Brett Smith

Kotahi — a health & wellbeing platform serving providers across New Zealand, built on data-sovereignty and consent-aware principles. Joined with a self-built health OS platform, initially licensed to Karo under terms negotiated in the employment offer, then gifted outright as the foundation for Kotahi's next evolution; it now underpins the company's reporting product and long-term consolidation strategy.

• When a provider organisation needed to administer services across ~50 member organisations through Kotahi, identified elastic database sharding with a multi-workspace pattern as the path to multi-organisation support.

  Re-architected Kotahi from single-tenant to sharded multi-workspace: isolated workspaces within a single instance, giving the provider one administration surface instead of ~50 separate systems.

  Tenant isolation enforced at the database layer — row-level security within the sharded model — rather than depending on application code getting every query right.

• Designed a satellite-workspace model so existing Karo clients joining the national programme kept their own Kotahi instances rather than being forcibly migrated.

  One-way sync of provider-owned configuration (services, activities, forms), marked read-only at the satellite; client and patient data never leaves the client's instance.

  Made data conflicts structurally impossible while preserving data sovereignty — ~4 existing instances connected as satellites.

• Embedded Apache Superset natively through an authenticated platform proxy rather than via iframe, keeping the entire BI layer off the public internet.

  Built Maramatanga, a multi-tenant SaaS reporting platform, on the health OS foundation — with dynamic SSO federating users from multiple Kotahi instances into a single reporting surface.

• Positioned Maramatanga as the proving ground for the recommended consolidation of Kotahi's multi-instance MVC + Vue estate onto a single platform.

  Shipped a revenue-carrying product while de-risking the platform migration bet.

• Separated identity provisioning from authentication after real-world Azure AD group-claim limits surfaced during a pilot rollout.

  Introduced SSO and SCIM provisioning across the Kotahi estate — IT providers manage user services and permissions without touching Kotahi.

• Replaced manual cluster provisioning with reproducible, version-controlled deployment.

  Migrated the reporting platform's AKS infrastructure to Infrastructure-as-Code.