Isgoo
Multi-Tenant Occupational Health & Safety (OHS) Enterprise SaaS
The Operational Problem
Context & Domain
Workplace safety legislation mandates meticulous audit trails, strict retention of inspection photo evidence, and timely renewal of personnel training certificates. Historically, safety firms relied on fragmented spreadsheets, lost physical folders, and insecure file shares that risked severe legal liability during state audits.
Overview
Enterprise OHS platforms must support thousands of separate corporate client workspaces under a single infrastructure while ensuring absolute cryptographic data isolation between competing companies. Furthermore, inspections generate high volumes of high-resolution hazard photographs and stamped documents that overwhelm traditional relational databases.
System Architecture
Engineered a secure multi-tenant architecture on ASP.NET Core paired with PostgreSQL schema separation, clustered Redis for session and permission caching, MinIO for on-premise S3-compatible encrypted object storage, and a responsive React client built with Vite and Tailwind.
┌─────────────────────────────────────────────────────────────────────────────┐
│ WEB CLIENT SPA TIER │
│ │
│ ┌─────────────────────────────────────────────────────────────────────┐ │
│ │ React 18 SPA (Vite / Tailwind CSS / TanStack Query) │ │
│ │ - Dynamic Tenant Branding & Dynamic Risk Assessment Forms │ │
│ │ - Direct-to-MinIO Chunked Photo Upload Pipeline │ │
│ └──────────────────────────────────┬──────────────────────────────────┘ │
└──────────────────────────────────────┼──────────────────────────────────────┘
│ HTTPS / Bearer Token + Tenant Header
▼
┌─────────────────────────────────────────────────────────────────────────────┐
│ ASP.NET CORE MULTI-TENANT API │
│ │
│ ┌─────────────────────────────────────────────────────────────────────┐ │
│ │ Tenant Resolution Middleware (Subdomain & JWT Claim Evaluation) │ │
│ │ ├── Fine-Grained Role-Based Access Control (RBAC) │ │
│ │ ├── Risk Matrix Calculation Engine (Fine-Kinney, L-Type Matrix) │ │
│ │ └── Audit Trail Event Interceptor (Immutable Compliance Records) │ │
│ └───────────────────┬───────────────────────────────┬─────────────────┘ │
└───────────────────────┼───────────────────────────────┼─────────────────────┘
│ │
Cached Queries ▼ Document Streams ▼
┌──────────────────────────────┐ ┌────────────────────────────────────────┐
│ REDIS DISTRIBUTED CACHE │ │ MINIO S3 OBJECT STORAGE VAULT │
│ - Tenant Permission Cache │ │ - Inspection Hazard Photos │
│ - Session & Throttling Keys │ │ - Signed PDF Certification Archives │
│ - < 5ms Fast Path │ │ - Presigned URL Direct Uploads │
└──────────────────────────────┘ └────────────────────────────────────────┘
│
▼ Relational Transactional Data
┌─────────────────────────────────────────────────────────────────────────────┐
│ POSTGRESQL MULTI-TENANT STORE │
│ │
│ ┌─────────────────────────────────────────────────────────────────────┐ │
│ │ PostgreSQL Enterprise Relational Database │ │
│ │ - Tenant-Scoped Query Filters & Discriminator Columns │ │
│ │ - Full Audit History Table Partitions │ │
│ │ - Automated Regulatory Inspection Deadline Triggers │ │
│ └─────────────────────────────────────────────────────────────────────┘ │
└─────────────────────────────────────────────────────────────────────────────┘Responsive React portal for safety auditors, dynamic risk calculators, and real-time report previewers
Resolves tenant context, enforces isolation rules, coordinates compliance workflows, and verifies JWT tokens
Maintains high-speed permission caches and rate limits across active tenants to bypass relational queries
Stores tamper-evident workplace hazard images, PDF audit certificates, and employee health records
Engineering Decisions
MinIO S3-Compatible Storage for Hazard Media
Storing gigabytes of high-resolution hazard photographs directly inside PostgreSQL BLOB columns rapidly bloats database backups and slows down query indexing.
Decoupled media storage into MinIO S3 object buckets with presigned upload URLs, reducing database footprint by 80% while retaining full on-premise data sovereignty.
Tenant Resolution Middleware with Scoped EF Core Filters
Human error in developer queries could lead to catastrophic data leaks between competing enterprise tenants.
Implemented automated global query filters in Entity Framework Core tied to the resolved HTTP tenant context, guaranteeing that no query executes without tenant isolation.
Redis Cache for Permissions and Fast Regulatory Lookups
Complex role hierarchies (safety specialist, workplace doctor, employer representative) required repeated permission checks on every API request.
Cached parsed user authorization claims in Redis with invalidation hooks on role updates, reducing database authorization roundtrips to zero.
Technical Challenges & Solutions
Large Photo Uploads Over Constrained Cellular Networks
Safety inspectors on construction sites uploading 10–20 high-res hazard photos experienced request timeouts when posting directly to application servers.
Architected presigned S3 URL direct uploads directly to MinIO with client-side image compression prior to dispatch, bypassing the web API server thread pool entirely.
Dynamic Risk Formula Calculations
Different industrial sectors require varying mathematical matrices (5x5 Probability/Severity vs. Fine-Kinney frequency-based algorithms).
Engineered a pluggable strategy pattern calculator in the domain layer that dynamically evaluates risk scores and suggests mitigation timelines according to labor ministry statutory codes.
Technology Stack
- • ASP.NET Core 8
- • C#
- • EF Core
- • MediatR
- • React 18
- • Vite
- • Tailwind CSS
- • TanStack Query
- • PostgreSQL
- • MinIO S3-Compatible Object Store
- • Redis Distributed Cache
- • Docker
- • Docker Compose
- • Linux Ubuntu
Key Implementation Highlights
- Presigned S3 upload signatures allowing client browser uploads directly to MinIO without loading API server RAM
- Automated statutory audit scheduling engine generating warning alerts 30, 15, and 7 days prior to compliance expiration
- Export engine rendering legally compliant, cryptographically stamped inspection PDFs with embedded evidence matrices
Production Screenshots & System Interface
High-resolution interface evidence, operational telemetry cockpits, and field runtime screens.
Isgoo Enterprise OHS Platform (Live Production)
Production interface showing enterprise workplace safety inspections, hazard tracking, and compliance certification workflows.
Multi-Tenant OHS Compliance Portal & Risk Matrix
Fine-Kinney statutory risk scoring, direct-to-MinIO encrypted document uploads, and < 3.2ms Redis RBAC verification.
Results & Current State
Serving certified OHS consultancies and enterprise manufacturing facilities, tracking regulatory inspection compliance across thousands of registered workers.
Key Architectural Takeaways
- 01.Multi-tenancy security must be enforced by automated architectural barriers, never developer discipline alone.
- 02.Separating relational metadata from heavy file objects is mandatory for maintainable enterprise database scaling.
- 03.Enterprise compliance software thrives when complex statutory formulas are translated into intuitive, foolproof workflows.