ESPAU

The problem

A nonprofit working with autistic students keeps track of information that is both sensitive and highly structured: student records, the therapy programs each child is on, and formal developmental assessments like the DENVER model and ADOS-2. That kind of data usually ends up scattered across spreadsheets and paper, which makes it hard to keep consistent, hard to secure, and hard for a team to share safely. The organization needed a public face to explain its work and, behind it, a real clinical platform for the people doing the day-to-day.

The approach

ESPAU is a public site paired with a clinical admin platform on Next.js. I built the admin: authentication and users, the students, teachers, and schedules workflow, the developmental-stage tracking, assessments persisted to the database, and Excel export, with role-based access so staff only reach the data their role allows. It sits on a type-safe PostgreSQL backend built with pgtyped, the same foundation as zql, so queries are typed from the real schema and sensitive records are handled with structure rather than loose, untyped access.

Because the records are clinical, security got its own pass rather than a checkbox: two-factor authentication on the admin, encryption of sensitive fields at rest, an access log that records who reached what, and account deactivation that revokes live sessions instead of waiting for them to expire.

The outcome

ESPAU gives the organization one place to run its programs: a public site that explains the mission and a secure admin where staff manage students, therapies, and assessments under proper access control. Because it is built on a typed data layer, the records the team relies on stay consistent as the platform grows.