Claude App — Production Readiness & Enterprise Compliance Build

We have built an extensive Claude code web app currently at MVP/prototype stage. We need an experienced full-stack developer or small team to take it from prototype to a production-ready, enterprise-grade product suitable for Australian commercial deployment. This includes replacing all placeholder/mock integrations with live services, standing up proper infrastructure, and implementing security and compliance controls aligned with the Australian Privacy Act (APPs) and ISO 27001 principles. 1. Placeholder Integrations to Implement (Production-Grade) • Payments: Replace mock/placeholder payment flow with live Stripe integration (AU entity, correct tax/GST handling, webhooks, refunds, PCI-compliant handling — no raw card data touching our servers) • Transactional Email: Implement a proper provider (e.g. SendGrid, Postmark, AWS SES ap-southeast-2) for account, notification, and billing emails, with deliverability setup (SPF/DKIM/DMARC on new domain) • SMS: Implement a real SMS provider (e.g. Twilio or an AU-based alternative) for notifications/OTP where used • AI Integration: Replace any mocked AI features with live API integration (Anthropic Claude API), including secure key management and cost/rate-limit controls • SSO / Authentication: Implement production authentication with SSO support (e.g. Auth0, Clerk, or Azure AD/Entra depending on client base), MFA support, and secure session management • Audit the codebase for any other placeholder/mock/stubbed services and flag for replacement 2. Database, Storage & Backup (Australian Data Residency) • Migrate/deploy production database to an Australian region (e.g. AWS ap-southeast-2 Sydney, Azure Australia East, or Supabase Sydney region) • Encryption at rest and in transit • Automated, tested multi-tier backups (e.g. daily + weekly + monthly retention) stored in-region, with documented restore procedure and a disaster recovery runbook • Data residency confirmation — no personal data transiting or resting offshore, including in third-party subprocessors (email/SMS/AI providers) where reasonably avoidable, or clearly disclosed where not • Retention and deletion policy aligned with the Australian Privacy Principles (APPs), including data subject access/deletion request handling 3. Environments & Deployment Pipeline • Separate test/staging and production environments (isolated databases, keys, and configs) • CI/CD pipeline (e.g. GitHub Actions) so changes can be developed, tested in staging, and promoted to production with approval gates • Claude Code integration: developer workflow set up so future technical changes can be made and tested via Claude Code, with a clear, documented path to push changes through staging into production (repo structure, environment variables, deployment scripts documented for this purpose) • Rollback procedure documented 4. Access Control & Security • Role-based access control (RBAC) covering all user types/tiers in the app • Admin audit logging (who did what, when) • Secrets/key management (no credentials in source control) • Standard hardening: HTTPS everywhere, security headers, dependency vulnerability scanning, input validation, rate limiting on public endpoints • Documented alignment with ISO 27001 Annex A control areas relevant to a SaaS app (access control, cryptography, operations security, communications security, incident management, supplier relationships) 5. Domain & Go-Live • Configure and deploy to new custom domain (domain to be supplied) • DNS, SSL/TLS certificates, email authentication records (SPF/DKIM/DMARC) • Production cutover plan with rollback option 6. Documentation Deliverables • Architecture diagram (test + prod environments, data flow, third-party services) • Data flow / data residency statement (for privacy compliance evidence) • Backup & disaster recovery runbook • Security control summary mapped to ISO 27001 Annex A (evidence pack suitable for an audit) • Environment variable / secrets inventory (names only, not values) • Handover documentation for ongoing maintenance Looking for a project cost (fixed cost) to develop the above, as well as an ongoing support and enhance hourly rate arrangement (fee for service) once the initial deployment has taken place. Please include pricing for both as part of your proposal, thank you!