Technology
We run a deliberately small stack and use it everywhere. A decision made once about how environments are separated, how secrets are handled or how a deployment is rolled back applies to every product, rather than being taken again per project.
Boring technology, owned properly
Interesting technology choices are usually someone else’s problem to maintain. We choose well-understood tools with long support horizons, large communities and predictable failure modes, because we are the ones carrying the pager.
The corollary is that we own the whole path. We are not assembling a product out of eleven vendors and hoping the seams hold. Fewer moving parts means fewer places for data to sit unaccounted for, fewer suppliers to assess, and a much shorter answer when a customer asks where their information is.
Care360 holds sensitive information about vulnerable people. Rather than running two standards, we let the most sensitive product set the bar for all of them.
The request path
The shape every RB Stackworks web application takes. The dashed boundary is the important part: privileged credentials exist only inside it.
- 1. Browser requests a page. Most of the response is cached static HTML served from Vercel’s edge network.
- 2. Next.js renders on the server. Server components and server actions run in a trusted environment, so data access and secrets never reach the client bundle.
- 3. Supabase stores the data. Postgres with row-level security. The service-role key is held server-side only and the table policies deny client access outright.
- 4. Resend delivers email. Transactional messages are sent from a verified domain, triggered server-side and never from the browser.
The stack
Current stable versions, kept current. This website runs on the same stack as the products.
How we handle data
These are engineering practices we apply, described plainly. Where a formal certification or registration is held, it will be listed on this page with its reference number. We do not claim compliance we cannot evidence.