Backend / Full-Stack Engineer — plaintiff personal-injury case management platform

I'm a PI attorney (Florida) who has built a complete, working prototype of the case-management system my firm needs. It runs today: intake, matters, settlements, documents, deadlines, permissions, audit trail. It is the specification — the hire rebuilds it as a production application. Schema, screens, and business rules are already documented, so this is execution against a precise spec, not product discovery. ▎ ▎ The platform is AI-native by design: the AI assistant ships in Phase 2, but the architecture must support it from day one — structured, queryable data, stable IDs, clean read APIs. No re-architecture later. ▎ ▎ Stack ▎ - TypeScript, Next.js/React — you port the existing screens, so front-end capability matters even for a backend-weighted role ▎ - PostgreSQL + Supabase, with Row-Level Security as the enforcement layer: "standard users can't delete" must be true at the database, not just in the UI ▎ - Auth & permissions: roles, per-user grants, MFA, and a complete audit trail ▎ - Phase 1 is single-tenant but multi-tenant-ready (tenant_id on every table) ▎ ▎ Data migration ▎ - Build a Salesforce import and field-mapping tool ▎ - Bulk ingestion at scale: roughly 0.5 TB of existing files. Performance here is a requirement, not a nice-to-have ▎ - Recommend and defend the storage architecture (my instinct is Supabase as the base layer with AWS ainst three goals: mostprotected, fastest, best growth path ▎ ▎ Integrations ▎ - DocuSign — full e-signdriven ▎ - Microsoft Graph / Office 365 — email; calendar sync (provider TBD) ▎ - Dialpad or Twilio — SMto the record ▎ - QuickBooks Online — expense sync ▎ - Word/PDF document gene ▎ - Inbound lead webhook (public web form → de-duplicated intake pipeline) ▎ ▎ Anthropic Claude API in production (Phase 2, architected in Phase 1) ▎ - Server-side streaming he API key must not live in the browser ▎ - Per-user token limits acking ▎ ▎ Security — this is a fil ▎ This system holds attorney-confidential PII, medical records, and Social ▎ Security numbers. ▎ - HIPAA compliance is non-negotiable: BAA-covered services, encryption at ▎ rest and in transit, strull audit, retention andlegal-hold ▎ - Any AI pipeline touchieep PHI inside BAA-coveredinfrastructure — confirm the model provider offers a BAA before PHI reaches ▎ it ▎ - Secrets management, signed expiring document links, tested backups and ▎ restore, OWASP hygiene, nt separation with noproduction data in lower environments ▎ ▎ Strong signal: SOC 2, or prior legal-tech / health-tech work. ▎ Nice-to-have: legal-techne, Litify), productionLLM-app experience, Spanish (the firm operates Miami / Bogotá / Buenos Aires).