Flight Desk India · 2024
When State Law Meets Paper Filings, Something Has to Give
Flight Desk India had a vision, a customer base, and zero engineers. Six months later, they had a booking platform processing fares across two markets, four payment gateways, and one of the most volatile flight-API ecosystems online.
- Travel & Tourism
- Web Platform
- 7 min read
20%
Industry: Government, financial regulation
4
Users: Filers, organization admins, state examiners
2
Languages: English and Spanish
0
Filing steps digitized: 10
<800ms
Reporting cycles automated: 2 per year, per organization
The Build at a Glance
01
Industry
Government, financial regulation
02
Project type
Full-stack compliance and case management platform
03
Users
Lenders, servicers, organization admins, state regulatory staff
04
Languages
English, Spanish
05
Identity & access
State identity platform (Azure AD B2C, OIDC/PKCE) for filers;
Azure AD for staff
06
Deployment
AWS (EC2, Windows/IIS)
07
Core stack
React 19, .NET 8, PostgreSQL, SignalR, DevExpress XAF
Where the Old Process Broke Down
State law gives lenders and servicers five business days after a court filing to submit foreclosure petitions. Every reporting period, they also owe a compliance report. The old process ran on paper, email, and manual reconciliation.
Duplicate filings went unnoticed. Someone had to catch them by hand. Correspondence between filers and the regulator sat in inboxes, with no shared record.
For a regulator overseeing the whole state, that gap was a real risk. Filings got missed. Changes had no clear owner. No one had a single view of activity across every organization.
Eight Requirements That Don't Usually Coexist
- Audit trails with real legal weight: Every change to a filing needs a complete, attributable history for legal and compliance review.
- Hard data walls: Dozens of independent organizations share one platform. None can see another’s data.
- A live identity migration: Filers had to move to a new government identity system without losing their filing history.
- Real bilingual access: Full English-Spanish support, including content filers type in themselves, beyond static interface text.
- A complex workflow with duplicate risk: A ten-step legal filing process, with two filers able to submit on the same property without knowing it.
- Translation costs that can’t scale linearly: Translating every page through a paid API doesn’t hold up financially at real traffic.
- Real-time communication with a hard boundary: Filers and regulators needed live messaging, but filers could never message each other directly.
- Bounded self-service support: Filers needed on-demand help with the process itself, without the platform reading as legal advice.
What We Shipped
- Role-aware dashboard: Petition counts, compliance status, and recent activity, scoped to each user’s role, with text-size and high-contrast controls built in.
- Guided filing workflow: A ten-step guided intake flow with auto-save, digital signatures, and address-based duplicate detection with a takeover flow.
- Compliance reporting engine: Automatic calculation and validation of the twice-yearly compliance report, tracked by organization and period.
- Government identity integration: Sign-in through the state’s identity platform for filers and Azure AD for staff, with a multi-step matching flow that reconnects legacy accounts instead of losing filing history.
- Scoped AI assistant: A floating assistant that answers “how do I use this” questions on every screen, with a standing disclaimer against legal advice.
- Real-time messaging: Built on SignalR, with role-aware permissions: filers reach the regulator and their own org admin, never other filers.
- Bilingual by design: Static text translated at build time; user content translated on demand and cached by content hash, so repeat views cost nothing extra.
- Accessibility: Adjustable text size, high contrast mode, keyboard navigation, and ARIA labeling, built in from the start.
- Full audit trail: Column-level before/after history on every save, with soft deletes so nothing disappears from the record.
- Public self-service search: A no-login search by filing number or address, with PDF and CSV export.
Under the Hood
Frontend
React 19, TypeScript, Vite, React Router
Backend
ASP.NET Core (.NET 8), Entity Framework Core
Database
PostgreSQL
Real-time
SignalR
Identity
JWT, Azure AD, Azure AD B2C (OIDC/PKCE)
Admin portal
DevExpress XAF, Blazor Server
Cloud
AWS (EC2, S3, Secrets Manager)
Ops
SendGrid, Serilog, Datadog, Azure Pipelines
- One shared business logic layer runs both the public application and the internal admin portal, so a rule changes once, not twice.
- 16 REST controllers, 17 application services, and 25+ repositories on a generic base that handles create, read, update, and delete by default.
- Query safeguards against injection through sort parameters and performance issues on large joins.
- Security headers (HSTS, strict content policy, locked frame options) applied by default, not configured per feature.
- A custom retry layer keeps a browser tab working through a new deployment instead of breaking mid-session.
Locked Down by Design
- Separate identity paths for filers and internal staff, with tokens that never appear in the browser URL.
- Every query scoped by organization ID, blocking cross-tenant access at the data layer.
- All credentials held in AWS Secrets Manager, never in source or config files.
- Admin impersonation is fully audited and visibly flagged in the interface while active.
- Uploaded documents validated and stored in S3, not on application servers.
Table of Contents
Building something like this?
Skip the sales call. Get 30 minutes with an engineer who’s shipped it before.
Problems Worth Solving Properly
- Translation costs at scale: Hash-based caching on translated content, so an unchanged filing never triggers a second translation charge.
- Zero data loss on identity migration: A three-way identity match kept every filer connected to their filing history through the migration.
- Duplicate filings: Address normalization plus a takeover flow, so two unrelated filers never create conflicting records.
- Safe deployments: A retry layer clears stale cached files automatically, so a live deployment never breaks an open session.
- AI help without legal risk: An explicit scope and a standing disclaimer keep the assistant useful without reading as legal advice.
What Changed
- One system of record replaced paper, email, and spreadsheets for an entire state’s filing activity.
- The regulator gained a real-time, statewide view of filings and compliance status for the first time.
- Filer-to-regulator correspondence moved from untracked email into a logged, real-time channel.
- Duplicate and conflicting filings are now caught automatically, not discovered by hand.
- Spanish-speaking filers get full access without a translation bill that grows with traffic.
- The public gets transparent, no-login access to filing status, without exposing private data.
- Routine support requests dropped, with a clear line held against legal-advice liability.
Your Next Compliance Platform Starts Here
Ariel builds compliance platforms for regulated industries. Audit trails, data isolation, and identity work correctly from day one. We’ve done it for state regulators. We can do it for you.