Globalia.

The context

Globalia is a Spanish travel group with several consumer brands. Polargate built the group's corporate web platform: an internal web platform with the employee directory synced from Microsoft 365, a digital business card with Apple Wallet and Google Wallet passes, and the group's public website, all on one repository.

One repository is not a detail. The internal platform and the public site share the same code, the same build and the same deploy, so a brand change happens once instead of once per site. The stack is React, Vite, TypeScript, Tailwind and shadcn/ui on the front end, Supabase on the back end (Postgres with row-level security, Edge Functions on Deno, Storage and Auth), Microsoft Graph for the directory and single sign-on, Apple PassKit and the Google Wallet API for the passes, and Vercel for hosting. The backend lives in a single Supabase project of its own.

The directory: delta queries and a sync that resumes

Employees sign in with their own Microsoft 365 account, and the directory reads from that same Microsoft 365, so the accounts stay under the group's control and nothing about a person is retyped into a second system.

The sync runs on Microsoft Graph delta queries, so each run brings only what changed instead of pulling the whole directory again.

The sync is resumable by design: the continuation link is stored, each run gets a time budget, and the next run carries on from where the last one stopped instead of starting over. That is what lets a sync at the scale of a large group finish.

Duplicates are handled by an identity merge rule that is reversible, joins the aliases of one person, and never merges two different people who happen to share a name.

Three layers of privacy

A staff directory is personal data, so it is not one dataset. It is three. The public layer carries professional information. The second carries corporate contact details. The third, personal data, sits behind an explicit permission. Avatars are served signed and expiring, so an image URL is not a permanent door.

The digital business card

Every employee has a public card page, with a mirrored English route, a vCard download, Apple Wallet and Google Wallet buttons and a branded QR code. Cards are provisioned from the directory and claim themselves when the employee signs in with SSO, and the public link does not change when that happens, so anything already printed stays valid.

Passes are signed on the server, never in the browser

Apple passes get a manifest with a hash per file and a PKCS#7 signature. Google passes get a JWT signed with RS256. The passes use QR, not NFC.

Contact data is only served against a signed access token, stable per card so printed QR codes do not expire. The field contract is an allowlist with explicitly forbidden fields, the mobile number off by default and a sanitiser as defence in depth. Cards are not indexed.

The vCard follows RFC 2426, with the photo embedded in base64 because iOS does not import photos by URL, and the page carries a visual hint that shows people which button saves the contact.

Multi-company by email domain

Globalia is several companies, so the platform is multi-company. Each brand is assigned by email domain and carries its own name and identity on the card. Access control is role based and verified.

The public site, made readable by AI assistants

A modern web application is painted in the browser, and almost no AI crawler runs JavaScript. The reader and the crawler do not get the same page, and closing that gap was the job on the public site.

We did it without migrating the site to static generation. Edge middleware injects, for crawlers only, title, description, canonical, hreflang, Open Graph, JSON-LD and a real body with a heading and paragraphs. Humans still get the application untouched, and neither the build nor the app changed.

The numbers are the point. A news page now gives a crawler 11,421 characters of readable content. Across six routes and their language mirrors, crawlers now get 756 characters on the home page and 200 to 260 on inner pages. 707 archived articles are readable.

What else is inside

Notifications do not fan out: one notification is a single row with an audience, and each user's feed is computed on the fly, honouring their preferences and the mandatory types. There is a visual board of benefits and offers, published by the people team and visible to everyone. The platform is an installable PWA that tells the user when an update is ready, and it uses Supabase Realtime instead of polling.

Where it stands

Measured, not projected. In the August 2026 diagnostic: 39 tables with row-level security and zero errors, and the row-level security policies consolidated into one policy per role and action, which is both easier to read and cheaper to run.

On weight: re-encoding the 153 frames of the home page hero to WebP cut it by 38% with no visual change, one component went from 739 KB to 3.6 KB by loading only the icons it uses, and a 423 KB chart library moved to lazy loading.

Before deploy: typecheck, 18 tests, the web build and the app build green, and 20 routes reviewed on desktop and mobile.