← All work
Their own account. No public address on payroll. 
Sample data. 
The new site scores near-perfect where the old one struggled
Client work · Payroll + HR · 2026 – now
Go Further Group
All the tech for a California payroll company
- Role
- Director of Technology
- Client
- Go Further Group
- When
- 2026 – ongoing
- Built with
- Azure, Microsoft 365, Next.js
- 15 min
- most data they could lose
- ~1 hr
- to rebuild everything
- 57 → 98
- phone speed score
The before
Their hosting provider held the servers, backups and keys. Leave ran on email.
What I built
Now they hold their own keys.
Features
01A cloud they own
Payroll rebuilt in their own Microsoft account, multi-factor sign-in on every account.
02Backups nobody can delete
Three layers, including an offsite copy nobody can delete for 90 days.
03Leave without email chains
Employees get a secure link for their case. No login needed.
04A website for hotels
Rebuilt around hotel payroll, with city wage pages and near-perfect scores.
Why it matters
| Before | After | So what |
|---|---|---|
| Outside firm held admin keys | GFG holds the keys | They decide who gets in |
| Backups held by provider | 3 copies, one locked | Ransomware can't stop payroll |
| Stuck with one provider | One script, one hour | No vendor holds them hostage |
- Speed: old site57
- Speed: new site98
- Best practices: old54
- Best practices: new100
Source: Google Lighthouse, mobile, out of 100. Sep–Oct 2026
How it works
- Staff sign in (MFA)
- Private payroll server
- Client portal
- Backups ×3
- Locked offsite copy
Staff work in a private network. Clients only see the portal.
Technical details +
Cloud
- Azure Virtual Desktop + SQL Server
- Entra ID with MFA
- No public IP on the payroll server
- Azure Backup + locked offsite copy
Leave app
- Fastify + Postgres API
- React front end
- Secure per-employee links
Website
- Next.js
- 14 city wage pages
- Encrypted client forms
What I learned
- —The scariest risk wasn't the software. It was who held the keys.
- —Test the backup you'd need. We proved the lock by trying to delete it.
Running on someone else's servers? Let's check who holds your keys.