Backend & Database Architect - Python, FastAPI, CloudSQL for Postgres and GCP
Budget: $8 – $15 USD
• Multi-Tenant Architecture: Implementing the tenant_id isolation logic at the database level (Postgres) and ensuring every API request is scoped to the correct customer.
• API Design (FastAPI): Building the RESTful endpoints that the Frontend consumes and that the AI Agent uses as "Tools."
• Database Management: Managing the Cloud SQL schema, migrations, and performance tuning (indexing).
• Authentication & RBAC: Integrating with Identity Providers (like Google Identity) and enforcing Role-Based Access Control (e.g., ensuring a "Viewer" cannot trigger an AI action that deletes a risk).
• Infrastructure (Cloud Run): Managing the containerization (Docker), environment variables, and deployment pipelines on GCP.
• Audit Logging: Capturing every system event (including AI-triggered ones) into the audit_logs table for compliance.
• Tenant Health Score: Automate the "Health" status you see in the Admin Portal based on real uptime metrics and database connection health.
• Encrypted Storage: Use Google Cloud Storage (GCS) with Customer-Managed Encryption Keys (CMEK) to store the physical documents
• Database Scoping (RLS): Move from localStorage to PostgreSQL (Cloud SQL). Implement Row Level Security (RLS) where every query is automatically filtered by a tenant_id at the database engine level, ensuring no data leakage. Every table must have a tenant_id column.
• Python Backend (FastAPI): Build a robust API layer using FastAPI.
• Impersonation Engine: Implement the backend "Support Token" logic. When an admin impersonates, the backend must log every action to a "Master Audit Trail" that the customer can view (Transparency).
• Load Balancing: Use a GCP Global External HTTP(S) Load Balancer with Cloud Armor (WAF) to protect against SQL injection and DDoS attacks
Backend - Frontend Integration
• Context Passing: The Frontend sends the JWT (token) and tenant_id with every request. The Backend validates this before allowing the AI Agent to access any data.
• Action Confirmation: If the AI Agent suggests a change (e.g., "Should I update this Risk?"), the Backend sends a "Confirmation Required" flag to the Frontend, which then shows a modal to the user for final approval.
Backend - AI Integration
• The Gateway: The Backend Developer creates a specific FastAPI endpoint (e.g., /api/ai/chat) that the AI Developer uses to initialize the Gemini session.
• Tool Execution: When Gemini decides to call a function (e.g., get_compliance_status), the Backend executes the actual SQL query and returns the raw data to the AI Agent.
• Streaming: The Backend must support Server-Sent Events (SSE) or WebSockets so the AI Developer can stream Gemini's response to the user bit-by-bit.
• API Design (FastAPI): Building the RESTful endpoints that the Frontend consumes and that the AI Agent uses as "Tools."
• Database Management: Managing the Cloud SQL schema, migrations, and performance tuning (indexing).
• Authentication & RBAC: Integrating with Identity Providers (like Google Identity) and enforcing Role-Based Access Control (e.g., ensuring a "Viewer" cannot trigger an AI action that deletes a risk).
• Infrastructure (Cloud Run): Managing the containerization (Docker), environment variables, and deployment pipelines on GCP.
• Audit Logging: Capturing every system event (including AI-triggered ones) into the audit_logs table for compliance.
• Tenant Health Score: Automate the "Health" status you see in the Admin Portal based on real uptime metrics and database connection health.
• Encrypted Storage: Use Google Cloud Storage (GCS) with Customer-Managed Encryption Keys (CMEK) to store the physical documents
• Database Scoping (RLS): Move from localStorage to PostgreSQL (Cloud SQL). Implement Row Level Security (RLS) where every query is automatically filtered by a tenant_id at the database engine level, ensuring no data leakage. Every table must have a tenant_id column.
• Python Backend (FastAPI): Build a robust API layer using FastAPI.
• Impersonation Engine: Implement the backend "Support Token" logic. When an admin impersonates, the backend must log every action to a "Master Audit Trail" that the customer can view (Transparency).
• Load Balancing: Use a GCP Global External HTTP(S) Load Balancer with Cloud Armor (WAF) to protect against SQL injection and DDoS attacks
Backend - Frontend Integration
• Context Passing: The Frontend sends the JWT (token) and tenant_id with every request. The Backend validates this before allowing the AI Agent to access any data.
• Action Confirmation: If the AI Agent suggests a change (e.g., "Should I update this Risk?"), the Backend sends a "Confirmation Required" flag to the Frontend, which then shows a modal to the user for final approval.
Backend - AI Integration
• The Gateway: The Backend Developer creates a specific FastAPI endpoint (e.g., /api/ai/chat) that the AI Developer uses to initialize the Gemini session.
• Tool Execution: When Gemini decides to call a function (e.g., get_compliance_status), the Backend executes the actual SQL query and returns the raw data to the AI Agent.
• Streaming: The Backend must support Server-Sent Events (SSE) or WebSockets so the AI Developer can stream Gemini's response to the user bit-by-bit.