Armakuni Contact us
← All case studies

Deleting the scan doesn't close the record.
Shredding the paper does.

A U.S. payments and prepaid company handled regulated customer documents through email, fax, encrypted upload and scanned paper, with nothing tying them together. In 12 to 16 weeks we built a platform on AWS that records what arrived, who handled it and when it can be destroyed, with GLBA and HIPAA rules enforced by the system rather than by memory.

Before

Documents came in through four channels, but none of them could be found again afterward.

The compliance rules existed in policy, but enforcement depended on people remembering to apply them.

After
4 → 1intake channels into one governed system
4role groups, enforced at every layer
Everydocument action logged in an audit trail

Documents came in through four channels, but none of them could be found again afterward

The company's customer-success team handles documents that carry real obligations: identity records for know-your-customer (KYC) and know-your-business (KYB) checks, health and flexible spending account (HSA/FSA) claims, account transfers, beneficiary designations and employer onboarding. They arrived by encrypted email, by fax, by direct upload and as scanned paper.

None of those channels fed one place. Documents lived in inboxes, fax archives and file shares, and finding one meant someone remembering where it went. When a document related to an open support ticket, the link existed only in the head of whoever had processed it.

The compliance rules existed in policy, but enforcement depended on people remembering to apply them

The company operates under GLBA and HIPAA obligations for retention, access and secure deletion. Nothing in the old setup enforced a retention schedule, produced an audit trail or flagged a deadline. Account management, customer support, operations and engineering each needed different access, and those boundaries were kept by policy rather than by the system.

The system was rebuilt to enforce the rules itself

We moved compliance out of people's hands and into the platform, so each document gets one intake and one record from the moment it arrives, access is decided by role, retention runs by the clock, and the lifecycle can't be closed early.

How we built it

3 decisions, in the order we made them. Each one says what we did and why, with what it did drawn beside it.

  1. Every channel produces an ID and an audit record
  2. Access runs through four role groups, enforced at every layer
  3. Retention stays open until the paper original is confirmed destroyed

Every channel produces an ID and an audit record

Built withS3
EmailFaxUploadScanned paper ID + audit
The engineering

Each intake channel needed its own connection, but they all had to end in the same place:

  • Virtru and Nextiva integrations collect encrypted email attachments and fax documents. A scheduled integration retrieves scanned PDFs from the existing Microsoft repository every day, and users can upload directly.
  • Each incoming document receives a unique identifier and enters encrypted S3 storage (AES-256).
  • Operations staff classify records through a structured interface. Account type decides the available document taxonomy, so an HSA account shows HSA document classes, with bulk tagging for batches and automatic file naming.
  • Member ID, account-holder information, document class and receipt date become searchable metadata, and staff can link a document to its Zendesk ticket while tagging it, so the case relationship lives in the system.
  • Configurable inactivity rules send a notification when a document sits in a pending state past its threshold, so a missed SLA shows up before it becomes a compliance issue.

Access runs through four role groups, enforced at every layer

Every layer Account ManagementCustomer SupportOperationsEngineering four role groups
The engineering

Microsoft Azure Active Directory supplies single sign-on (SSO). Four role groups (Account Management, Customer Support, Operations and Engineering) have permissions covering the records and actions each can reach, and inactive sessions expire and require re-authentication.

Authorized users search and view documents inside the application, in a secure viewer. Reception, tagging, viewing, downloads, edits and deletion all add to each document's audit history, so a compliance officer can produce the complete history of any file.

Retention stays open until the paper original is confirmed destroyed

Built withReactNode.jsEC2PostgreSQLCloudFrontRoute 53
A recordThe scan deletedThe paper shredded only then does it close
The engineering

The retention logic accounts for the fact that a document often exists twice, once as a scan and once as the paper it came from. Retention rules follow the document's classification. Scheduled jobs find records approaching their deadline and put them up for review. Electronic destruction is recorded with evidence, and paper records stay open until shredding is confirmed, because deleting the digital copy can't close the lifecycle while the paper original is still waiting to be destroyed.

An auditor wants to know when every copy, paper included, was destroyed.

The React and Node.js application runs on EC2 with a PostgreSQL data layer, distributed through CloudFront with DNS on Route 53. WAF protects the entry point, GuardDuty, Security Hub and CloudWatch handle threat monitoring and operations, and CodePipeline and CodeBuild provide the release pipeline.

One document, end to end

  1. Take a trustee-transfer form, for example, arriving by fax. The Nextiva integration pulls it in.
  2. It gets its unique ID and goes into encrypted S3. The audit trail starts.
  3. An operations specialist tags it: the account is an HSA, so HSA document classes appear. They add the Member ID and link the Zendesk ticket.
  4. A customer-support colleague finds it by Member ID, opens it in the viewer, and the view is logged.
  5. Its retention deadline approaches. A scheduled job puts it up for review.
  6. The scan is destroyed, with evidence, but the record stays open until the paper original is confirmed shredded. Then the lifecycle closes.

What we'd tell another CTO

1Give a document its identity at the door, since everything later depends on it, and let the account type drive the taxonomy so staff only see the classes that apply. Link documents to cases inside the system as well, because what people remember leaves when they do.
2Model the physical copy. Retention isn't finished until every copy is gone, and an auditor will also ask who looked, so log reads as well as writes.

What else changed

  • Records can be searched by Member ID, account holder, document type and receipt date, and linked to support tickets.
  • Retention is enforced on schedule, with proof of destruction and a paper rule that keeps the record honest.
  • The first release, covering intake, manual classification, access and retention controls, delivered in 12 to 16 weeks.

What comes next

The proposed second phase covers intelligent document processing that classifies and extracts documents automatically with a reviewer in the loop, lifecycle management that archives or deletes records on its own, e-signature built into the platform, manual and automatic redaction of details such as Social Security numbers before anything is shared, and secure external sharing through links that expire by time, access count or first download.

How we'd do it today

This project came before our current offers. Here's how we'd approach the same work now.

For the AI classification in the proposed phase, every document the operations team has already classified would become a test case, and an AI classifier would have to match them, plus a sealed set nobody tunes to, before it tags anything live. A wrong class moves a retention date, so it would count as a critical case that must pass on every run.

The classifying AI agent would get its own identity and only the tools its job needs: it could suggest a class and fill metadata, and it couldn't delete, share or change a retention date, which stay with people and the scheduled rules. The GLBA and HIPAA evidence would come from the controls as they run, from a data-flow map approved before any data moves, and AK Run would own each security finding until a tested fix is live.

Modernize with AI AI-Native Managed Services AK AI Factory

More work like this

  1. Build~25%A cross-platform consumer email servicelower operating cost, as reportedA paid email app was competing with free ones. It needed reasons to stay, and a cheaper engine to run.~2× faster incident response13M+ messages synced a dayOn AWS S3 · EKS · RDS · DynamoDB
  2. Build60–80%A U.S. field-service platformless time on task management, as reportedThe technician finished the job by lunchtime. The office had the report days later.80% fewer communication errors99.9% availability at production loadOn AWS ECS · Lambda · SQS · SNS
  3. Build45%A global automotive logistics companymore vehicles delivered on time, as reportedDealers stopped calling to ask where their vehicles were. They look them up by VIN instead.15% lower shipping costs40% more data capacityOn AWS DynamoDB · Lambda · SNS · S3

All case studies →

Have a problem like this one?

A free workshop: a few hours with the architects who'd do the work, on your own systems. No cost.

Book a free workshop