CileaCloud
The shared service that stores and signs documents for every other Cilea product — where a signature has to still mean something a year after it was collected.
- Industry
- B2B software infrastructure
- Platform
- Internal service + API
- Role
- Collaborator — Cilea software & payments dev team
Business context
Every Cilea product generates paper that matters: rental contracts, invoices, inspection reports. Each one had been solving storage and signature for itself, which means each one was also solving — or quietly not solving — who is allowed to download a document, whether a signed PDF is the one that was actually signed, and what happens when two people sign at once. Those questions have the same answer for every product, and only need answering well once.
My responsibility
I work on this as part of Cilea's software team under a B2B contract, contributing to the document-signing service and its API.
Solution
A document management and signing service the other applications call rather than reimplement. Signing is protected by one-time codes with lockout and expiry, and the service rejects a source PDF that has been tampered with between generation and signature — so a signature is bound to a specific document, not merely collected next to one. Concurrent double-signing is handled explicitly rather than left to chance. Large files stream on download instead of being buffered whole, and the schema migrations run in both directions so a bad deploy can be walked back. Security work included closing unauthenticated access paths to the file API and paths that would have allowed signature evidence to be destroyed.
Results
Delivered as shared infrastructure for Cilea's applications. The security and integrity behaviours above are covered by automated tests — including OTP lockout and expiry, concurrent double-signing, and rejection of a tampered source PDF.
Technology
It lives in the same monorepo as the other new-generation Cilea applications and shares their core package, which is the point: the products that need signing call one service instead of each carrying their own.