ActiveWork

• Per-tenant RLS on every table
• One-step staging and production deploys
• Versioned schema delivery

Problem

HR and payroll rules vary per customer, and one leaked row between tenants is a compliance incident. The product needed strict isolation without slowing feature work.

Approach

• Enforced tenant isolation with PostgreSQL Row-Level Security and tenant-resolution middleware
• Built JWT auth, RBAC and searchable field-level encryption for employee records
• Owned the pipeline from GitHub Actions to AWS, with Flyway migrations on every release

Tenant isolation

Every tenant shares one database, so isolation lives in PostgreSQL itself. Row-Level Security policies filter each table by tenant, and middleware resolves the tenant on every request before any query runs.

I designed this as the backend architect, so the same guarantee holds for the API, background jobs and real-time notifications.

1. Request
2. ↓→JWT auth
3. ↓→Tenant-resolution middleware
4. ↓→Row-Level Security policy
5. ↓→Tenant's rows only

ALTER TABLE leave_requests ENABLE ROW LEVEL SECURITY;

CREATE POLICY tenant_isolation ON leave_requests
  USING (tenant_id = current_setting('app.tenant_id')::uuid);

SELECT id, type, days, status
FROM leave_requests
WHERE employee_id = $1
ORDER BY filed_at DESC;

Leave management

• Accrual engine that grants leave on schedule
• Balance ledger so every change to a balance is recorded
• Philippine statutory leave rules built into the engine
• Multi-level approvals and year-end forecasting

Payroll outputs

• Overtime approval workflow with audit logging and optimistic UI
• Bank-file generation and payslip history
• BIR-2316 PDFs generated with PDFsharp

Reliability and real-time

Long-running and retryable work runs as Hangfire background jobs. Redis caches hot reads, and SignalR pushes notifications to users as approvals move through the workflow.

Security

Authentication uses JWT with role-based access control. Sensitive employee fields are encrypted at the field level while staying searchable.

Release pipeline

I own CI/CD end to end. GitHub Actions builds Docker images and pushes them to GHCR, then deploys to an on-prem Ubuntu staging host and to AWS EC2 for production. Flyway applies versioned migrations on each release.

1. GitHub Actions
2. ↓→Tests
3. ↓→Docker build
4. ↓→GHCR
5. ↓→Flyway migrate
6. ↓→Ubuntu staging
7. ↓→AWS EC2 production

Outcome

Tenants share one platform safely, and releases to staging and production became a routine, repeatable step.