Independent PostgreSQL Architecture and Security Review — NDIS Software Prototype

Independent PostgreSQL Architecture and Security Review — NDIS Software Prototype I am the Director of an Australian NDIS provider developing Totally COS, a configurable, multi-tenant provider operating system. I need an experienced PostgreSQL architect/security specialist to independently review our proposed design and identify what must be completed before a controlled live pilot. Current stage We have database schema and migration designs, synthetic testing packages, and interactive prototypes covering participant onboarding, worker compliance, readiness approvals, an Action Centre and dashboard. The current connected prototype runs in browser memory. It is not yet a production application connected to PostgreSQL. PostgreSQL is the proposed operational database, subject to technical validation. The eventual platform will hold sensitive participant and worker information, including disability-related support plans, risk assessments, consent, representative authority, training and compliance evidence. Initial scope Please review the available architecture, SQL schemas, migrations, permissions and test materials, then assess: - Multi-tenant isolation, including Row Level Security, ownership, privileged accounts and potential bypasses. - Database roles, least-privilege access, application connections and migration permissions. - Authentication and application/API authorisation requirements, including approval permissions. - Secure functions, extensions, schema permissions and `search_path`. - Evidence storage, audit history and protection of sensitive information. - Proposed hosting, Australian data residency, encryption, secrets management and environment separation. - Backup, restoration, monitoring and operational readiness. - Gaps between our existing synthetic tests and the testing needed before live use. Where a suitable isolated PostgreSQL environment is available, propose and conduct agreed tests using synthetic data only. Please distinguish document review from controls actually tested. You may recommend pgdsat or similar tools, but automated scanning alone will not satisfy this engagement. Required deliverables 1. A prioritised findings report with supporting evidence and practical remediation steps. 2. A test record identifying the environment, versions, tests executed, results and limitations. 3. An assessment of readiness for a controlled pilot, including outstanding blockers and conditions. 4. A clear list of any application security or penetration testing that requires a separate specialist. 5. A handover discussion explaining the findings in plain English. Boundaries No real participant or worker data will be provided for this initial review. No production changes, infrastructure purchases or deployment are authorised. Any testing environment or configuration changes must be agreed first. Existing business systems must remain unchanged. Confidentiality and secure handling of project materials are required. Please include in your proposal - Relevant PostgreSQL security and multi-tenant application experience. - Examples of similar reviews, particularly involving sensitive information. - Which parts of this scope you can personally assess and any exclusions. - Your proposed approach, required access, timeframe and fixed-price estimate for an initial review. - Whether remediation and retesting would be quoted separately. I am seeking an independent technical assessment with actionable findings, not general advice or a software sales proposal.