even though the actual work happens in a browser or a line-of-business app. You’re buying hardware to run an operating system, not to do the job.

02

You can’t see what’s happening.

A machine goes down in a branch office and you find out when someone phones. There’s no record of what happened, no way to check the network, and no way to help without travelling or talking someone through it.

03

Data sits on machines you don’t control.

Files saved to desktops. Local logins. USB sticks. Every endpoint is a place data can leak from, and every one needs patching, antivirus and someone to look after it.

The desktop is the problem. Move it to the cloud, lock the endpoint down to a single job, and manage the whole fleet from one place.

Outcomes

Why it matters

What changes once it is running

Cut hardware spend.

Any PC from the last decade works — a 10-year-old desktop boots the same session as a new one, because the actual computing happens on AWS. Machines stop being a refresh cycle and become a screen and a keyboard.

Nothing to steal from the endpoint.

No local desktop, no local files, no local user account. If a machine is stolen, the thief gets a locked screen — on encrypted installs, a disk only that machine’s own security chip can open — and the moment it comes back online, the dashboard wipes it.

Cut your AWS bill for the hours nobody is working.

Start and stop the Windows servers on EC2 straight from the dashboard. A clinic running 12 hours a day doesn’t pay for the other 12.

See and fix problems without travelling.

Watch a live view of any screen, check the real measured connection speed, chat with the person using it, lock it, restart it, or pull a full diagnostic bundle — from your phone if necessary.

A record of what actually happened.

Optional session recording (screen, webcam and microphone in a single stream) stored in your own encrypted S3 bucket, with automatic retention so it deletes itself on schedule.

Set up in minutes, updates itself forever.

Write the ISO to a USB stick, boot, enter one enrolment key. After that, cryptographically signed updates roll out to the fleet on their own — staged, with automatic rollback on failure.

ThinClient OS + Fleet Manager - Main showcase

Capabilities

Key capabilities

What we designed, built and shipped.

  1. 01

    Boots into fullscreen Windows RDP — zero desktop, fully locked down

  2. 02

    Full-disk encryption sealed to the TPM, plus remote wipe for lost devices

  3. 03

    Per-account USB, clipboard, password-lockout and certificate-pinning policy

  4. 04

    Cloud fleet manager: enrolment approval, monitoring, patching & remote control

Stack

Technology stack

Each layer, the technology behind it, and why it was chosen.

LayerTechnologyWhy
Device OSDebian 13 (live-build ISO), OpenboxStable, minimal, reproducible images
RDP clientFreeRDP 3 (xfreerdp3)H.264/AVC444 acceleration, mature protocol support
Device agentPython daemon, GTK3 (PyGObject)Small footprint, no desktop environment required
CaptureFFmpeg with VA-API hardware encodingGPU encode keeps old CPUs usable
StreamingHLS (segmented H.264/AAC)Plays in any browser, resumable, cache-friendly
Control planeNext.js, React, TypeScriptServer components, one deployable app
DataPostgreSQL via PrismaRelational integrity for multi-tenant billing
StorageAWS S3 (per tenant)Durable, encrypted, lifecycle-managed
ComputeAWS EC2Windows workloads, started/stopped on demand
DeliveryDocker Compose, PWA + service workerReproducible deploys, installable dashboard
SecurityAES-256-GCM, bcrypt, RSA-signed updates, TOTP, WebAuthnDefence in depth

Architecture

How data actually moves

The endpoint holds nothing. Every path below is a real connection the system makes today.

ThinClient OS architecture and data flow diagram: a branch/clinic PC runs ThinClient OS with no local data, connecting via (1) HTTPS device registration and heartbeat every 5 seconds and (2) policy/command updates to the ThinClient Manager control plane (Next.js, PostgreSQL, REST APIs), which (3) also opens a direct encrypted RDP session from the PC straight to an EC2 Windows desktop, bypassing the control plane, and (4) provisions and manages that EC2 instance via the AWS API. The PC (5) uploads encrypted screen recordings and live HLS segments directly to a per-tenant S3 bucket using pre-signed URLs — the bucket is never public. Admins (6) get secure HTTPS access from a browser or PWA to view fleet status, control live sessions, watch recordings via signed URLs, configure policy, and review audit logs and billing.
The endpoint holds no data. It streams a Windows session from EC2, reports to the control plane every five seconds, and pushes recordings straight into the customer's own encrypted S3 bucket. The storage bucket is never public — the dashboard proxies playback through short-lived signed URLs.

Screens

The real dashboard

Captured from the live console. Device and customer names have been redacted for privacy.

Live device view showing a locked ThinClient OS screen with a real-time connection quality badge (download/upload speed and latency) and an unlock control
01Lock a machine instantly — even if it’s currently offline, the lock applies the moment it reconnects.
ThinClient Manager Machines tab showing an AWS EC2 Windows instance with Start and Stop controls
02Start and stop the Windows servers on EC2 straight from the dashboard.
ThinClient Manager Tenants page listing three tenants with their device counts, user counts, and per-tenant storage configuration status
03Multi-tenant by design — each tenant’s fleet and storage are kept separate.
ThinClient Manager Security settings showing two-factor authentication enabled and biometric (Face ID / Touch ID / fingerprint) sign-in enabled
04Two-factor and biometric sign-in for admins, enabled by default.

How it works

From USB stick to managed fleet

  1. Step 01

    Flash & boot

    Write the ISO to a USB stick and boot any PC. No Windows licence, no imaging server.

  2. Step 02

    Enrol once

    Enter the customer’s enrolment key. The device registers itself, gets a unique identity, and appears in the dashboard.

  3. Step 03

    Connect

    It boots straight into the Windows session on EC2 using credentials pushed from the server. The user never sees or types them.

  4. Step 04

    Operate

    Staff work normally. You watch status, quality and activity; step in with live view, chat, lock or restart if needed.

  5. Step 05

    Maintain

    Signed updates roll out on their own, in stages. Recordings age out automatically under the retention policy you set.

Deployment

Deploy it your way

Fully managed (recommended).

We run the control plane; you run your Windows workloads on your own AWS account. Fastest to start, nothing to maintain.

Self-hosted control plane.

The dashboard ships as a Docker Compose stack with a bundled PostgreSQL. Runs on any Linux host or your own EC2 instance — useful where data residency rules require it.

Bring your own storage.

Point each customer at their own S3 bucket. Recordings never touch our infrastructure. Any S3-compatible provider works (AWS S3, MinIO, Wasabi, Backblaze B2, DigitalOcean Spaces).

Integrations

  • AWS EC2 — power Windows instances on and off from the dashboard; the RDP target updates itself when the address changes
  • AWS S3 — per-tenant recording and live-view storage with lifecycle retention
  • Any RDP host — AWS EC2, Azure, on-premise Windows Server, or a physical PC
  • Microsoft Authenticator and any RFC-6238 TOTP app
  • WebAuthn / passkeys — platform biometrics on macOS, Windows, iOS and Android
  • Admin API — token-authenticated REST endpoints for automation and scripted provisioning

Next step

See it running on your own hardware.

We'll walk you through a live fleet, then help you boot your first machine from a USB stick on a call. No commitment, no sales script.

Request a demoView the live console

Feature guide

Everything the platform does

ThinClient OS turns any standard PC into a secure, single-purpose workstation that boots straight into your Windows desktop — with full-disk encryption, remote wipe and per-account data-leak controls — paired with a full web + mobile dashboard to run, monitor, secure, support and record every machine from one place. Here is everything the platform does.

On each machine

The ThinClient operating system

Installs on any standard PC and turns it into a secure, single-purpose workstation. Staff never touch the underlying system — it simply switches on and works.

Startup & session

  • Boot straight to work. Powers on to a branded start-up screen, then a secure lock screen — no Windows desktop, no clutter, nothing to configure.
  • Secure lock screen first. The screen password is required before anything connects, so a machine left on is never open to a passer-by.
  • Automatic connection. After unlocking, the machine connects to your Windows desktop by itself — the user is working within seconds.
  • Single-purpose kiosk. Locked to its job: users cannot exit to a desktop, install software, or change system settings.
  • Automatic session recovery. If a session ends unexpectedly it returns to the connect screen and reconnects — never stuck on a dead screen.

Connecting to Windows

  • Centrally managed connection. Windows server address, username, and password are set from the dashboard — not typed at the device.
  • The password stays hidden. Delivered securely and never shown on the machine. Staff can connect but can never see, copy, or share it.
  • Per-machine or account-wide. One default connection for all machines, or a specific connection per machine.
  • One-time manual override. An operator can enter a different connection for a single session; it reverts on the next restart.
  • Local fallback. If the dashboard is unreachable, a securely-saved local connection keeps work from being blocked.
  • Video quality control. Remote display mode can be tuned centrally (automatic, high-quality, or compatibility) to keep tricky setups smooth.

Networking & internet quality

  • Wired or Wi-Fi. Works over a network cable or Wi-Fi, and knows which it is using (cable, Wi-Fi, or mobile/tethered).
  • Prefers the cable. Waits for the more reliable wired connection first when a cable is plugged in before offering Wi-Fi.
  • Simple Wi-Fi picker. An on-screen list to choose a network and enter the password, with USB-adapter stability built in.
  • Live internet speed test. Measures real download speed on a schedule and on demand from the dashboard — even during a live call.
  • Live latency & packet-loss check. Continuously watches the link to your Windows server — the early warning for lag or freezes.
  • On-screen quality badge. A movable, colour-coded badge (green / amber / red) floats over the session showing live speed and link quality.

On-screen controls & display

  • Volume & brightness. Simple on-screen sliders for volume and (on supported screens) brightness.
  • Correct local time. Clock and time zone are set for you, per machine or account-wide, so the on-screen time is always right.
  • Clean, branded look. A polished start-up/branding screen and a distraction-free interface.

Security & lockdown

  • Screen lock with password. Locks the session instantly when the user steps away, and is required after boot.
  • Password rules & 3-strike lockout. When you switch it on: minimum length and character mix, the factory default must be replaced, passwords expire with a reminder and cannot be reused. The third wrong attempt locks the machine until an administrator releases it — and the count survives a restart.
  • Remote password updates. A new screen-lock password can be pushed from the dashboard. It travels as a salted hash, so the password itself is never sent.
  • Checks it is talking to your real server. When switched on for your account, the machine reads the Windows server’s certificate before the password leaves it, and compares it with the one on record. Report mode warns on a change; enforce mode refuses an impostor, including on reconnects mid-session.
  • Tamper-proof. No unapproved software, no system settings, no breaking out of the workstation.
  • No back doors. Remote shell access, the hidden console and any debug login are switched off at every start, whatever image the machine came from. Production images do not carry a remote-login server at all.
  • Dial-out only. The machine reaches out to the dashboard — nothing inbound to open, so it works behind any normal firewall.

Encryption & lost-device protection

  • Full-disk encryption. On machines with Secure Boot and a TPM 2.0 chip, the whole disk is encrypted (LUKS2, AES-256). The key is sealed inside that machine’s own TPM — nothing to type at start-up, and no key file anywhere.
  • Stays locked when attacked. Tested against moving the disk to another PC, switching Secure Boot off, altering one byte of the boot image, and signing it with the wrong policy. In every case the disk stays locked.
  • Remote wipe. A lost or stolen machine is wiped the moment it comes back online: credentials, saved connection details, pending recordings, chat and logs. On an encrypted machine every disk key is destroyed as well, so the drive is unreadable for good.
  • Stolen means stolen. A machine reported stolen receives nothing but the wipe. It cannot re-register, and cannot be reinstalled into your fleet until an administrator marks it recovered.
  • Windows password never on disk. Held in memory only, so pulling the drive out recovers nothing.
  • Memory hardening. Optional per account: memory is zeroed as it is handed out and released, devices plugged into the machine cannot read its RAM, and sleep and hibernate are disabled — nothing from an earlier session lingers.

Data-leak controls

  • Block USB storage. Switch off pen drives, USB disks and card readers for an account. Keyboards, mice, headsets, webcams, printers and phone tethering keep working.
  • Clipboard control. Copy and paste between the machine and Windows can be turned off per account.
  • Nothing to take. No local files, downloads or profile to begin with — so these close the routes that remain, rather than guarding stored data.

Monitoring & recording

  • Live screen & camera streaming. Stream a machine’s screen — and camera, if attached — to the dashboard in real time.
  • Session recording. Record screen, camera, and microphone combined into one video saved to secure cloud storage.
  • Continues across screen locks. Recording keeps going through screen locks so nothing is missed.
  • Transparent recording notice. A non-blocking on-screen badge names what is being captured (or runs silently where policy allows).
  • Choose what’s captured. Screen, camera, and microphone can each be turned on or off.

On-device support chat

  • Always-available chat bubble. A floating chat button in the corner — visible on the desktop and over the full-screen remote session.
  • Unread badge. A red badge appears when an administrator sends a new message.
  • Share screenshots both ways. Send a screenshot of exactly what you see, and view screenshots the administrator sends back.
  • Emoji & quick reactions. An emoji picker plus one-tap reactions, flowing in near real time.

Reliability & self-healing

  • Frozen-session recovery. Detects a frozen session and restarts the connection automatically — no power-cycling, no lost server-side work.
  • Smart reconnection. Ordinary network hiccups are ridden out and the session reconnects on its own.
  • Freeze-proof audio pipeline. A purpose-built remote-desktop engine removes a known cause of call-related freezes.
  • Stability hardening. Real-time audio priority, a memory safety cushion, a hardware watchdog, and persistent logs keep long calls stable.

Automatic over-the-air updates

  • Updates arrive over the internet. New features and fixes install themselves — no IT visit, no manual work.
  • Safe & verified. Every update is cryptographically signed, so only genuine updates are ever applied.
  • Staged, non-disruptive rollout. Rolled out gradually; the operator is gently prompted and can defer before it applies.
  • Operating-system security patches. When switched on for your account, security fixes are downloaded quietly in the background, bandwidth-limited and spread across the morning so a whole site never saturates its connection, then installed at the next start — before anyone signs in.
  • Canary machines go first. A few chosen machines install a new patch first. The rest of the fleet only ever receives versions those machines came back healthy from.
  • Kernel updates that undo themselves. On encrypted machines a new kernel arrives as a signed image with two attempts. If it never reaches the lock screen, the machine returns to the previous kernel on its own.
  • Always reports its version. So you can see exactly what each machine is running.

Setup & provisioning

  • Graphical install wizard. Step by step, with a clear “do not switch off” warning and a one-click restart at the end.
  • Approval before it joins. With installation approval on — the default for new accounts — a copied installer is not enough to get into your fleet. The machine shows a pairing code; an administrator confirms it matches and reads back a one-time password. Five wrong attempts and the request is void.
  • Identity bound to the hardware. A disk copied onto a different PC loses its identity and has to be enrolled again, rather than quietly joining as a second copy.
  • First-boot setup. Handles the initial configuration automatically.
  • Install to disk. So the machine runs the operating system permanently.

Management dashboard

The web + mobile application

One place to see, control, support, and record everything — from your computer or your phone.

Access anywhere — web + mobile

  • Full web application. Open the dashboard in any modern browser, on any computer — nothing to install.
  • Installable mobile app (PWA). One-tap install on phone or tablet for an app-like experience — manage your fleet on the go.
  • Responsive, light & dark. Looks great on desktop, tablet, and phone, with light and dark themes.
  • Comfortable navigation. A collapsible side menu; account details, theme switch, and sign-out sit neatly together.

Users & access control

  • Logins for your team. Give each team member their own account.
  • Access levels. Full administrator, or view-only / limited access — you decide.
  • Add or remove people any time. You stay in control of who can get in.
  • Account settings. Each user manages their own profile and password.

Device fleet management

  • All machines in one list. See every machine at a glance, in consistent order.
  • Search & filter. Find machines by name and filter by status (online / offline) or group.
  • Device detail pages. Everything about a single machine in one place.
  • Enrolment & organise. Add machines with secure codes, then rename and organise to match your setup.
  • Key rotation. Administrators can re-secure a machine’s identity if ever needed.

Live monitoring

  • Online / offline at a glance. Updated live, with a “last seen” time for every machine.
  • Internet quality per machine. Live speed and connection type (cable / Wi-Fi / mobile) with a clear colour signal.
  • On-demand speed test. Trigger a real speed test on any machine — even mid-call — and watch the result appear.
  • Fleet overview. Machines online, in session, licensed and up to date at a glance, with a “needs attention” list ordered worst first.
  • Video wall. Every live screen on one wall. Double-click a tile to lock it, end the session or shut it down without leaving the wall.

Live view & session recording

  • Watch live. View any machine’s screen — and camera — in real time, in split view or full-screen.
  • Auto-stop when offline. If a machine drops off, monitoring stops cleanly and won’t silently restart.
  • Recording & playback. Recorded sessions are stored securely and can be played back from the dashboard.

Activity & productivity tracking

  • Working hours & connections. How long each machine was actually in use, and how many times a session was started.
  • Screen locks & idle time. How often and how long the machine was locked, plus periods with no activity.
  • Offline time. When the machine wasn’t reachable.
  • Day-by-day, per machine. Spot patterns and see where time goes.

Remote control & actions

  • Lock, restart, shut down. Lock or unlock the screen, and restart or shut down a machine remotely.
  • End session & force update. Give the user a clean start, or push a machine to the latest version now.
  • Speed test & diagnostics. Run a speed test or collect a full diagnostics bundle on demand.
  • Offline-safe & confirmed. Actions queue for offline machines and run on reconnect; disruptive ones ask for confirmation.

Windows connection management

  • Set the connection centrally. Configure server address, username, and password per machine — or one default for all.
  • Password stays hidden. Stored encrypted and never displayed back — not in the dashboard, not on the device.
  • Display/quality control. Tune the remote display mode per machine to keep difficult setups smooth.

Support chat from the dashboard

  • Message any machine. Chat directly with the person at any machine, with per-machine conversations and full history.
  • Screenshots both ways. Receive screenshots from users and send screenshots back, with emoji reactions.
  • Unread badges & local time. Never miss a reply; messages show in the machine’s local time with friendly labels.
  • Clear a conversation. When it’s no longer needed. Messages flow within seconds.

Secure storage & retention

  • Your own secure cloud storage. Recordings and shared screenshots live in private cloud storage configured for your account.
  • Recording retention. Recordings auto-delete after a period you choose (for example, 30 days).
  • Chat retention. Support-chat messages and screenshots auto-delete after a period you choose, up to 7 days.
  • Recording notice control. Show the on-screen recording badge, or run silently where a monitoring policy applies.

Audit log

  • Every important action recorded. Who did what, and when.
  • Covers key events. Locks, restarts, setting changes, and recordings.
  • Reviewable any time. A clear, trustworthy trail for accountability and compliance.

Device security

  • Security policy per account. Password rules, USB storage, clipboard, memory hardening, certificate checking and OS patching — each switched on per account, and all off until you choose.
  • Plain-language findings. Every machine reports its posture — encryption, Secure Boot, TPM, memory protection, patch status — as findings you can read. Anything it cannot determine is reported as unknown, never guessed.
  • Certificate alerts. The first certificate a Windows server presents is recorded. A different one is held for review and raises an alert.
  • Wipe & report stolen. Behind a typed confirmation and two-factor authentication, and written to the audit log.
  • Installation approvals. For accounts with approval on, a queue of machines waiting to join, each matched by the pairing code on its own screen.

Cloud Windows machines

  • AWS, Azure and VPS panels. Start, stop and see the state of the Windows machines your thin clients connect to — across AWS, Azure and a VPS provider panel — from one place.
  • Buy time, not a forgotten machine. Give a machine 30 minutes to four hours with one tap. It starts if it was off and stops itself when the time runs out, so nobody pays for a machine left on overnight.
  • Stopped really means stopped. On Azure a stop releases the machine so it stops billing, and a Windows machine shut down from inside — still charged by Azure — is flagged and stopped properly.

Update management

  • See each machine’s version. At a glance, with an “update available” indicator when a newer version is ready.
  • Force-update on demand. Push a specific machine to the latest version now.
  • Staged rollout control. So updates reach the fleet gradually and safely.

Diagnostics

  • One-click diagnostics. Request a full bundle from any machine — system health, logs, and connection details.
  • Delivered securely. Straight to your storage and downloadable from the dashboard — no site visit needed.

Licensing & billing

  • Per-machine licensing. Costs scale simply with your fleet.
  • One invoice for everything. Licences, cloud machines and other charges on a single invoice, finalised automatically when the month closes. Account administrators download their own.
  • Billed for what actually ran. A machine is charged from when it really started, and a mid-month price change applies from its date — not to the whole month.

Security & privacy

  • Full-disk encryption on machines with Secure Boot and TPM 2.0 — the key sealed in the machine’s own chip, tested against disk theft and boot tampering.
  • Remote wipe for lost or stolen machines; on an encrypted machine the disk keys are destroyed too.
  • Hidden Windows password — delivered securely, held in memory only, never shown or written to disk.
  • Optional certificate checking — with it on, an impostor Windows server gets no password.
  • Optional installation approval (on by default for new accounts) — a copied installer alone cannot join your fleet.
  • Per-account switches for USB storage, clipboard, password rules and memory hardening.
  • Everything encrypted, with recordings and screenshots in secure, private cloud storage.
  • Role-based access — people see and do only what you allow.
  • Full audit trail — every important action is logged.
  • Transparent monitoring — a clear on-screen recording badge (unless a policy allows silent operation).
  • Automatic clean-up — recordings and chats delete on the schedule you set.
  • Locked-down machines — no tampering, no unapproved software.
  • Signed, verified updates — only genuine updates are ever applied.
  • No inbound access needed — machines dial out, so nothing is exposed on your network.

Reliability

  • Self-healing — frozen sessions recover automatically, no power-cycling.
  • Smart reconnection through everyday network hiccups.
  • Freeze-proof audio and call-stability hardening for long, smooth sessions.
  • Automatic over-the-air updates keep every machine current, effortlessly.
  • Optional operating-system security patching, tried on canary machines first, then released to the rest.
  • A kernel update that fails to start rolls itself back to the previous one.
  • Set it and forget it — once running, machines just keep working.

Pricing

$45per machine / month

All-inclusive — no hidden fees

No separate charges for the dashboard, storage, updates, or support — one simple price, per machine.

Everything included

  • The secure operating system on every machine
  • The management application — on the web and as a mobile app
  • Live view, session recording, and secure cloud storage
  • Activity tracking and the audit log
  • Support chat and user management
  • Automatic updates and ongoing support

Solutions

See how it fits your industry

Exam proctoring, BPO desktops, healthcare clinics, retail branches, and 6 more — each with the specific problem it removes and how ThinClient OS fits.

Explore solutions by industry

Live

See it in action

This product is live in production — explore it for yourself.

Visit ThinClient OS + Fleet Manager

Work with us

Have a similar system to build?

Tell us the problem and the constraints. We will tell you how we would approach it — and whether we are the right team for it.

Contact usOur services

More work

Related projects

Our other devops & infrastructure projects.

Database Migration Platform — Data Platform
01 / Data Platform

Database Migration Platform

In development

Browser-operated any-to-any database migration on CDC

Esparks IT Solutions built a browser-operated data platform for planning, running, monitoring, and validating real-time migrations between heterogeneous databases. Five relational engines (SQL Server, PostgreSQL, MySQL, Oracle, Db2) migrate in either direction; MongoDB is supported as a CDC source. Its Java 21 and Spring Boot 3 control plane orchestrates jobs, while a React interface supports operation through the browser. For real-time CDC, the data plane uses Debezium, Kafka, and a JDBC sink, with PostgreSQL in the stack and deployment via Docker Compose or Kubernetes (Strimzi). The platform includes end-to-end integrity validation with drift detection, custom Java SMTs, AES-GCM secret encryption, Prometheus/Grafana, and JWT/RBAC security. SQL Server, PostgreSQL, MySQL and MongoDB migrations are live-verified end-to-end — including a production programme that moved roughly 960 million rows across 405 tables from SQL Server to PostgreSQL with zero rows missing at validation; Oracle and Db2 connectors are implemented and tested at the unit/config level, pending live verification.

  • ~960M rows migrated across 405 tables
  • 0 rows missing at validation
  • SQL Server → PostgreSQL, source stayed live
  • Java 21
  • Spring Boot 3
  • React
  • +4
CallIntell — AI Call Synopsis & Quality — AI Platform
02 / AI Platform

CallIntell — AI Call Synopsis & Quality

In development

Every call summarised into the CRM, without anyone listening

CallIntell turns recorded phone calls into reviewed, structured CRM records without anyone listening to the call. A six-stage queue-backed pipeline fetches the recording, transcribes it with speaker labels and word-level timestamps on serverless GPU, strips personal identifiers before any text reaches a language model, matches the call to its CRM record, and generates a schema-validated synopsis — outcome, commitments, objections, price discussed — with every point linked to the second of audio it came from. Spoken follow-up phrases such as “call me in ten days” are resolved into dated CRM tasks in the customer's own time zone, with the verbatim wording kept alongside. Anything the system is not confident about routes to a human review queue rather than being guessed, and CRM writes are idempotent so a retry cannot duplicate a note or a task. Built on Next.js, BullMQ on Redis, PostgreSQL with Drizzle, WhisperX with diarization, Microsoft Presidio redaction and Claude, with passkey and TOTP sign-in, an append-only audit log, per-company isolation and usage metering. Deployed and running the first customer workflow; not yet opened as a public product.

  • Speaker-labelled transcripts with word-level timestamps
  • Every synopsis point links to its moment in the audio
  • Idempotent CRM writes — retries cannot duplicate
  • Next.js
  • TypeScript
  • BullMQ
  • +5
Sparks Business — Inventory, Sales & GST Invoicing Platform — SaaS
03 / SaaS

Sparks Business — Inventory, Sales & GST Invoicing Platform

Live in production

Multi-tenant inventory, sales and GST-invoicing SaaS for Indian trading businesses

Sparks Business is a multi-tenant platform built by Esparks IT Solutions to run inventory, purchases, sales and GST invoicing from one system. It pairs a NestJS 11 API with an installable Next.js 15 PWA, backed by PostgreSQL 17 through Prisma 6 across 49 data models. Every query is scoped to its tenant through an AsyncLocalStorage-driven Prisma client extension, and an append-only audit table is enforced at the database level — even a direct update or delete against it is rejected by a trigger. GST math (CGST/SGST/IGST splitting, GSTIN validation) runs on decimal.js for exact, rounding-free results, and a real Tally XML importer lets a business bring in existing ledgers, vouchers and stock items instead of starting over. Redis and BullMQ handle background email and document generation, S3-compatible object storage holds product images, invoice PDFs and backups, and Microsoft Graph sends transactional email. Deploys are health-gated, so a broken build never reaches production.

  • 49 data models
  • Installable PWA
  • Health-gated CI/CD
  • NestJS 11
  • Next.js 15
  • React 19
  • +5