<h2>The Problem</h2>
<p>Companies face increasing pressure to measure and report their environmental impact. ESG (Environmental, Social, Governance) compliance isn't optional anymore. But most companies track sustainability data in spreadsheets, scattered across departments, with no centralized way to calculate emissions or generate reports.</p>
<p>I saw an opportunity to build a platform that makes sustainability tracking as straightforward as any other business metric.</p>
<h2>What I Built</h2>
<p>Midgard is a comprehensive B2B SaaS platform for ESG management. Companies can track carbon emissions across their operations, manage sustainability policies with AI-powered analysis, assign compliance tasks to team members, and generate reports for stakeholders.</p>
<h3>Core Features</h3>
<ul>
<li><strong>Carbon Footprint Tracking</strong>: Calculate emissions from energy usage, fuel consumption, business travel, and purchases</li>
<li><strong>Policy Management</strong>: Upload and analyze sustainability policies with AI-powered suggestions</li>
<li><strong>ESG Task Management</strong>: Track compliance tasks across environment, social, and governance categories</li>
<li><strong>Team Collaboration</strong>: Invite team members, assign roles, and manage permissions</li>
<li><strong>Email Integration</strong>: Automatically extract receipts and invoices from Gmail and Outlook</li>
<li><strong>Real-time Notifications</strong>: WebSocket-powered alerts for task updates and policy changes</li>
<li><strong>Sustainability Rating</strong>: Public-facing scorecards for company sustainability performance</li>
<li><strong>Multi-language Support</strong>: Internationalization with next-intl and Crowdin</li>
</ul>
<h2>Tech Stack</h2>
<table>
<thead>
<tr>
<th>Layer</th>
<th>Technology</th>
<th>Why I Chose It</th>
</tr>
</thead>
<tbody>
<tr>
<td>Frontend</td>
<td><a href="https://nextjs.org/">Next.js 14</a></td>
<td>App Router, Server Components</td>
</tr>
<tr>
<td>Language</td>
<td><a href="https://www.typescriptlang.org/">TypeScript</a></td>
<td>Type safety across full stack</td>
</tr>
<tr>
<td>Auth</td>
<td><a href="https://aws.amazon.com/cognito/">AWS Cognito</a></td>
<td>Enterprise SSO, built into Amplify</td>
</tr>
<tr>
<td>Database</td>
<td><a href="https://aws.amazon.com/dynamodb/">DynamoDB</a></td>
<td>Serverless, scales automatically</td>
</tr>
<tr>
<td>Storage</td>
<td><a href="https://aws.amazon.com/s3/">S3</a></td>
<td>Document storage with presigned URLs</td>
</tr>
<tr>
<td>Functions</td>
<td><a href="https://aws.amazon.com/lambda/">AWS Lambda</a></td>
<td>19 serverless functions</td>
</tr>
<tr>
<td>AI</td>
<td><a href="https://platform.openai.com/">OpenAI API</a></td>
<td>GPT-4 for policy analysis</td>
</tr>
<tr>
<td>Payments</td>
<td><a href="https://stripe.com/">Stripe</a></td>
<td>Subscription billing</td>
</tr>
<tr>
<td>UI</td>
<td><a href="https://ant.design/">Ant Design</a> + <a href="https://www.radix-ui.com/">Radix</a></td>
<td>Enterprise component library</td>
</tr>
<tr>
<td>Charts</td>
<td><a href="https://www.highcharts.com/">Highcharts</a></td>
<td>Data visualization</td>
</tr>
<tr>
<td>State</td>
<td><a href="https://zustand-demo.pmnd.rs/">Zustand</a> + <a href="https://tanstack.com/query">React Query</a></td>
<td>Client state and server cache</td>
</tr>
<tr>
<td>Infra</td>
<td><a href="https://docs.amplify.aws/">AWS Amplify Gen 2</a></td>
<td>Full-stack serverless deployment</td>
</tr>
</tbody>
</table>
<h2>Architecture Highlights</h2>
<h3>System Architecture</h3>
<pre><code>flowchart TB
    subgraph Client["Frontend (Next.js 14)"]
        UI[React Components]
        RQ[React Query Cache]
        ZS[Zustand Store]
    end

    subgraph Auth["Authentication"]
        COG[AWS Cognito]
    end

    subgraph API["AWS Amplify Gen 2"]
        GQL[GraphQL API]
        REST[REST Endpoints]
    end

    subgraph Compute["Lambda Functions"]
        EMI[Emission Calculator]
        POL[Policy Analyzer]
        EMAIL[Email Processor]
        NOTIF[Notification Handler]
    end

    subgraph Storage["Data Layer"]
        DDB[(DynamoDB)]
        S3[(S3 Bucket)]
    end

    subgraph External["External Services"]
        OAI[OpenAI API]
        GMAIL[Gmail API]
        OUTLOOK[Outlook API]
        STRIPE[Stripe]
    end

    UI --> COG
    UI --> GQL
    UI --> REST
    GQL --> DDB
    REST --> Compute
    EMI --> DDB
    POL --> OAI
    EMAIL --> GMAIL
    EMAIL --> OUTLOOK
    EMAIL --> S3
    NOTIF --> DDB
    UI --> STRIPE
</code></pre>
<h3>Data Model</h3>
<pre><code>erDiagram
    Company ||--o{ TeamMember : has
    Company ||--o{ Employee : employs
    Company ||--o{ CompanyDetail : tracks
    Company ||--o{ BusinessTravel : records
    Company ||--o{ Purchases : logs
    Company ||--o{ Policy : manages
    Company ||--o{ Task : assigns
    Company ||--o{ CompanyResult : calculates

    TeamMember ||--o| Employee : "links to"
    TeamMember ||--o{ CompanyDetail : submits

    Employee ||--o{ Purchases : makes

    Project ||--o{ BusinessTravel : includes
    Project ||--o{ Purchases : contains

    Company {
        string id PK
        string name
        string subscriptionStatus
        string stripeCustomerId
        enum workEnvironment
    }

    TeamMember {
        string id PK
        string email
        enum role "OWNER, ADMIN, MEMBER"
        enum status "PENDING, ACCEPTED"
    }

    CompanyDetail {
        string id PK
        enum type "FUEL, ENERGY, TRAVEL"
        json details
        enum fileStatus
    }

    Policy {
        string id PK
        string title
        enum category "ENV, SOCIAL, GOV"
        json suggestedText
        string analysis
    }

    Task {
        string id PK
        string title
        enum status
        enum category "ENV, SOCIAL, GOV"
        string answer
    }
</code></pre>
<h3>Email Processing Pipeline</h3>
<pre><code>sequenceDiagram
    participant U as User
    participant F as Frontend
    participant L as Lambda
    participant G as Gmail/Outlook
    participant S as S3
    participant D as DynamoDB

    U->>F: Connect Email Account
    F->>L: Initiate OAuth
    L->>G: Get Auth URL
    G-->>U: Authorization Page
    U->>G: Grant Access
    G-->>L: Auth Code
    L->>L: Exchange for Tokens
    L->>D: Store Integration

    Note over L,G: Background Processing

    L->>G: Fetch Emails (with filters)
    G-->>L: Email + Attachments
    L->>S: Store Documents
    L->>D: Create CompanyDetail
    L->>F: WebSocket Notification
    F-->>U: New Document Alert
</code></pre>
<h3>Serverless Functions</h3>
<p>I built 19 Lambda functions handling everything from email OAuth to emission calculations:</p>
<ul>
<li><strong>Email Integration</strong>: Gmail and Outlook OAuth flows, automatic document extraction</li>
<li><strong>Calculations</strong>: Distance calculation, coordinate lookup, emission factor application</li>
<li><strong>AI Processing</strong>: Policy text analysis, task generation, compliance suggestions</li>
<li><strong>Notifications</strong>: WebSocket handlers, Slack integration, email sending</li>
</ul>
<h3>Real-time Features</h3>
<p>The platform uses WebSocket subscriptions for real-time updates. When a team member uploads a document or completes a task, everyone sees the change immediately. This was challenging to implement correctly with eventual consistency.</p>
<h2>What Building This Taught Me</h2>
<h3>1. DynamoDB access patterns require upfront planning</h3>
<p>I restructured the data model three times. DynamoDB is incredibly fast and scales infinitely, but you can't just add a new query later. Every access pattern needs a GSI (Global Secondary Index) designed from the start.</p>
<p>The lesson: spend a week mapping out every query your application will need before writing any code.</p>
<h3>2. Policy analysis needs structured prompts</h3>
<p>My first attempt at AI policy analysis returned inconsistent results. Sometimes it found compliance gaps, sometimes it missed obvious issues. The breakthrough came from structured prompting:</p>
<pre><code>const analysisPrompt = `
Analyze this sustainability policy for:
1. CSRD compliance gaps (list specific missing clauses)
2. Actionable improvement suggestions (ranked by impact)
3. Missing metrics and KPIs
4. Role and responsibility gaps

Return as JSON with these exact keys...
`
</code></pre>
<p>Constraining the output format made results reliable enough for production.</p>
<h3>3. Email integration is surprisingly complex</h3>
<p>I thought OAuth would be the hard part. It wasn't. The hard part was:</p>
<ul>
<li>Handling rate limits from Gmail/Outlook APIs</li>
<li>Parsing receipts in dozens of different formats</li>
<li>Extracting structured data from unstructured emails</li>
<li>Managing token refresh without user intervention</li>
</ul>
<p>I ended up building a processing queue with SQS to handle the volume reliably.</p>
<h3>4. Multi-tenant data isolation is non-negotiable</h3>
<p>Every query filters by <code>companyId</code>. Every Lambda function verifies the user belongs to the company they're accessing. This sounds obvious, but it's easy to forget one endpoint and create a data leak.</p>
<p>I added authorization middleware that runs before every data operation:</p>
<pre><code>const verifyCompanyAccess = async (userId: string, companyId: string) => {
  const member = await getTeamMember(userId, companyId)
  if (!member || member.status !== 'ACCEPTED') {
    throw new UnauthorizedError('Not a member of this company')
  }
  return member.role
}
</code></pre>
<h2>The Bigger Realization</h2>
<p>Building Midgard taught me that B2B SaaS is fundamentally about trust. Companies are entering sensitive data about their operations. Every feature needs to be reliable, every calculation needs to be accurate, and every piece of data needs to be secure.</p>
<p>The "cool" features matter less than getting the basics right: data accuracy, role-based access, audit trails, and clear reporting.</p>
<h2>What I'd Do Differently</h2>
<p>Start with a simpler emission calculation model. I built a flexible system that handles dozens of emission factors, unit conversions, and regional variations. Most users just need a straightforward way to enter their electricity bill and see the carbon equivalent.</p>
<p>Complexity can come later. Simple and correct beats comprehensive and confusing.</p>
<h2>References</h2>
<ul>
<li><a href="https://docs.amplify.aws/">AWS Amplify Gen 2 Documentation</a></li>
<li><a href="https://ghgprotocol.org/">GHG Protocol</a> for emission calculation standards</li>
<li><a href="https://finance.ec.europa.eu/capital-markets-union-and-financial-markets/company-reporting-and-auditing/company-reporting/corporate-sustainability-reporting_en">CSRD Requirements</a></li>
<li><a href="https://www.alexdebrie.com/posts/dynamodb-single-table/">DynamoDB Single Table Design</a></li>
<li><a href="https://platform.openai.com/docs/api-reference">OpenAI API Reference</a></li>
</ul>


Projects.

Midgard: ESG & Sustainability Management Platform