The corporate web platform of Globalia
Globalia, the Spanish travel group, had its people data in Microsoft 365 and its public website somewhere else. Polargate built one web platform on a single repository: an employee directory synced from Microsoft 365, a digital business card with Apple Wallet and Google Wallet passes, and the group's public site, made readable by AI crawlers without rebuilding it. Pedro Ciordia works at Globalia, so this is related-party revenue, not a client won on the open market.
- 1
- repository for the internal platform, the directory and the public site
- 11,421
- characters of real content an AI crawler gets from a news page
- 707
- archived news articles now readable by AI crawlers
- 39
- tables with row-level security and zero errors in the August 2026 diagnostic
The problem
Globalia runs several consumer brands, and its people data lived in Microsoft 365 while its public website lived somewhere else entirely. The group needed a staff directory that stays in step with Microsoft 365 at the scale of a workforce of tens of thousands, one card and one identity per brand, and a public site whose news archive could be read and cited by the assistants people now ask instead of a search box.
What we built
Polargate built the whole thing as one web platform on a single repository, so the internal platform and the public site share code, build and deploy. The directory sync was rebuilt on Microsoft Graph delta queries and made resumable, with the continuation link stored and a time budget per run, and employees sign in with their own Microsoft 365 account, so the accounts stay under the group's control. The directory applies privacy in three layers and serves avatars signed and expiring. On top of it sits the digital business card: provisioned from the directory, claimed by the employee at first single sign-on without the public link changing, with Wallet passes signed on the server and contact data served only against a signed access token. Each brand of the group is assigned by email domain. On the public site, edge middleware injects real content for crawlers only, with no migration to static generation and no change to the application.
The outcome
The directory now holds tens of thousands of active employees, kept in step with Microsoft 365 run after run. On the public site, one news page went from 14 characters of crawler readable content to 11,421, and 707 archived articles became readable. In the August 2026 diagnostic the database showed 39 tables with row-level security and zero errors, the security advisor warnings cleared and the row-level security policies consolidated into one policy per role and action. Before deploy: typecheck, 18 tests, the web build and the app build green, and 20 routes reviewed on desktop and mobile. The first nine cards were provisioned by hand for executives and work end to end.
Stack
- Vite
- React
- TypeScript
- Tailwind CSS
- shadcn/ui
- Supabase
- PostgreSQL
- Deno
- Microsoft 365
- Microsoft Entra ID
- Vercel
The context
Globalia is a Spanish travel group with several consumer brands. Its people data was kept in Microsoft 365 and its public website lived somewhere else. Polargate built the group's corporate web platform: an internal web platform with the employee directory synced from Microsoft 365, a digital business card with Apple Wallet and Google Wallet passes, and the group's public website, all on one repository. Pedro Ciordia works at Globalia, so this project is related-party revenue rather than a client won on the open market.
One repository is not a detail. The internal platform and the public site share the same code, the same build and the same deploy, so a brand change happens once instead of once per site. The stack is React, Vite, TypeScript, Tailwind and shadcn/ui on the front end, Supabase on the back end (Postgres with row-level security, Edge Functions on Deno, Storage and Auth), Microsoft Graph for the directory and single sign-on, Apple PassKit and the Google Wallet API for the passes, and Vercel for hosting. The project started with scaffolding from a visual builder and is now completely off it, with the backend consolidated into a single Supabase project of its own.
The directory: delta queries and a sync that resumes
Employees sign in with their own Microsoft 365 account, and the directory reads from that same Microsoft 365, so the accounts stay under the group's control and nothing about a person is retyped into a second system.
The sync runs on Microsoft Graph delta queries, so each run brings only what changed instead of pulling the whole directory again.
The sync is resumable by design: the continuation link is stored, each run gets a time budget, and the next run carries on from where the last one stopped instead of starting over. That is what lets a sync of this size finish. It now holds tens of thousands of active employees.
Duplicates are handled by an identity merge rule that is reversible, joins the aliases of one person, and never merges two different people who happen to share a name.
Three layers of privacy
A staff directory is personal data, so it is not one dataset. It is three. The public layer carries professional information. The second carries corporate contact details. The third, personal data, sits behind an explicit permission. Avatars are served signed and expiring, so an image URL is not a permanent door.
The digital business card
Every employee has a public card page, with a mirrored English route, a vCard download, Apple Wallet and Google Wallet buttons and a branded QR code. Cards are provisioned from the directory and claim themselves when the employee signs in with SSO, and the public link does not change when that happens, so anything already printed stays valid.
Passes are signed on the server, never in the browser
Apple passes get a manifest with a hash per file and a PKCS#7 signature. Google passes get a JWT signed with RS256. The passes use QR, not NFC.
Contact data is only served against a signed access token, stable per card so printed QR codes do not expire. The field contract is an allowlist with explicitly forbidden fields, the mobile number off by default and a sanitiser as defence in depth. Cards are not indexed.
The vCard follows RFC 2426, with the photo embedded in base64 because iOS does not import photos by URL, and the page carries a visual hint that shows people which button actually saves the contact.
Multi-company by email domain
Globalia is several companies, so the platform is multi-company. Each brand is assigned by email domain and carries its own name and identity on the card. Access control is role based and verified, and the minimum role is assigned automatically at first sign-in by a database trigger.
The public site, made readable by AI assistants
A modern web application is painted in the browser, and almost no AI crawler runs JavaScript. The reader and the crawler do not get the same page, and closing that gap was the job on the public site.
We fixed that without migrating the site to static generation. Edge middleware injects, for crawlers only, title, description, canonical, hreflang, Open Graph, JSON-LD and a real body with a heading and paragraphs. Humans still get the application untouched, and neither the build nor the app changed.
The numbers are the point. A news page went from 14 characters of readable content to 11,421. Across six routes and their language mirrors, crawler visible content went from roughly 14 to 80 characters up to 756 on the home page and 200 to 260 on inner pages. 707 archived articles became readable.
What else is inside
Notifications do not fan out: one notification is a single row with an audience, and each user's feed is computed on the fly, honouring their preferences and the mandatory types. There is a visual board of benefits and offers, published by the people team and visible to everyone. The platform is an installable PWA that tells the user when an update is ready, and it uses Supabase Realtime instead of polling.
Where it stands
Measured, not projected. In the August 2026 diagnostic: 39 tables with row-level security and zero errors, the security advisor warnings cleared, and the row-level security policies consolidated into one policy per role and action, which is both easier to read and cheaper to run. Dead code removal took out 27 components and 16 dependencies. Security headers and TLS were hardened at the edge in the same phase.
On weight: re-encoding the 153 frames of the home page hero to WebP cut it by 38% with no visual change, one component went from 739 KB to 3.6 KB after a full icon library import was replaced, and a 423 KB chart library moved to lazy loading.
Before deploy: typecheck, 18 tests, the web build and the app build green, and 20 routes reviewed on desktop and mobile.
Questions about this project
Can we sync our staff directory from Microsoft 365 without copying it by hand?
Is it safe to give every employee an Apple Wallet and Google Wallet business card?
Do we have to rebuild our website as static HTML before AI assistants can read it?
Related work
B2B services company, EuropeHardening a corporate website that a DNS filter was blocking
A customer's corporate DNS filter was rejecting our client's domain, and that stopped the client operating as one of that customer's suppliers. The site was not compromised and not blacklisted. It was simply unhardened. Polargate diagnosed it in a week, migrated the CMS to hosting the client controls, and hardened it there, because the CMS admin panel was the only access available.
2026Read the case
Global Dynamic Security GroupBrand and bilingual site for Global Dynamic Security Group
Brand identity, a 15-page identity manual and a bilingual Spanish and English corporate site for Global Dynamic Security Group (GDS), a security services group in the Dominican Republic, delivered as one fixed-price project.
2026Read the case
NationwideLegalThe CRM behind NationwideLegal, on Odoo 18
NationwideLegal in the United States runs its commercial operation on a CRM that Polargate built on Odoo 18 Enterprise and still directs technically: one custom module, five new models, permissions rebuilt around how the team actually sells, and a verification pass against production after every deploy.
2026Read the case
Start the engine
Tell us what you are building in a few short questions. A senior engineer answers in writing within 48 business hours, with a first take on scope, timeline and price.