CestaLex

Overview

A case-law research platform for law firms, covering Yargıtay, the regional courts of appeal and the Constitutional Court, with semantic search, a streaming AI assistant and a document editor.

• Multi-tenant architecture: each law firm's data is isolated from the others in three independent layers, including PostgreSQL Row-Level Security.
• JWT/OAuth sessions, UYAP e-signature for legally binding actions, plus 2FA and role-based access for privileged operations.
• Transactional outbox over Kafka for lossless event delivery between services; a SHA-256 chained, tamper-evident audit log.
• Semantic search built on Qdrant and Gemini, with a streaming RAG assistant.
• Subscription payments through iyzico, automatic e-arşiv invoicing through Paraşüt; deployed with CI/CD on Kubernetes and Coolify.

01

Problem

02

Approach

03

Architecture

04

Key decisions

1. 01

   Row-Level Security as the last line of defence

   RLS policies apply the tenant filter at the database level on every query. The performance cost is low, and a bug in application code can no longer leak data.

2. 02

   Outbox: write the event first, publish second

   Publishing straight to Kafka leaves a 'written but never published' window. The outbox table closes it; a relay process drains the queue.

3. 03

   Keep model calls off the request path

   The AI assistant is its own microservice; long model calls never block the main API and the answer streams down to the user.

Outcome

What I learned

“Tying security requirements such as data isolation to the database layer rather than application code is both safer and easier to maintain. That was the most important architectural decision in this project.”