Education
21,777 programmes. Five interfaces. One platform.
A fragmented consultancy workflow became one connected platform for students, consultants, teachers, and administrators, backed by 21,777 searchable programmes.
- 21,777
- Programmes indexed
- 445
- Universities
- 5
- Interfaces
- 1 command
- Rollback time
The starting point
GradGermany advised students by hand, over email and spreadsheets. Programme data for 445 German universities lived in scattered files, consultants had no shared view of an applicant, and every enquiry outside office hours went unanswered until the next morning.
They needed one system that served five different audiences without becoming five different products.
Inside the build
One Laravel application serving four audiences, built so that security, content operations and automation are properties of the system rather than tools bolted on beside it.
A person is one record with one password and one audit trail, while each audience gets its own session and its own authorisation surface. Access is scoped in the query rather than the interface, so a consultant's own applicants are the only rows that exist for them - editing a URL returns nothing rather than something merely hidden.
What changed
The platform runs 24/7 behind Cloudflare Zero Trust with no inbound ports open on the origin. Enquiries arriving outside office hours are answered immediately instead of the next working day, and every applicant has one record that consultants, admins and the student all see.
Deploys that used to be a manual sequence are now a push to the main branch, and the security review that followed found no exposed services.
Architecture
-
Four guards, one identity
Students, consultants, teachers and admins share one user table but hold separate sessions and permissions.
-
Scoped in the query
A consultant sees only their own applicants, because the others are never selected - not merely hidden.
-
Meilisearch programme search
Indexed the way students phrase a subject, not the way a schema is shaped.
Security
-
Intrusion detection
Probes, failed logins, lockouts and privileged sign-ins recorded and alerted, under a ceiling so a scan cannot become the outage.
-
Two-factor on every admin
No administrative account reaches the panel on a password alone.
-
No inbound ports
The tunnel dials out from inside. A port scan finds nothing, because nothing is listening.
-
IP allowlist and Zero Trust
Reaching the admin login is itself an authenticated act.
-
Retention that runs
Consent, email, sign-in and activity logs each expire on their own schedule - with a heartbeat, so a sweep that stops is noticed.
In the back office
-
Email client
Inbound mail fetched, threaded and answered inside the panel, beside the applicant it concerns.
-
Carousel and reel composer
Social posts built and scheduled in the same system that holds the data they talk about.
-
AI where it saves hours
Drafting statements of purpose, reviewing CVs, evaluating profiles, generating content and pitches.
-
WhatsApp assistant
Answers first contact at any hour, captures the lead, hands to a human on request.
Operations
-
One supervised container
Web server, queue worker and mail poller running together, restarted independently.
-
Rollback in one command
One image per commit, tagged by SHA. Recovery re-points a tag rather than rebuilding.
-
Deploy from main
A push builds, tests and ships behind a manual button - no manual sequence to misremember.
The platform gave every part of the business one place to work. Even deployment became simple: we can ship confidently and roll back in one command.
More proof
