IdeaBuild
ENPTESFR Home
For IT and IT leadership

What you are being asked to validate

Someone on the business side has seen the IdeaBuild homepage and wants to move. This page is for the people who have to say whether it is safe, whether it fits, and what it will cost IT to run. No marketing. Everything here links to a deeper technical note.

What it is

An open, containerised application foundation (.NET 10, React 18, PostgreSQL 16, Keycloak 24, Redis 7, Docker) plus two delivery services: AI-accelerated custom application engineering, and incremental migration off Oracle APEX, OutSystems and similar runtimes.

What it is not

Not a low-code platform, not a SaaS, not a runtime you licence. You receive source code, schemas and runbooks, deployed on your infrastructure or a sovereign cloud of your choice.

What you need to check

Security model, data residency, identity integration, migration risk, operability, and what happens on day two. Each has a section below and a line in the checklist at the end.

Two services on one open foundation

Service 1

AI-accelerated application delivery

Your domain experts describe how the business works. Our engineers use AI to synthesise C# services and React components on top of the pre-built foundation, verified against 1,200+ automated backend tests and 100+ end-to-end suites before anything reaches you.

Service 2

Legacy migration

Business rules buried in PL/SQL packages, APEX regions or OutSystems runtimes are extracted into clean C# services and React screens, cut over module by module with the legacy system running in parallel until parity is proven.

The foundation

The part you never build again

Both services start from the same audited stack: Nginx gateway, Keycloak identity, segregated transactional and audit databases, modular .NET APIs, React SPAs, full telemetry.

.NET 10 · React 18 · PostgreSQL 16 · Keycloak 24 · Redis 7 · Docker

AI writes code inside guardrails you can inspect

The question IT asks first: how do you stop the model inventing rules or seeing our data. The answer is structural, not a policy.

AI inside guardrails

Domain knowledge enters on the left. AI synthesis sits inside a yellow frame of four guardrails: executable specs, tests that must pass, pre-built audited modules, no production data. Verified C# and React exit on the right. Domainknowledge AI synthesis Executable specs from your experts 1,200+ tests must pass Pre-built audited modules No production data in VerifiedC# + React The model never sees credentials, production rows or secrets

Deterministic rule enforcement

AI output is constrained by executable specifications written with your domain experts. Business rules are verified by tests, not by trusting the model. No logic drift, no hallucinated rules in production.

Zero data exposure

Production databases, credentials and proprietary rules are never sent to external models or used for training. Synthesis works on schemas and specifications, not on your data.

Pre-tested building blocks

RBAC, audit, data grids, document pipelines, i18n and parameterisation are assembled from modules that already carry their own test suites.

Lifecycle

Week 1: architecture and domain blueprint with your experts. Weeks 2 to 4: AI-accelerated synthesis and verification. Week 5: containerised deployment to your environment with telemetry, runbooks and handover. AI Application Delivery Framework

Twelve capabilities you do not have to build

01

Identity & access (IAM)

Keycloak 24, OIDC/OAuth2 with PKCE, TOTP second factor, session control, admin-access audit.

02

Server-side RBAC

Every endpoint evaluates claims and policies on the server. UI hiding is never the security boundary.

03

Immutable audit

Pre- and post-mutation JSON state, user, IP and timestamp streamed via Redis Streams to a dedicated audit database.

04

High-volume data grids

Server-side sort, paginate and filter over millions of rows, saved views, XLSX export.

05

Natural-language search

Free text converted to validated column filters, constrained by the caller's permissions and index rules.

06

Rules & alert engine

Configurable conditions, email notifications, event triggers, execution history.

07

Centralised parameterisation

Settings, policies, third-party credentials and timezones managed in the backoffice, AES-256 encrypted, hot reload.

08

Document pipeline

Uploads bound to entities, MIME validation, zip-bomb and macro scanning, PDF rendering via Gotenberg.

09

White-label theming

Per-tenant logos, typography and colours at runtime, no redeploy.

10

Multilingual i18n

One catalogue for React views and .NET validation messages.

11

Observability

Prometheus, Grafana, Loki/Promtail, Seq with correlation IDs.

12

MCP audit facade

Read-only Model Context Protocol server for AI-assisted incident analysis, without database credentials.

Seven tiers, all containerised, all yours

Everything runs under Docker Compose on your hosts or a sovereign cloud. No component requires a licence. Full tier description in the migration methodology.

The seven tiers

Layered stack. Nginx ingress is the only public surface. Below a dashed line marked internal network: React frontends and Keycloak, five .NET services, then PostgreSQL main, PostgreSQL audit and Redis. A telemetry band runs down the right side. Public internet Tier 1 · Nginx ingress TLS, rate limits, CSP/HSTS, blocks admin ports only public surface Internal Docker network. Nothing below publishes a port. Tier 5 · React 18 frontends Public portal · Operational dashboard · Backoffice Tier 3 · Keycloak 24 OIDC, PKCE, TOTP Tier 4 · .NET 10 services api-auth · api-private · api-backoffice · api-audit · api-diag PostgreSQL main business entities PostgreSQL audit isolated, append-only Redis 7 cache, sessions, streams Tier 2 · Data and cache Tiers 6 to 7 Telemetry Prometheus Grafana Seq Loki Everything inside the dashed line is reachable only from other containers.
TierRole
1 · NginxOnly public entry point. TLS termination, rate limiting, CSP/HSTS headers, blocks admin and diagnostic ports.
2 · Datapostgres-main for business entities; postgres-audit isolated for compliance history; Redis for cache, sessions and audit event streams.
3 · IdentityKeycloak 24. OAuth2/PKCE, signed JWTs, TOTP enforcement; admin console on a private network only.
4 · Servicesapi-auth, api-private, api-backoffice, api-audit, api-diag
5 · FrontendsReact 18 + Vite. Public portal, operational dashboard, backoffice; shared component library.
6 to 7 · TelemetryPrometheus metrics from Nginx, Postgres and Redis exporters; Grafana; Seq structured logs; Loki/Promtail container logs.

What happens to a request

One request, end to end

Browser gets a token from Keycloak, calls through Nginx to a .NET service that checks RBAC, reads and writes PostgreSQL main. Every mutation emits an event to Redis Streams which the audit service stores in PostgreSQL audit, which application services cannot write. 1 · BrowserHTTPS, PKCE 2 · NginxTLS, rate limits 3 · .NET serviceJWT + RBAC check 4 · PostgreSQL maininternal network only Keycloaksigned JWT 5 · mutation event Redis Streamsuser, IP, before, after 6 · PostgreSQL auditconsumed by api-audit app services cannot write Every write leaves a before/after record in a store the application cannot alter.
  1. 1Browser authenticates with Keycloak over HTTPS using PKCE and receives a signed JWT.
  2. 2Every API call enters through Nginx, which terminates TLS, applies rate limits and security headers, and refuses anything aimed at internal ports.
  3. 3The target .NET service validates the token signature and evaluates RBAC policies on the server before touching data.
  4. 4Reads and writes go to postgres-main over the internal Docker network only.
  5. 5Every mutation publishes an event (user, IP, timestamp, previous and new state) to Redis Streams.
  6. 6api-audit consumes the stream and persists it in postgres-audit, a separate instance that application services cannot write to directly.

Zero-trust by construction

Authorisation on the server, always

Claims are evaluated per endpoint. Hidden buttons are a UX choice, never the control. This closes the BOLA and parameter-tampering class of issues common in departmental platforms.

Two databases, not one

Audit history lives in a separate PostgreSQL instance. Elevated privileges on the transactional database do not reach the audit trail.

Second factor enforced

TOTP (RFC 6238) on Keycloak, mandatory for administrative realms.

One door in

Nginx is the only published surface. Databases, Redis, Keycloak admin, diagnostics and MCP sockets are unreachable from outside.

Verified at every boot

Three automated checks halt deployment if violated: no-published-ports, production-blocks-tools, attachments-volume-not-served. Uploads never sit on a public path; downloads stream through authenticated APIs.

AI never sees production

No production data, credentials or rules are sent to external models. Keycloak OIDC and RBAC technical note

Plugging into what you already run

Identity
Existing directories federate into Keycloak without forcing password resets. SSO lets users move between legacy and new screens in one session.
APIs
Every capability is exposed through documented REST endpoints on the .NET services. Integration with ERPs, CRMs or data platforms goes through these, with the same RBAC.
Data synchronisation during migration
Change Data Capture via Redis Streams or Kafka keeps the legacy database and PostgreSQL mirrored with sub-second latency and dual-write in both directions.
Documents and exports
Office/HTML to PDF via Gotenberg, XLSX export from any grid, uploads bound to business entities.
Notifications
Email and event triggers from the rules engine.

Where your data lives and who can touch it

Residency
On your hardware or in the sovereign cloud region you choose. Nothing is hosted by IdeaBuild.
Isolation
Services reach databases only over the internal Docker network. No database port is published.
Audit
Every change is recoverable as before/after state, with actor and origin, in a store the application cannot overwrite.
Ownership
Schemas, migrations and data are yours from day one; there is no export step at the end of the contract.
External models
Not trained on, not queried with, your production data.

Five phases, no big bang

Each phase has a rollback point. The legacy system is never switched off before the replacement has proven itself in production. Legacy Migration Methodology · Low-code trap whitepaper

Strangler Fig: legacy shrinks, new grows

Five columns P1 to P5. In each, a grey legacy block shrinks and a yellow new block grows. Dual-write CDC spans phases two to four. Each phase has a rollback mark. At phase five legacy is zero and the licence ends. Legacy New dual-write / CDC rollbackrollbackrollbackrollback licence ends P1 Discovery P2 Replication P3 Identity P4 Services P5 Cutover
  1. P1

    Automated schema and rule discovery

    Static analysis of DDL, triggers, sequences and PL/SQL packages produces a map of buried logic and an executable test harness before any code changes.

  2. P2

    Parallel replication and dual-write

    PostgreSQL 16 provisioned alongside the legacy database; CDC keeps both in sync with no drift.

  3. P3

    Identity federation

    Existing users land in Keycloak; SSO across old and new screens.

  4. P4

    Modular service extraction

    Procedures and screen-bound workflows become C# services with server-side RBAC and audit, verified against the harness.

  5. P5

    Screen cutover and licence decommissioning

    Screens move to React one at a time; when telemetry shows parity, legacy connections are severed and the proprietary licence ends.

What we need from your side

Infrastructure
Docker-capable Linux hosts (on-prem or cloud) with capacity for PostgreSQL ×2, Redis, Keycloak, the API services and the frontends. Sizing is agreed in the assessment.
Network
One public ingress for Nginx; internal network for everything else; outbound SMTP for notifications.
Access for discovery
Read access to legacy schemas and code (DDL, packages, OutSystems exports) and to the identity source for federation.
People
Domain experts for the blueprint week (a few hours each); an IT owner for environments and access; a security contact for the review.
Time
Five weeks for a new application on the foundation. Migration length depends on the number of screens and rules found in phase 1 and is estimated after discovery.

Who does what

Grid of six areas by three parties: Business, IT, IdeaBuild. Yellow cells mean owns, outlined cells mean consulted, black cells mean delivers. AREA BUSINESS IT IDEABUILD Business rules and priorities Owns Consulted Captures, verifies Environments and hosting Owns Specifies, deploys Identity source and SSO Owns Integrates Security review and sign-off Owns Evidence, fixes Code, tests, runbooks Receives Delivers Day-two operation Owns Trains, supports Owns Consulted / receives Delivers Not involved

Oracle APEX vs OutSystems vs open foundation

DimensionOracle APEXOutSystemsIdeaBuild foundation
Runtime dependencyOracle Database engine (PL/SQL)Proprietary compiled runtimeOpen-source .NET 10 and PostgreSQL
LicensingDB CPU cores / cloud creditsPer user + per application tierNo licence fees; self-hosted
TalentNiche PL/SQL APEX specialistsCertified platform developersC#, React, SQL market
FlexibilityUI bound to database objectsHard limits on complex custom logicModular services, no ceiling
Code ownershipMetadata exports onlyObfuscated code on detachClean Git repositories, documented
AuditCustom bolt-onsCustom bolt-onsBuilt-in before/after state store

Ten things IT should check before saying yes

  1. 01Is authorisation enforced server-side on every endpoint?Security
  2. 02Can the audit trail be altered by someone with database privileges?Security
  3. 03Where does data live and who hosts it?Data
  4. 04Does it integrate with our identity provider without resetting passwords?Integration
  5. 05Is any production data sent to an external AI model?AI delivery
  6. 06What is exposed to the internet?Architecture
  7. 07Can we roll back at each migration phase?Migration
  8. 08What do we receive at handover and can our team maintain it?Responsibilities
  9. 09What does it cost to run on day two?Matrix
  10. 10Can we see it running before committing?Live console

Deeper reading

Technical session

Book a technical architecture session

Bring your security lead and whoever owns the legacy system. We walk through the architecture, open the repositories, and answer the checklist line by line.

contact@ideabuild.co
Mutual NDA before any discovery call