Build vs SaaS
Consider a case management SaaS first, build when workflows are distinctive.
Why. Small teams should not run software they can buy.
Trade-off. Less flexibility.
Industry patterns · Not-for-profit
Not-for-profit case management and reporting
Case notes, referrals and outcomes tracked securely by small teams, with funder reporting generated from the same data and strict access to sensitive client information.
A reference architecture from EITSAA, not a named client system. Service limits, prices and product features change, so confirm current details before you commit to a design.
- Australian Privacy Principles
- ACSC Essential Eight
- Funder reporting requirements
Architecture
- People and clients
- Databases and data
- Object and file storage
- Monitoring, audit and analytics
- Messaging, events and workflow
- Security and identity
- Request or data flow
- Asynchronous or optional
- Boundary: region, account, network or trust zone
Request and data flow
Case workers sign in with SSO and MFA, then see only clients and programs they are assigned to.
Case data is stored in PostgreSQL with row-level security by program and team.
Notes and documents are encrypted and linked to the case.
Managers use dashboards on de-identified data for caseload and outcomes.
A reporting layer strips direct identifiers and applies small-number suppression.
Funder exports or submissions are generated from the same data, checked and sent by the responsible person.
Reminders and appointment messages contain minimal detail.
Components and why they were chosen
| Component | What it does | Why this choice |
|---|---|---|
| Case management app (containers on ECS or App Runner) | Workflow and records. | Low operations effort for small teams. |
| Cognito with SSO | Staff authentication. | MFA and quick offboarding of volunteers. |
| RDS PostgreSQL with row-level security | Client records. | Access rules enforced in the database. |
| S3 with KMS | Notes and files. | Encrypted by default. |
| QuickSight or Power BI | Reporting. | Managers self-serve without exports. |
| De-identification layer | Funder and board data. | Reduces risk. |
| SES and SMS gateway | Communications. | Consent and minimal content. |
| Backup and retention policy | Records. | Obligations to clients and funders. |
Design decisions and trade-offs
Access
Row-level security by program.
Why. Sensitive client data.
Trade-off. Design effort.
Reporting
De-identified datasets with suppression.
Why. Prevents re-identification.
Trade-off. Less drill-down.
Volunteers
Time-limited accounts with narrow roles.
Why. Turnover risk.
Trade-off. Admin overhead.
Well-architected pillars
Security
Private networking, IAM Identity Center and Cognito with MFA, encryption with customer-managed keys, least-privilege roles and WAF on the public edge.
Reliability
Multi-AZ services, backups with tested restores and queue-based retries for integrations.
Performance
Edge caching for public content, asynchronous processing for anything slow and indexes tuned to the main queries.
Cost optimisation
Scale with demand, use reservations or savings plans for the steady baseline and set budgets and alerts per environment.
Operational excellence
Infrastructure as code, pipeline deployments with rollback, dashboards on service-level objectives and runbooks for the top failure modes.
Sustainability
Right-size, schedule down non-production and archive data to colder tiers on a retention schedule.
Network, identity and data
Networking
VPC with public, private and isolated data subnets and VPC endpoints. Public ingress only through the edge service with WAF. Private connectivity to on-premises or partner systems by VPN or dedicated link.
Identity and least privilege
SSO from the organisation's identity provider with MFA. Program-scoped roles. Volunteers on expiring accounts.
Data and encryption
Client information is often sensitive. Encrypt, restrict, minimise free-text notes, define retention and support access and correction requests.
Security and compliance mapping
| Control | How this design addresses it |
|---|---|
| Multi-factor authentication | Required for staff and administrators. Essential Eight. |
| Restrict administrative privileges | Just-in-time elevation and separate admin accounts. Essential Eight. |
| Regular backups | Automated backups with a copy held outside the workload account or subscription. Essential Eight. |
| Privacy and security of personal information | Encryption, access logging and retention support APP 11. |
| Logging | Central, tamper-resistant logs support ISM event logging guidance and ISMF expectations. |
Mappings show how the design supports each control. They are not certifications, and EITSAA does not claim IRAP assessment or compliance for any reference architecture.
Failure modes, targets and scaling
- Target RTOMinutes for zone failure; hours for a rebuild from code
- Target RPOSeconds to minutes with point-in-time recovery
- Scaling and limitsSized from measured peak demand with a load test before go-live. Check service quotas early.
| Failure mode | Mitigation |
|---|---|
| Staff leave with access | SSO deprovisioning and quarterly review. |
| Re-identification in reports | Suppress small counts. |
| Funder format changes | Isolated export layer. |
| Data loss | Backups and tested restore. |
Observability and runbooks
- Service-level objectives for availability and latency with burn-rate alerts.
- Audit log review for sensitive actions.
- Queue depth and integration error dashboards with a named owner.
Cost drivers and levers
Compute, database, data transfer and licences for any SaaS components.
- Reserve the baseline.
- Schedule non-production down.
- Cache and compress at the edge.
- Archive old data.
Implementation and fit
Phased approach
- Discovery: process, data and obligations mapped with the business owner.
- Foundation: landing zone, network, identity and pipeline.
- Thin slice: one journey end to end in production for a small group.
- Expand and harden: remaining journeys, load and penetration testing.
Anti-patterns to avoid
- Building before the decision rights and audit needs are agreed.
- A single shared admin role.
- Personal data in logs and test data.
- Integrations without retries or a dead-letter path.
When to use it
- Programs with sensitive client data and funder reporting.
- Teams outgrowing spreadsheets.
When not to
- Teams that can use an off-the-shelf product.
- Systems with no data owner.
More in industry patterns
Professional services
Professional services document intake and extraction
Clients upload documents, the platform classifies and extracts the key data, and a professional reviews the result before it reaches the practice system.
Retail and distribution
Retail order and inventory integration
Orders from web, marketplace and in-store channels flow to one order management layer, with inventory, fulfilment and accounting kept in step and a clear view of stock.
Utilities and field services
Field inspection and asset maintenance
Inspectors capture evidence on mobile devices, offline if needed. Findings flow to the asset register and generate work orders with a complete, timestamped evidence trail.
Related insights
Discuss this architecture
Tell us your systems, constraints and timeline. We reply within one business day, and the initial conversation is free.