Organizations, employees and the org chart
Departments, job groups, positions and reporting lines. The hierarchy is what lets the app resolve N+1, N+2 and A+1 signers without anyone looking them up.
named client case · occupational safety
SSM Connect: Mihai wanted the paperwork simplified. I built the platform.
Every Romanian employer has to keep occupational health and safety (SSM) and emergency (SU) records: training sheets, instructions, who was trained by whom and who signed. SSM Connect turns that into a digital file. Set up the organization once, pick a template, and the app generates the documents, works out the signers and collects the signatures.
Mihai runs operations and the client side, Mișu is the SSM expert who sets the rules, and I own the technology. A team of three.
the original condition
The data lived in five places and the signers lived in someone's head.
Organizations, employees, roles, superiors, instructions and training sheets were scattered across spreadsheets and paper. Preparing a document meant retyping data that already existed, and deciding who had to sign depended on one person knowing the org chart. The first version of the product had grown too many technical layers before its main flows reached the screen, so V2 was written as a simpler, single-platform specification and built from that.
what I built
From organization data to the signed document, in one path.
Configure the organization, add the employees and the hierarchy, choose a template, generate, resolve the signers automatically, send to signature, keep the final document in the file.
Template builder
Training sheets built in the app as ordered, typed sections with a preview and a sample PDF. Five starter templates: individual sheet, collective sheet, topic, internal instruction and training register. DOCX upload remains available.
Trainings and verification tests
A manager assigns a training to one or more employees. The employee reads the material, takes the test if the topic requires one, and the sheet is generated and sent for signature. Due dates are computed and daily reminders go out.
Signatures
A simple electronic signature inside the app: signers sign in order from a To sign list, the final PDF carries the signature stamps and an evidence page. External providers plug in through the same interface.
The file, search and inspection export
Generated documents are archived automatically, searchable across the organization, and exportable as a ZIP with a manifest for a labor inspection.
Invitations without email
Employees without an email address are invited by SMS with a six-digit code, or by a login handed over by the administrator.
by the numbers
The figures come from the project's own repository.
- automated tests
- 981
- At the August handoff, with every gate green on every merge. Data-layer tests run against a real in-memory MongoDB replica set.
- architecture decisions
- 17
- Written and superseded in order, from per-tenant stacks to the shared multi-organization platform of V2.
- fixed roles
- 7
- Super-admin to visitor, each with a capability matrix enforced server-side. The UI hides; the server decides.
- to configure a new organization
- < 30 min
- The V2 target for an organization ready to generate its first sheet, when its data is available. A target, not a measured result.
how it was built
Documentation first, then the code that implements it.
Write the product before building it
A legal register of verified sources, a glossary of Romanian domain terms, a PRD, module specifications and a requirements traceability table. Code implements the documents, not the reverse.
Build the foundation
From 2 August: the monorepo, quality gates, typed configuration, repositories with optimistic concurrency, an audit hash chain, field-level encryption of personal identifiers and a job queue. Deployed to Frankfurt with a working sign-in.
Simplify to V2
One platform hosting every organization instead of one deployment per client. The review meeting of 16 October and the product owner's decisions of 23 October extended the scope: builder, tests, in-app trainings, in-app signature.
Deliver and verify in the browser
On 24 October the full flow was walked through in the browser on the test instance: build a template, approve it, assign a training, pass the test, generate the sheet, sign it in order, find it in the file, export the ZIP.
the stack
What it runs on, and why.
Next.js, TypeScript, MongoDB
App Router as the full-stack boundary, one database with logical isolation by organization, server-side authorization on every operation.
Security by design
MFA for admins, re-authentication with a recorded reason for privileged actions, personal identifiers encrypted at the field level and searched through a blind index, a tamper-evident audit chain, no sensitive values in logs.
Vercel in Frankfurt, Resend, AWS for files
EU region by decision. Email through Resend. S3 with antivirus scanning for uploaded instructions and templates.
what this case does not claim
Named work, without invented performance theater.
- SSM Connect supports SSM and SU processes. It does not guarantee legal compliance, and the product says so.
- No client count or usage figure is published. The platform runs on a test instance while the SSM expert signs off the starter templates and the data-processing agreements are completed.
- The in-app signature is a simple electronic signature. It is never described as advanced, qualified or equivalent to a handwritten one.
- Medical files, diagnoses and clinical results are not stored. Only the fitness sheet and its permitted summary fields.
Mihai did not have to become a developer to ship a software product. Neither do you.
Tell me what your company runs on and who is holding it together today. In 30 minutes I'll tell you what it takes for me to own it.