Security and compliance consulting
Vesta's platform collects deeply sensitive personal information, and it had to satisfy security standards from two demanding institutions at once, the Ontario Provincial Police and Queen's University. Ollon implemented row level encryption, non PII identification keys, and multi factor authentication built to meet both organizations' requirements, then facilitated an external security audit to satisfy the project's cyber insurance requirements. That audit and the security architecture behind it are what let a small nonprofit platform earn approval from a police service and a university at the same time. The platform continues operating under those same standards years after the initial audit.
Identity and Access Management (IAM)
Survivors, crisis center staff, police personnel, and social workers all needed access to Vesta's platform, but none of those groups needed to see the same information or have the same level of access. Ollon built role based access controls scoped to each user type, combined with multi factor authentication strong enough to meet the Ontario Provincial Police's own standards for accessing sensitive information. That access model meant a crisis center worker and a police officer could use the same underlying system without either one seeing more than their role required. Strict separation between user types is what let multiple organizations share one platform without compromising the privacy each stakeholder group needed.
Quality assurance and testing
A platform used by survivors, crisis centers, police, and university administrators could not launch on functional testing alone, since each stakeholder group needed to confirm the system worked for how they specifically used it. Ollon ran functional and security testing alongside user acceptance testing with each stakeholder group separately. That layered approach meant issues specific to a police case worker's workflow got caught by police testers. Passing that multi group process is part of what let the platform earn approval from institutions with very different day to day uses for the same system.
UI/UX design and prototyping
Designing for survivors meant Vesta's interface had to feel unintimidating and accessible, while the same platform needed a fully functional administrative interface for police and crisis center staff managing real cases. Ollon built wireframes, user flows, and visual designs for both experiences, using agile methods to create functional prototypes survivors and staff could react to before development went further. That process meant the tone and accessibility of the survivor facing side got tested directly with the people it needed to work for. Two genuinely different user experiences came out of the same design process without either one compromising the other.
Infrastructure as code
Running a platform that collects deeply sensitive personal information meant Vesta's AWS infrastructure needed to be reviewable and reproducible. Ollon built the AWS environment using Terraform, covering RDS, ECS, an application load balancer, S3, CloudFront, Secrets Manager, and KMS, with CI/CD pipelines automating deployment on top. That infrastructure as code approach meant the environment's security configuration could be reviewed directly during the external audits the platform needed to pass. The infrastructure was auditable by design, which mattered given exactly who was doing the auditing.
Business System Integrations
Getting crisis centers, police departments, and social workers to coordinate on the same cases meant Vesta needed real time data exchange between organizations that had never shared a system before. Ollon built a common API layer to enable that secure exchange and synchronization, letting information entered by one stakeholder organization become immediately visible to others authorized to see it. That integration turned separate organizations working the same cases in isolation into a genuinely centralized system, without requiring any one organization to give up its own internal processes. The platform's value came directly from that cross organization data flow, not from digitizing what any single organization already did on its own.
Project management
Vesta did not have the technical expertise to even apply for the government funding its platform needed, let alone build it, when this engagement began. Ollon helped prepare the successful IRAP grant application, then became the organization's de facto technology team once funding came through, managing an 18 month project across multiple phases with up to four team members involved at any given time. That continuity from grant writing through delivery meant the same team that helped secure the funding was accountable for building what it was meant to pay for. Vesta went from a funding application to a live platform serving multiple institutional stakeholders.
Technical architecture
Vesta's platform needed to serve survivors, crisis centers, police, and social workers from one system while keeping each group's data appropriately separated and secure. Ollon architected that system around two distinct web applications connected through a common API and a shared database, designed specifically so information could flow securely between authorized parties without collapsing the privacy boundaries between different organizations. That architecture had to satisfy the Ontario Provincial Police and Queen's University during their own security reviews, not just work well enough to demo. The system Ollon designed is what let multiple institutions with very different security expectations approve the same underlying platform.
Startup lifecycle support: founding through exit
Vesta has not gone through an exit, so this engagement actually represents technical support starting before the organization had funding and continuing through years of live operation since. Ollon helped prepare Vesta's original IRAP grant application, became its de facto technology team once funding was secured, and has continued supporting the platform for years past the initial 18 month build. That continuity meant Vesta never had to onboard a new technical partner from its earliest funding stage through operation today. The relevant story is sustained support from before the company was funded through however long it keeps operating.
