System / 004
Consentio
Compliance management platform
Role
Full-Stack Engineering
Period
Dec 2022 – May 2023
Domains
1
Context
PROGSITS (Montreal)
Primary Outcome
Enterprise-grade backend with tamper-evident audit logging across 18+ regulatory frameworks.
Last updated 2026-08-11
01 / Context
Consentio is a Montreal-based compliance management platform that helps organizations manage data privacy and automate audits across 18+ regulatory frameworks — including GDPR, HIPAA, SOC 2, CCPA, Quebec Law 25, and ISO 27001 — serving startups through large multi-jurisdictional enterprises.
02 / Problem
Compliance platforms operate in a zero-error environment: they handle highly sensitive organizational data across multiple privacy jurisdictions and regulatory frameworks. The backend needed to enforce strict data handling, maintain complete audit trails, support multi-language workflows, and remain correct under constant regulatory scrutiny.
03 / Constraints
Regulatory frameworks (GDPR, HIPAA, SOC 2, CCPA, and others) impose hard requirements on data handling and auditability that aren't negotiable engineering trade-offs.
04 / Architecture
CLIENT | v API SERVICE | +--> AUDIT LOG (TAMPER-EVIDENT) | v MYSQL
05 / Engineering Decisions
Decision / 01
Every compliance-relevant action needs to be provably auditable after the fact, for regulators and internal review alike.
Chosen: Tamper-evident audit logging built as a first-class part of the write path, not a side effect.
Why: A compliance platform whose own audit trail can't be trusted defeats its purpose.
Trade-off: Extra write overhead on every state-changing action.
08 / Technology
BACKEND
Node.js, PHP
DATA
MySQL
SECURITY
Audit Logging, Access Control
07 / Contribution
My Contribution
- —Built and maintained backend services powering compliance workflows — assessment registers, audit trails, and remediation tracking
- —Implemented secure handling of sensitive regulatory data with strict access controls and data segregation
- —Developed Subject Access Request (SAR) automation and data-inventory discovery features
- —Ensured full auditability of compliance-related actions with tamper-evident logging
- —Built multi-framework support so organizations could track GDPR, HIPAA, SOC 2, and 15+ other regulations simultaneously
09 / Outcome
- —Trusted compliance backend supporting organizations across multiple jurisdictions
- —18+ privacy regulations tracked simultaneously
- —Automated SAR processing
10 / Lessons
- In a compliance system, the audit trail is a product feature, not an implementation detail — it shaped nearly every backend decision on this project.
- Data segregation requirements are easiest to satisfy when designed at the schema level from the start, not layered on with application-level checks later.