AugustaUtilities
Compliance Center
Compatibility & Compliance Evidence
Appendix B support: what this prototype demonstrably provides today, how it is hosted and secured, and exactly which items still require client or vendor confirmation. No certifications are invented.
Architecture summary
Full-stack React application (TanStack Start) with server-side rendering, typed RPC server functions for app-internal logic, and versioned REST endpoints under /api/public/v1/* for external callers. All state-changing demo workflows write audit events.
Hosting & deployment model
Managed cloud deployment via the Lovable platform (edge-served application + managed Postgres). Environments: preview and published. No customer-operated infrastructure is required for the prototype.
Database & data ownership
Dedicated Postgres schema with row-level security enabled on every table. All records in this prototype are synthetic and flagged is_synthetic. Utility data would remain utility-owned; export paths (CSV/REST) are documented in the API catalog.
Security & access model
Role and permission model is configured in the database and visible under Administration. RBAC is configured but enforcement requires the Microsoft Entra SSO integration — this prototype runs in a single-operator demo mode and does not claim live access control.
Public REST endpoints require an API key stored as a server-side secret; keys never reach browser code.
Encryption
In transit: HTTPS/TLS on all application and API traffic (platform-enforced). At rest: encryption is provided by the managed database platform — confirm specifics against platform documentation before contract submission.
Performance & concurrency (RFP Q18)
No validated simultaneous-user benchmark yet; no application-level hard cap; deployment capacity is environment dependent.
A load-test harness (scripts/load-test.mjs) exercises the read APIs with configurable concurrency so a defensible number can be produced in the target environment before proposal submission.
Support & role model (RFP Q16)
Separate limited-scope roles are modeled for Billing Supervisor, Finance/CSR, Field Crew, IT Administrator, and Read-Only Auditor — see Administration → Roles. Live assignment requires the identity integration.
Auditability, backup & data migration
Every demo workflow writes to the database-backed Audit Log. Backup/DR: platform-managed backups are assumed but retention and RPO/RTO are unconfirmed — listed below as an open item. Data migration approach: CSV import adapters (preview mode) plus the REST surface; see the API catalog.
Software compatibility matrix (RFP Q24/Q25)
Nothing here is a certified vendor claim — unvalidated items say so
| System | Type | Status | Supported / validated versions |
|---|---|---|---|
| Web browsers | Client runtime | Built | Current Chrome, Edge, Firefox, Safari (desktop + mobile) |
| Application runtime | Platform | Built | React 19 / TanStack Start on managed edge deployment |
| Database | Data platform | Built | Managed Postgres (Lovable Cloud) |
| Cityworks | Work management | Requires Vendor Access | Not yet validated — target versions configuration dependent |
| Esri ArcGIS Enterprise / Online | GIS | Requires Vendor Access | Not yet validated — REST service URL configuration provided |
| Tyler MUNIS | ERP / finance | Requires Vendor Access | Not yet validated — illustrative GL export artifact available |
| IAS World | CAMA / parcels | Requires Vendor Access | Not yet validated — CSV import adapter (preview) available |
| Itron Temetra | Meter reading | Requires Vendor Access | Not yet validated — route-file export exists; AMI import planned |
| MultiSpeak | Interop protocol | Requires Vendor Access | Adapter design only — endpoint, version, credentials required |
| Microsoft Entra ID (SSO) | Identity | Requires Vendor Access | Not yet connected — required to enforce the configured RBAC model |
Items requiring client / vendor confirmation
The explicit open list behind every Configuration needed answer
- Cityworks / Esri / MUNIS / IAS World / Itron endpoints, versions, and credentials
- Microsoft Entra ID tenant details for SSO-enforced role-based access
- Backup retention and disaster-recovery objectives (RPO/RTO) with the hosting platform
- Validated simultaneous-user benchmark from a load test in the target environment
- Formal security certifications (none are claimed by this prototype)
- Production rate tables and adopted fee schedules to replace illustrative demo rates
Cross-references: API Catalog · Questionnaire Evidence Index · RFP Readiness