PolicyGrain V3 + CheckMyDPDP

Strict-TypeScript monorepo for two products: PolicyGrain (privacy ops) and CheckMyDPDP (green/mint public-site journey). Apps: policygrain-web, checkmydpdp-web, app-web (workspace + operator admin), Fastify API (opaque sessions, CSRF, workspace auth, command-only DB), worker (scanner, monitoring, transactional jobs). Auth/MFA/passkeys, RLS, private storage, 9 lawyer-source fact programmes, 7 framework families, observation-only public scanner. No certification implication, no fake proof — governance that stays honest.

We partnered with the team to scope the smallest meaningful slice, then iterated weekly with demos to keep stakeholders close to the work. The architecture prioritises observability and a calm on-call experience over premature flexibility.

Today the system serves real users in production, with a deploy cadence that lets the team ship safely without ceremony.