Solutions · Institutions & administration
A town hall or institution has a fixed list of mandatory sections, a transparency obligation in decision-making and a public officer who has to publish an announcement without calling a developer. We build exactly that, with an audit log that is deleted automatically on schedule and a limit on login attempts.
Already builtTwo proprietary platforms, public and verifiable today. The first is the official website of a commune town hall: Laravel 12 on PHP 8.2 with MySQL 8, 40 templates, 32 routes, 10 migrations, with editorial content that changes rarely kept in a single 1,613-line configuration file and the content that changes often stored in the database, editable from the panel; panel authentication is limited to 5 requests per minute, and the audit log is deleted daily after 12 months, with explicit reference to the legal basis. The security headers can be read from outside right now. The second is a civic platform in production, with 65 API routes, over 50 migrations, 103 server-side test files and 59 end-to-end scenarios, with accessibility checks in tests. What we do not mark as “delivered”: interoperability with state services — the federated authentication and e-signature code is written and tested, but turned off, because the contract with the authority and the system certificate are missing.
A public institution website is not judged by how it looks, but by a list. Government Decision 728/2023 sets out which sections must exist: decision-making transparency, projects and decisions, announcements, documents, contacts, budget. They are mandatory, checked and not negotiable. That is why we build them from the start, as structure, and do not add them at the end — added at the end, they become formal and useless, and that is immediately visible.
The second condition is more practical: the institution must be able to publish on its own. A tender notice, a decision draft put out for consultation, a photo from an event — if each one goes through a developer, information of public interest stays on paper or in a social network group, and the site becomes a dead display window. We intentionally separated two types of content: the editorial content that changes rarely — geography, history, institutions, contacts, budget — is kept in a single configuration file read directly by templates; the content that changes often is kept in the database and edited from the panel.
The third condition is the one nobody asks about in the specification: what happens to the data. A public administration panel needs a limit on login attempts — on the sixth request in one minute from the same address, the response is 429, and this is covered by an automated test, not assumed. The audit log contains IP addresses, so it is personal data: a scheduled task cleans it daily of anything older than twelve months, with the legal basis written in the code comment, not in a separate document that nobody opens.
And, finally, the part we prefer to talk about before the tender: interoperability with government services. Federated authentication and electronic signature are written and tested by us, but switched off by a toggle, because the contract with the authority and the system certificate are missing — the paper is missing, not the code. For the state payments platform, the interoperability bus and the citizen cabinet, we have no code at all, in any repository, and we state that as such.
What it covers
Decision-making transparency, projects and decisions, announcements, documents, contacts, budget, plus the accessibility statement, information on data processing, the open data section and the site map. Compliance with the government decision is written into the code — in templates and in configuration — not just stated in the offer.
What changes rarely — locality data, history, institutions, council composition, contacts, budget — is kept in a single 1,613-line configuration file, read directly by templates; what changes often — announcements, gallery, projects and decisions, documents, transparency settings — is kept in the database and edited from the panel. The separation is not aesthetic: it reduces to a minimum what someone can break through a wrong edit.
The panel covers exactly the operations carried out weekly in a town hall: a new announcement, a draft decision put out for consultation, a document uploaded, a few photographs. Every administration action is logged in an audit table — who, what, when — because in a public institution the question ‘who published this’ sooner or later has an answer that matters.
Five requests per minute from the same address for the authentication form; the sixth receives 429. This is not a setting we merely state: there is an automated test that checks the return of code 429 exactly. The difference between a configured measure and a tested one only becomes visible when someone changes a route and forgets about it.
On production they are read externally: frame blocking, `nosniff`, strict referrer policy, secure transport enforced for one year with subdomains, permission policy that closes geolocation, microphone and camera, plus an explicit content security policy. We check them with a request, not with a promise.
Audit logs contain IP addresses. A task runs daily and deletes everything older than twelve months, with the reference to the legal basis written in the code comment. It is the difference between a privacy policy that says ‘we keep it as long as necessary’ and a system in which the term is actually applied automatically.
In the civic platform, the checks run in automated tests against the WCAG 2.0 A and AA plus 2.1 A and AA criteria, with one baseline per page: any new issue stops delivery, even if the overall level has not changed. For a public institution accessibility is not an image option, and the accessibility statement is not written without something having run.
The home page publishes structured data of the government organisation type, with the postal address. It matters for how the institution appears in results and for systems that read automatically; it is also one of the few categories for which the engine documentation still shows the enriched result with frequently asked questions — but ‘well-known and authoritative’ is not a box we tick ourselves, so we do not sell it as a deliverable.
We do not state as delivered the link to the state payments platform, the interoperability backbone or the citizen portal: we do not have code for them in any repository. Federated authentication and electronic signature are written and tested, but turned off — the contract with the authority and the system certificate are missing. And hosting on state infrastructure, where it is mandatory, is a procedural requirement, not a technical option.
Traseul
The first deliverable is the list of mandatory sections for your type of institution and their correspondence with what you publish today. From this it becomes clear what is missing, what exists on paper and what is published in a place that cannot be cited. The design comes after the list, not before.
What changes rarely goes into configuration, what changes often goes into the database, with a panel. We deliver the structure populated with the institution’s real data — not placeholder text — because an institution website with provisional content cannot be assessed by anyone and usually remains that way.
The limit on the login form with a test that checks it, an audit log with scheduled deletion at the set term, security headers verified externally, the information page on data processing with the legal bases named. We deliver the verification results, not only the configuration.
We hand over the repository, the commissioning document and the accesses, plus training for the person who will publish the announcements. Delivery is not considered complete until an official has published, on their own, an announcement that appears on the site.
The data
The rules differ from one industry to another. These are the ones that apply in institutions & administration.
A case
The situation
The administration panel of a town hall website keeps an audit log: who published, what and when. The log contains IP addresses, so it contains personal data. Almost all sites of this kind solve the issue in a sentence from the privacy policy — “we keep data for as long as necessary” — and that is the end of it.
What we built
I wrote the term as a scheduled task: a routine runs daily and deletes from the log everything older than twelve months, with the reference to the legal basis written in the comment above the code. In the same stage I set the limit on the login form — five requests per minute from the same address — and an automated test that checks the return of code 429, so the measure does not disappear silently during a refactor.
What came out
The published policy and the system behaviour say the same thing, and the difference can be checked: the term is a line of code that runs every night, not an intention. The security headers are read from outside with a single request.
What the case does not say
Hosting, publishing artefacts and server configuration remain internal information. And the content — the locality data, the council composition, the budget — belongs to the institution and is provided by it: we built the structure and the panel, not the data.
Questions
The list comes from Government Decision 728/2023: decision-making transparency, projects and decisions, announcements, documents, contacts, budget, plus the accessibility pages and the information page on data processing. We build them as structure from the start. In the work we cite, compliance is written in code — in templates and in configuration — not only stated in the offer.
Yes, and that is half the work. Announcements, draft decisions, documents and the gallery are edited from the panel. What remains in configuration is content that changes rarely — history, geography, the council composition — precisely so that routine editing cannot break the structure.
Yes. Every administrative action goes into an audit table, with the actor, role, event type and moment. The log also contains the IP address, so it is personal data and has a term: everything older than twelve months is deleted daily.
On the sixth request in a minute from the same address, it receives 429. This is not a statement: an automated test checks this exact response code. In addition, the security headers in the real response can be read from outside — frame blocking, `nosniff`, the referrer policy, enforced secure transport and an explicit content policy.
The code is written and tested, but turned off with a switch, and the default test checks precisely that the disabled state does not leak anything. What is missing is not the code: what is missing is the contract with the authority and the system certificate. The version that works today is for the citizen to sign on the official portal and upload the signed document back. We prefer to say this before the tender, not after.
We do not have code for it in any repository — the same for the interoperability bus and for the citizen's cabinet. We checked this with a whole-word search across all our projects. When an institution needs them, it is an integration work with its own conditions and its own calendar of agreements, and that is how we write it in the offer.
Where it is mandatory by government decision, yes, and it is a procedural requirement, not a technical choice. We treat it as such from the start, because it changes the publication method and the list of necessary agreements, not just the server address.
With a check that runs in automated tests, against WCAG 2.0 A and AA plus 2.1 A and AA, with a baseline per page: any new issue stops delivery. The accessibility statement is written after the check runs, not before — otherwise it is a text that contradicts the page it sits on.
In the civic platform, the raw photograph remains private evidence; only the redacted version becomes public, with provenance preserved and with the explicit approval of a moderator, and the person who redacts is not the one who approves. If the status of an image becomes unsafe, the file is automatically withdrawn from public view. These are database constraints, not instructions for the operator.
Tell us about your process. Together we decide what is worth building, what we can connect, and how we check the result.