--- title: "The corporate web platform of Globalia · Polargate" description: "Globalia, the Spanish travel group, had its people data in Microsoft 365 and its public website somewhere else. Polargate built one web platform on a single…" url: https://polargate.ai/work/corporate-web-platform locale: en publisher: POLARGATE S.L. --- Travel and tourism # The corporate web platform of Globalia Globalia, the Spanish travel group, had its people data in Microsoft 365 and its public website somewhere else. Polargate built one web platform on a single repository: an employee directory synced from Microsoft 365, a digital business card with Apple Wallet and Google Wallet passes, and the group's public site, made readable by AI crawlers without rebuilding it. Pedro Ciordia works at Globalia, so this is related-party revenue, not a client won on the open market. In short Polargate built the corporate web platform of Globalia, the Spanish travel group: the internal platform, the employee directory and the group's public website on one repository. Pedro Ciordia works at Globalia, so this project is related-party revenue rather than a client won on the open market. The directory syncs from Microsoft 365 with Graph delta queries and a resumable job that carries on from where the last run stopped, and now holds tens of thousands of active employees behind three layers of privacy. Each employee gets a digital business card with Apple Wallet and Google Wallet passes signed on the server, and each brand of the group is assigned by email domain. On the public site, edge middleware serves real content to crawlers: one news page went from 14 characters to 11,421, with no migration to static generation. 1 repository for the internal platform, the directory and the public site 11,421 characters of real content an AI crawler gets from a news page 707 archived news articles now readable by AI crawlers 39 tables with row-level security and zero errors in the August 2026 diagnostic ## The problem Globalia runs several consumer brands, and its people data lived in Microsoft 365 while its public website lived somewhere else entirely. The group needed a staff directory that stays in step with Microsoft 365 at the scale of a workforce of tens of thousands, one card and one identity per brand, and a public site whose news archive could be read and cited by the assistants people now ask instead of a search box. ## What we built Polargate built the whole thing as one web platform on a single repository, so the internal platform and the public site share code, build and deploy. The directory sync was rebuilt on Microsoft Graph delta queries and made resumable, with the continuation link stored and a time budget per run, and employees sign in with their own Microsoft 365 account, so the accounts stay under the group's control. The directory applies privacy in three layers and serves avatars signed and expiring. On top of it sits the digital business card: provisioned from the directory, claimed by the employee at first single sign-on without the public link changing, with Wallet passes signed on the server and contact data served only against a signed access token. Each brand of the group is assigned by email domain. On the public site, edge middleware injects real content for crawlers only, with no migration to static generation and no change to the application. ## The outcome The directory now holds tens of thousands of active employees, kept in step with Microsoft 365 run after run. On the public site, one news page went from 14 characters of crawler readable content to 11,421, and 707 archived articles became readable. In the August 2026 diagnostic the database showed 39 tables with row-level security and zero errors, the security advisor warnings cleared and the row-level security policies consolidated into one policy per role and action. Before deploy: typecheck, 18 tests, the web build and the app build green, and 20 routes reviewed on desktop and mobile. The first nine cards were provisioned by hand for executives and work end to end. Stack - Vite - React - TypeScript - Tailwind CSS - shadcn/ui - Supabase - PostgreSQL - Deno - Microsoft 365 - Microsoft Entra ID - Vercel ## The context Globalia is a Spanish travel group with several consumer brands. Its people data was kept in Microsoft 365 and its public website lived somewhere else. Polargate built the group's corporate web platform: an internal web platform with the employee directory synced from Microsoft 365, a digital business card with Apple Wallet and Google Wallet passes, and the group's public website, all on one repository. Pedro Ciordia works at Globalia, so this project is related-party revenue rather than a client won on the open market. One repository is not a detail. The internal platform and the public site share the same code, the same build and the same deploy, so a brand change happens once instead of once per site. The stack is React, Vite, TypeScript, Tailwind and shadcn/ui on the front end, Supabase on the back end (Postgres with row-level security, Edge Functions on Deno, Storage and Auth), Microsoft Graph for the directory and single sign-on, Apple PassKit and the Google Wallet API for the passes, and Vercel for hosting. The project started with scaffolding from a visual builder and is now completely off it, with the backend consolidated into a single Supabase project of its own. ## The directory: delta queries and a sync that resumes Employees sign in with their own Microsoft 365 account, and the directory reads from that same Microsoft 365, so the accounts stay under the group's control and nothing about a person is retyped into a second system. The sync runs on Microsoft Graph delta queries, so each run brings only what changed instead of pulling the whole directory again. The sync is resumable by design: the continuation link is stored, each run gets a time budget, and the next run carries on from where the last one stopped instead of starting over. That is what lets a sync of this size finish. It now holds tens of thousands of active employees. Duplicates are handled by an identity merge rule that is reversible, joins the aliases of one person, and never merges two different people who happen to share a name. ### Three layers of privacy A staff directory is personal data, so it is not one dataset. It is three. The public layer carries professional information. The second carries corporate contact details. The third, personal data, sits behind an explicit permission. Avatars are served signed and expiring, so an image URL is not a permanent door. ## The digital business card Every employee has a public card page, with a mirrored English route, a vCard download, Apple Wallet and Google Wallet buttons and a branded QR code. Cards are provisioned from the directory and claim themselves when the employee signs in with SSO, and the public link does not change when that happens, so anything already printed stays valid. ### Passes are signed on the server, never in the browser Apple passes get a manifest with a hash per file and a PKCS#7 signature. Google passes get a JWT signed with RS256. The passes use QR, not NFC. Contact data is only served against a signed access token, stable per card so printed QR codes do not expire. The field contract is an allowlist with explicitly forbidden fields, the mobile number off by default and a sanitiser as defence in depth. Cards are not indexed. The vCard follows RFC 2426, with the photo embedded in base64 because iOS does not import photos by URL, and the page carries a visual hint that shows people which button actually saves the contact. ## Multi-company by email domain Globalia is several companies, so the platform is multi-company. Each brand is assigned by email domain and carries its own name and identity on the card. Access control is role based and verified, and the minimum role is assigned automatically at first sign-in by a database trigger. ## The public site, made readable by AI assistants A modern web application is painted in the browser, and almost no AI crawler runs JavaScript. The reader and the crawler do not get the same page, and closing that gap was the job on the public site. We fixed that without migrating the site to static generation. Edge middleware injects, for crawlers only, title, description, canonical, hreflang, Open Graph, JSON-LD and a real body with a heading and paragraphs. Humans still get the application untouched, and neither the build nor the app changed. The numbers are the point. A news page went from 14 characters of readable content to 11,421. Across six routes and their language mirrors, crawler visible content went from roughly 14 to 80 characters up to 756 on the home page and 200 to 260 on inner pages. 707 archived articles became readable. ## What else is inside Notifications do not fan out: one notification is a single row with an audience, and each user's feed is computed on the fly, honouring their preferences and the mandatory types. There is a visual board of benefits and offers, published by the people team and visible to everyone. The platform is an installable PWA that tells the user when an update is ready, and it uses Supabase Realtime instead of polling. ## Where it stands Measured, not projected. In the August 2026 diagnostic: 39 tables with row-level security and zero errors, the security advisor warnings cleared, and the row-level security policies consolidated into one policy per role and action, which is both easier to read and cheaper to run. Dead code removal took out 27 components and 16 dependencies. Security headers and TLS were hardened at the edge in the same phase. On weight: re-encoding the 153 frames of the home page hero to WebP cut it by 38% with no visual change, one component went from 739 KB to 3.6 KB after a full icon library import was replaced, and a 423 KB chart library moved to lazy loading. Before deploy: typecheck, 18 tests, the web build and the app build green, and 20 routes reviewed on desktop and mobile. [Build →](https://polargate.ai/services/build) · [Grow →](https://polargate.ai/services/grow) · [Corporate groups →](https://polargate.ai/for/corporate) FAQ ## Questions about this project Can we sync our staff directory from Microsoft 365 without copying it by hand? Yes, with Microsoft Graph delta queries: each run brings only what changed instead of the whole directory. The part most people get wrong is size. A sync that restarts on every run never finishes at the scale of a large group, so this one was built resumable: the continuation link is stored, each run gets a time budget and the next run carries on from where the last one stopped. It now keeps tens of thousands of active employees in sync. Employees sign in with their own Microsoft 365 account, and the directory serves data in three privacy layers, so professional information, corporate contact details and personal data are not the same dataset. Is it safe to give every employee an Apple Wallet and Google Wallet business card? It is, if the signing stays on the server and the card is treated as a public page. Apple passes are signed with a manifest and PKCS#7, Google passes with a JWT signed with RS256, and no signing key ever reaches the browser. Contact data is only served against a signed access token, stable per card so printed QR codes keep working. The fields that can appear are an allowlist with explicitly forbidden fields, the mobile number is off by default, and cards are not indexed. Do we have to rebuild our website as static HTML before AI assistants can read it? No. Static generation is the better long-term answer, but it is not the only one, and on a live corporate site it is rarely the fastest. Here, edge middleware injects title, description, canonical, hreflang, Open Graph, JSON-LD and a real body with a heading and paragraphs, for crawlers only. Humans keep getting the application untouched, and neither the build nor the application changed. Measured result: one news page went from 14 characters of readable content to 11,421, and 707 archived articles became readable. Worth checking first whether your own robots rules exclude AI crawlers, because plenty of them still do. ## Related work B2B services company, Europe ### Hardening a corporate website that a DNS filter was blocking A customer's corporate DNS filter was rejecting our client's domain, and that stopped the client operating as one of that customer's suppliers. The site was not compromised and not blacklisted. It was simply unhardened. Polargate diagnosed it in a week, migrated the CMS to hosting the client controls, and hardened it there, because the CMS admin panel was the only access available. 2026 Read the case [Hardening a corporate website that a DNS filter was blocking](https://polargate.ai/work/security-hardening) Global Dynamic Security Group ### Brand and bilingual site for Global Dynamic Security Group Brand identity, a 15-page identity manual and a bilingual Spanish and English corporate site for Global Dynamic Security Group (GDS), a security services group in the Dominican Republic, delivered as one fixed-price project. 2026 Read the case [Brand and bilingual site for Global Dynamic Security Group](https://polargate.ai/work/security-group-brand-and-site) NationwideLegal ### The CRM behind NationwideLegal, on Odoo 18 NationwideLegal in the United States runs its commercial operation on a CRM that Polargate built on Odoo 18 Enterprise and still directs technically: one custom module, five new models, permissions rebuilt around how the team actually sells, and a verification pass against production after every deploy. 2026 Read the case [The CRM behind NationwideLegal, on Odoo 18](https://polargate.ai/work/legal-services-crm-and-technology-direction) INITIATE ## Start the engine Tell us what you are building in a few short questions. A senior engineer answers in writing within 48 business hours, with a first take on scope, timeline and price. [Start your project](https://polargate.ai/start) · [Talk to us](https://polargate.ai/start#static-brief-heading)