Multi-tenant UK compliance and HR platform for licensed sponsors: deadlines that chase themselves

The challenge

A UK employer that sponsors overseas workers carries duties that do not forgive a missed date. The sponsor licence has to be renewed. Changes have to be reported to UK Visas and Immigration inside a window counted in working days. Every worker's right to work has to be checked, recorded and re-checked before it lapses. Disclosure and Barring Service certificates, mandatory training and role reviews all expire on their own schedules. Getting any of it wrong risks the licence itself, and with it the ability to employ the people the business already depends on.

Most teams track this in spreadsheets and calendar invites, which fail quietly. The record says a check was done; nobody notices that the visa behind it expires in three weeks. So the platform had to do more than store the data: it had to know what was coming due, work out who could actually do something about it, and tell them in time.

On top of that it is a multi-tenant product. Many organisations share one system, each needing certainty that their people data is isolated, that every change is attributable, and that nothing is ever silently lost.

Approach

The compliance side is built around a nightly sweep rather than a dashboard nobody opens. Each family of obligations carries its own reminder cadence, because the urgency genuinely differs: a sponsor licence is renewed over months through the Home Office, so it warns at ninety, sixty and thirty days, while right to work and Disclosure and Barring Service expiries warn at sixty, thirty and seven. Mandatory training, which is usually a same-week fix, warns at thirty and seven.

Two things stop the reminders becoming noise or becoming silence. Each notice is aimed at an audience that can act on it: the employee hears about their own expiring document, while duties that belong to the organisation go only to the administrators, because telling someone about a deadline they are powerless to meet is how people learn to ignore a channel. And once a date has passed, overdue reminders fire from the date itself, on a schedule held in code that an organisation cannot turn off. Cadences are theirs to tune; the compliance family cannot be silenced.

There is also a monthly report for the opposite problem: not what has a date, but what is missing. An active employee whose right to work was never checked, or whose check failed and therefore left no expiry date behind, appears on no dated reminder at all. That report is the surface that catches them.

Architecture

• A NestJS modular monolith of sixty-seven modules over PostgreSQL, from right to work and Disclosure and Barring Service checks, sponsor licence and key personnel records, Sponsorship Management System duties and role reviews, through to leave, payroll, HMRC Real Time Information submissions and onboarding.
• Multi-tenancy as a shared schema with an organisation discriminator, enforced in one place rather than in every query, with the tenant always resolved from request context and never from the request body.
• Auditing and history written by entity subscribers, not by hand: every core table has a history twin that receives an append-only copy of each version, created in the same migration as the table it mirrors.
• Permissions resolved per request from the database, never serialised into tokens, so a change to someone's role takes effect immediately. The backend also returns the filtered menu, so the interface cannot offer what the guards would refuse.
• Redis and BullMQ for the reminder sweep, digests and exports, so nothing slow runs inside an HTTP request. The sweep matches a reminder offset exactly on the day, which makes it idempotent without a ledger table to keep in step.
• A separate file service holding documents under envelope encryption, reached through short-lived signed URLs. It knows nothing about users or roles; the main backend stays the single access authority.
• A Next.js front end with a typed API client generated from the backend's OpenAPI specification, so any drift between the two fails at compile time.

Results

The platform is in active development and being prepared for its first organisations. The compliance engine is built and tested: the reminder cadences, the split between employee and administrator audiences, the unsilenceable overdue notices and the monthly gap report all run, backed by more than two thousand end-to-end tests across the API.

Figures on adoption and on deadlines met will be published once the platform is live with real employers.