The load is spiky and the deadline is real
Enterprise traffic is relatively smooth. Public-sector traffic is a wall. When a subsidy window opens or a filing deadline approaches, months of demand compress into hours. The system that idles comfortably at a thousand requests a minute suddenly faces a hundred thousand, and the citizens hitting it have no alternative and no patience.
We architect for the peak, not the average — stateless services that scale horizontally, aggressive caching of everything that is not per-user, queue-based processing for anything that can be deferred, and graceful degradation that keeps the core path alive even when the nice-to-haves fall over.
Accessibility is not a compliance checkbox
When your platform is the only way to access an entitlement, accessibility stops being a legal formality and becomes the difference between a citizen receiving what they are owed or not. That means the page has to work on a slow connection, on a small screen, in multiple languages, for users with limited literacy, and for assistive technology.
- Server-render the critical path so it works before any JavaScript loads.
- Keep payloads small — every kilobyte is a second on a rural connection.
- Support the languages your citizens actually speak, not just the official one.
- Test with real assistive technology and real low-end devices, not emulators.
Security and auditability are the foundation
Public platforms are high-value targets holding some of the most sensitive data a person has. Security cannot be a layer added at the end; it has to be the substrate. Every access is authenticated and authorised, every sensitive action is logged immutably, data is encrypted in transit and at rest, and the whole system is built to be audited — because it will be.
Compliance frameworks like the DPDP Act are not obstacles to route around. Treated properly, they are a specification for how to earn and keep citizen trust, and building to them from day one is far cheaper than retrofitting them after an incident.
Boring technology, deliberately
Public infrastructure has to run for a decade with teams that will change many times over. That is an argument for boring, well-understood technology with deep talent pools and long support horizons — not the framework that trended last quarter. The goal is a system the next team can understand, operate and extend, long after the people who built it have moved on.
Key Takeaways
- 1Architect for the deadline-day peak, not the comfortable average.
- 2Accessibility and low-end performance are core requirements, not compliance theatre.
- 3Security and immutable auditability are the substrate, designed in from day one.
- 4Choose durable, boring technology the next team can still operate in ten years.