Transparency portals and internal systems for organisations that answer to an auditor.
Transparency portals — portale trasparenza under Legislative Decree 33/2013 — access logging, roles with an audit trail and single sign-on against the directory you already run, and a way to replace the legacy system underneath without a cutover weekend.
Transparency portal
For Italian public bodies, this is not a feature. It is a legal obligation.
Legislative Decree 33/2013 requires public administrations, publicly-owned companies and concessionaires to publish a defined set of documents and data in a dedicated, publicly accessible section. The obligation is yours, and your legal and compliance functions decide what goes in it. Our part is the system that puts it there.
- Published from the source, not copied
- In the platform we build and run, documents are served straight from SharePoint through the Microsoft Graph API. The public section reads the same files the organisation already manages, so publication is not a second manual step somebody can forget.
- Findable by a member of the public
- Guided search by organisation, category and site. A citizen or a journalist looking for one document does not have to guess how the internal folder tree is organised.
- Same codebase as the internal side
- The public portal and the internal modules share one application, one deployment path and one test suite. There is no separate little website that quietly falls behind.
What gets published stays a decision for your legal and compliance functions. We build and maintain the portal that publishes it, and we tell you exactly what it does.
We are an independent engineering team, not a Microsoft reseller or certified partner. Where the platform reads SharePoint, Entra ID or Active Directory it goes through their documented APIs, on the licences you already hold, with credentials your administrators issue and can revoke.
What we usually find
The controls exist. They live in people's habits.
Nothing here is negligence. It is what happens when a system that was right ten years ago keeps being asked for one more exception.
- The obligation depends on one person
- The documents that have to be public are copied into place by hand by whoever knows the folder. When they are away, publication waits.
- Nobody can reconstruct who entered
- Reception keeps a paper book, the badge system keeps its own log, and neither can answer "who was in the building that afternoon" without an afternoon of work.
- Permissions grew by exception
- Roles were sensible at launch. Three reorganisations later, access is a set of individual exceptions nobody dares to clean up because nothing records why they were granted.
- The legacy system cannot be switched off
- It is unsupported, its tests cover the framework skeleton and nothing else, and it is load-bearing. Every quote you get proposes a rewrite with a cutover weekend, and every cutover weekend is refused.
01
02
03
04
What we build
One platform, twenty modules, one audit trail
This is the shape of the workplace platform we build and run today, on Laravel and Filament.
- Transparency portal
- A public section served from the document source your organisation already uses — in the platform we run, SharePoint through the Microsoft Graph API — with guided search by organisation, category and site, so the public side stays in step with the internal one without a manual copy.
- Visitor register and access logs
- Pre-registration, OTP and keypad codes at the entrance, tracked employee entry, and audit events on every access. Reception works from a kiosk instead of a book.
- Identity and roles
- Single sign-on against Microsoft Entra ID and Active Directory / LDAP, local login kept alongside it, role-based access with governance and a full audit trail, including explicit local overrides of a role.
- Workplace resources
- Desk and parking booking across a multi-storey structure, meeting rooms with room displays, and a company fleet with an electric pool — the resources people actually queue for.
- Internal mail and documents
- Registered internal mail with sequential numbering, couriers, attachments and reminders, plus a document catalogue. The paper trail becomes a query.
- Two languages, tested
- Italian and English throughout, with localisation covered by tests. Twenty admin modules and over a hundred test files run in CI on every push.
Name the module that is holding the rest hostage.
You get back where we would start, what has to move first, and what can stay where it is.
Replacing the legacy system
Module by module, with the old system still running
We replaced a Yii 2 application on a PHP 5.6-era stack this way. It is the point that needs the most evidence, because every previous quote came with a cutover weekend attached. This approach does not have one.
Read the system that exists
Modules, data model, integrations, and which permissions are real versus documented. The output is a written order of replacement, not a rewrite proposal.
Rebuild one module
The narrowest module that stands alone, with its own tests from the first commit. Small enough that being wrong about it costs a week, not a year.
Run both, then cut over
The new module runs alongside the old one and takes over only once the data reconciles. The legacy system stays in production the entire time.
Carry the roles across
Roles and assignments are backfilled from the old system rather than re-entered, so a cutover does not become a provisioning project for the IT team.
Repeat until nothing calls the old one
The legacy application goes dark when the last module stops depending on it — a consequence, not a date somebody has to defend.
Questions we get
Before you send anything
Is the transparency portal really a legal obligation, or a nice-to-have?
For Italian public administrations, publicly-owned companies and concessionaires it is an obligation, not a nice-to-have. Legislative Decree 33/2013 requires them to publish a defined set of documents and data in a dedicated, publicly accessible section. We are engineers, not compliance advisors: your legal and compliance functions decide what has to be published and for how long. What we did was build the portal that publishes it, serving documents straight from SharePoint through the Microsoft Graph API with guided search by organisation, category and site.
Can you replace a legacy system without stopping the operation?
That is how we did it. The system we replaced was a Yii 2 application on a PHP 5.6-era stack, and it stayed in production the whole time. We moved it module by module: one module rebuilt, tested, run alongside the old one, then cut over, with roles backfilled from the old system so nobody had to be re-provisioned by hand. There is no single switch-off date to negotiate, which is the part that usually blocks these projects.
Which identity systems can it authenticate against?
Single sign-on against Microsoft Entra ID and against Active Directory / LDAP, with local login coexisting rather than replaced — external staff, kiosks and reception desks usually cannot live in the corporate directory, and an internal system that assumes everyone can is unusable in practice.
How are roles and permissions handled when an auditor asks?
Role-based access control with a governance layer: roles and their permissions are defined in one place, local overrides are explicit rather than implicit, and changes emit audit events. Access itself is logged too — visitor check-in and employee entry both record who came in, when, and against which credential.
What does "internal system" actually cover here?
On the platform we build and run today: a public transparency portal, a visitor register with OTP and keypad codes, tracked employee entry with access logs, desk and parking booking across a multi-storey structure, a company fleet including an electric pool, internal mail with sequential numbering, couriers, attachments and reminders, meeting rooms with room displays, a reception kiosk, and a document catalogue. Twenty admin modules on one codebase.
Does it work in more than one language?
Italian and English are native, not an afterthought: every module ships translated, and localisation has its own tests so a missing string fails the build instead of surfacing in front of a visitor.
Who owns the system once it is live?
You do: the code, the repository, the infrastructure definitions and the documentation. We can keep operating it, hand it over with a walkthrough, or both in sequence. Nothing is locked behind an account only we can access.
Related: integrations & API when the internal system has to talk to something else, and case studies for the situations we get called in for.
Get in touch
Describe your internal system.
Which modules exist, what the auditor asks for, and what the legacy system still holds.
- Locations
- Italy · Czechia · Japan