NPESU Platform

The problem

The National Perinatal Epidemiology and Statistics Unit runs the clinical quality registries behind Australia and New Zealand's perinatal and reproductive health reporting. Its platform carries several of them. ANZARD, the assisted reproductive technology registry, is the largest — around a hundred fertility clinics reporting up to 110 data items per treatment cycle, feeding both the national annual report and the government-funded YourIVFSuccess service.

Whichever registry a given surface belongs to, the data underneath is about as sensitive as health data gets, and that ruled out the ordinary answer to automated abuse. A third-party CAPTCHA is the default choice precisely because it makes bot detection someone else's problem, but it works by sending request signals to an external provider and profiling the person on the other end. For a platform operating under Australian health data obligations, routing any part of a request through a foreign service was not a trade that was available, however convenient it would have been.

Access control had a parallel problem, and one that grew with every registry the platform took on. Accounts were administered by hand, which does not scale across a hundred contributing clinics and turns offboarding into a security question rather than a clerical one: when a clinician changes employer, their access should end that day.

What I built

A CAPTCHA built in-house for that constraint. Challenges are generated and graded server-side so the answer never reaches the browser, each challenge is single-use and time-limited so a solved response cannot be replayed, and attempts are rate-limited so brute force costs more than it returns.

How those challenges are produced is deliberately not described here. The deployment is live and the data behind it is sensitive. Unlike a cryptographic primitive — whose strength survives publication because the secret is the key, not the algorithm — a bespoke challenge gains nothing from having its internals documented and gives away something real.

Building rather than buying meant giving up the one genuine advantage the large providers hold: a global view of traffic to score behaviour against. The design compensates by making each challenge cheap to issue and expensive to farm, rather than trying to out-classify a vendor on signals we were never going to have.

Alongside it, an Azure Active Directory integration that moved onboarding out of the application and into the directory. Users are provisioned from directory membership rather than created by hand, application roles derive from directory groups, and the identity lifecycle — including revocation — sits centrally alongside the rest of the organisation's identity management.

Both are platform concerns rather than registry ones. They sit in front of every surface NPESU hosts, so a registry added later inherits bot protection and directory-backed access rather than solving either again.

Outcome

Public-facing surfaces across the platform are protected against automated abuse with no part of a request leaving NPESU's own infrastructure, which keeps bot protection consistent with the data-handling obligations the registries work under rather than in tension with them.

Onboarding stopped being a manual step. Access follows directory membership, so joiners and leavers are handled by the same process that governs the rest of the organisation, and the platform no longer maintains its own separate answer to who should be allowed in.

The platform continues to host the registries behind Australia and New Zealand's national perinatal and ART reporting — among them ANZARD, whose data underpins the annual report and the independent clinic success rates published through YourIVFSuccess.

Stack

Ruby on Rails · Haml · Docker · AWS · Azure Active Directory · Shell scripting