Portfolio

Confidential File Exchange Platform

A multi-brand parent organization in regulated sectors — handling medical records, financial data, and compliance filings — needed a secure document exchange platform that no off-the-shelf tool could provide: true brand data isolation where Brand A can never see, access, or discover Brand B’s files. Standard SharePoint configurations, shared drives, and email were creating unacceptable cross-brand data risk and zero audit capability.

We engineered a purpose-built solution combining Microsoft Power Pages with a React + TypeScript front end, serverless Azure Functions (C#) for security enforcement, Cosmos DB for centralized RBAC and metadata, and SharePoint Embedded as a headless file store — all orchestrated via Microsoft Graph API. Brand isolation is enforced at every architectural layer, every operation is audit-logged, and the platform is compliance-ready for healthcare and financial services from day one.

Portal & Front End

Power Pages + React + TypeScript (SPA)

Backend & Security

Azure Functions C# (Serverless Isolation Layer)

Storage & RBAC

SharePoint Embedded + Cosmos DB

File Operations

Microsoft Graph API (Upload, Download, Versioning)

The Challenge

No brand data isolation — SharePoint configs let Brand A access Brand B's regulated files.
No centralized RBAC — fragmented permissions, impossible to audit across brands & users.
Email distribution — insecure, untracked, no record of who received or accessed what.
No broadcast mechanism — parent shared to each brand manually, no central log.
SharePoint UI exposed — internal permission structures visible to end users.
No collaboration tools — comments, tags & version tracking scattered across external apps.
No audit log — file access, downloads & distributions unrecorded in regulated sectors.

Our Solution

React + TypeScript SPA in Power Pages : UI-level permission rendering — users see only their brand's files, zero SharePoint UI exposed.
Azure Functions — Serverless Security : Brand isolation and RBAC enforced server-side — cannot be bypassed at the front end.
SharePoint Embedded + Graph API : Headless file storage with enterprise versioning — no native SharePoint UI exposed to users.
Cosmos DB RBAC & Broadcast Distribution : Centralized permissions; parent broadcasts to all brands in one single logged operation.
Comments, Tags, Pins & Metadata : File collaboration features that make compliance infrastructure a daily productivity tool.
Tamper-Evident Audit Log : Every file event logged with user, timestamp, and brand context — exportable for compliance.

Business Impact

Zero cross-brand data exposure — isolation enforced by architecture
Centralized RBAC eliminates permission sprawl across all brands
Parent broadcasts to all brands in one controlled, logged operation
Every file event captured in a tamper-evident compliance audit log
Compliance-ready for healthcare, finance, and regulated industries
Comments, tags, and pins drive daily adoption across all brands

Client Testimonial

The platform gives us complete confidence in how sensitive documents are shared across brands. Data isolation is enforced by design, permissions are precise, and the added collaboration features have made the system both secure and practical for daily use. – Chief Information Officer