Named clientPublished with permission
Zero downtime, white-label ready: production GCP for TapTab.
TapTab is a restaurant fintech where downtime is not an acceptable failure mode. The company was expanding by offering white-label restaurant web pages, each partner brand running the platform under its own domain, and growth was outrunning the infrastructure. Onboarding a partner had become an engineering project. A single expired domain took down dev and production at once. Database spend was climbing with nobody watching it. We rebuilt the routing layer in Terraform, eliminated the outage failure class, and cut database cost 60%.
Growth was outrunning the infrastructure.
TapTab is a restaurant fintech platform where zero downtime is a hard requirement rather than an aspiration. When we started, the company was expanding its market by offering white-label restaurant web pages to its users, with each partner brand running the platform under its own domain.
That expansion was the problem. Every new white-label brand meant hand-built routing and deployment work, so onboarding a partner was an engineering project rather than a configuration change. The model only worked if partner growth was cheap, and it was getting more expensive with every brand.
Two other things were true at the same time. A single expired domain had taken down both the dev and production APIs simultaneously, which is the kind of failure that reveals a structural gap rather than a mistake. And database spend was growing month over month with nobody assigned to watch it.
Make partner onboarding a config change, not an engineering project.
The white-label problem and the outage were the same problem wearing two faces: routing was assembled by hand, so it was both expensive to extend and impossible to reason about when something broke. Fix the routing layer as code and both symptoms go away.
We designed one routing architecture that every brand flows through, expressed in Terraform, so adding a partner domain is a configuration entry rather than a bespoke deployment. Global load balancing in front of Cloud Run services, with the domain-to-brand mapping declared rather than assembled.
The incident work ran in parallel because it could not wait. Root-causing the dual dev and production outage to domain expiry told us the renewal path had no owner and no alarm, which is a guardrail problem rather than a person problem.
Four pieces of work, one durable platform.
White-label routing architecture
Global load balancing and Cloud Run services defined in Terraform, designed so a new partner domain onboards through configuration rather than engineering. One routing layer serves every brand, which means the cost of the next partner is close to zero and the behaviour of the whole system is readable in one place.
Production incident response
We root-caused the simultaneous dev and production API outage to domain expiry, restored service, and then put monitoring and renewal guardrails in place so that entire failure class is gone. The fix was not renewing a domain. The fix was making it impossible for an unrenewed domain to take the platform down silently again.
Cloud SQL cost analysis and right-sizing
Database capacity had been provisioned against assumption rather than measurement. We analysed real workload data, matched capacity to it, and cut monthly spend that nobody had been watching accumulate.
Integration hardening
OAuth integration rebuilt on Secret Manager with least-privilege IAM. No credentials in code, no credentials in configs. This is the unglamorous work that determines whether a security review goes well later.
Partner growth became an automation task. The outage class is gone.
Outcomes
New white-label brands now onboard without engineering rework, which turns partner growth from a staffing question into an automation task. Both environments came back and the domain-expiry failure class was eliminated rather than patched, with monitoring in place to catch the next one before customers do.
The engagement did not end. A one-off piece of work became a multi-year retained relationship, with Stonebridge as the standing infrastructure partner. That is the outcome we care most about, because it means the platform kept being worth maintaining.
Three decisions that compounded.
Treating routing as architecture, not plumbing
The obvious response to "onboarding a partner is slow" is to make the manual process faster. Making it a declared configuration instead removed the process entirely, and it also happened to make the system explicable during an incident. One decision, two problems.
Fixing the failure class, not the failure
Renewing the expired domain would have taken ten minutes and solved nothing. The actual defect was that a renewal had no owner and no alarm, so the same outage was scheduled to happen again on a different domain. Guardrails cost more up front and end the category.
Measuring before resizing
Database spend gets cut two ways: guess lower and hope, or measure the workload and match capacity to it. The first is how you end up with a 3am incident. Sixty percent came out of the second, and it held because it was derived from real data rather than optimism.
"Lucas is absolutely outstanding! Prompt, competent, likable, and professional, I recommend him wholeheartedly!"George N. — Founder, TapTab Verified review · Published with client permission
Infrastructure outrunning your growth? Retained relationships available.
Most discovery calls take 30 minutes. We come back with a written proposal within 48 hours. If the work is routing, cost, incident recovery, or platform architecture, we can scope from what you are running today.
Book a 30-minute call →Skip the form.
If you would rather email or call directly, the founder picks up.