Geospatial monitoring platforms

A dedicated instance for each client, on its own virtual machine: an asynchronous Python application behind a reverse proxy that verifies the session, a job queue in the database without external brokers, hardened system services with secrets delivered process by process, a single real-time stream per workstation. The source data are on another machine, accessed read-only through a closed list of internal channels.

We import the client’s data with file hashes and immutable versions, rebuild the geometries with fixed and repeatable rules and compute in PostGIS what the files do not say: municipalities crossed, distances, nodes, quality issues to flag. Every field declares its origin: client data, our own calculation or inference.

MapLibre maps with base cartography, terrain, fonts and symbols served from our servers, without third-party map services: those would reveal where the operator is looking. Dynamic layers (wind, hotspots, lightning, radar, alert zones) and a single clock for the map, the lists and the 3D scene.

CesiumJS scenes packaged in-house (the engine only, without cloud services), loaded when needed, with a probe of the graphics card and a fallback to the 2D map. Terrain supplemented by public LiDAR surveys at 1 m, the EGM2008 geoid, point clouds, measured heights. Anything inferred, such as the typical shape of an object, sits in a declared “indicative representation” layer that can be switched off, never in the data panels.

We apply the client’s design system with a single sheet of colour variables and with the deviations listed for approval. Severity always has a shape, a word and a colour; we choose palettes by calculation (CIEDE2000, simulation of the forms of colour blindness, contrast). Commands from a single registry for keyboard, radial menu, CAD mouse and 3D mouse; WCAG 2.2 AA as the target.

A wall is a device, not a user: it is paired through a keyed link that is shown only once and can be revoked and regenerated; it receives a read-only view and reconnects on its own. We design layout and font size around the reading distance, with repeated observations at 1920 pixels and in 4K.

Notifications on two axes, class and level (Alarm, Warning, Advisory), with acknowledgement, silencing, limits against avalanches of notifications and closure outcomes that measure the precision of the rules. Every rule starts “in shadow mode”: computed but invisible, it is calibrated on real data and switched on only with explicit approval.

For each section of a linear infrastructure, hourly series from 72 hours back to 72 hours ahead: wind perpendicular to the section, forecast and measured rainfall, lightning, hotspots, tremors, wet snow and ice at the right altitude, sea salt. The archive is bitemporal (what was known at time T) and we calibrate the thresholds with backtests on public events.

Named accounts with Argon2id passwords, a TOTP second factor that can be made mandatory per account, recovery codes, lockouts by account and never by address (control room traffic goes out through only a few proxies), server-side sessions with CSRF protection, a permission matrix in a single file read by the service, the interface and the tests; the four-eyes principle for sensitive actions. We also design federated access.

Only HTTPS from the internet, administration over VPN, no visible version or product name, generic errors, a strict Content Security Policy. We treat everything collected from the internet as hostile input: checks on addresses and redirects, caps on time and size, text from third parties and from models shown only as text. We introduce the application firewall in phases.

We generate documents from text sources, in the client’s format: architecture documents following its template, manuals and reports in the format of its publications, schedules in Microsoft Project. The generators stop if they find forbidden words, addresses, placeholders or missing steps; images go through text recognition before delivery.

We release a package specified by name, with a snapshot of the machine before risky releases, immutable and forward-only database migrations, an atomic swap, a health check and automatic rollback. The suites cover installation, service, interface, control room, security, 24-hour endurance and end-to-end paths, plus the “real-data tests”, which look for simulated data: a red result blocks the release unless there is a written waiver.