Architecture Decision Framework — UK Regulated Context
| Decision | Start Here | Move to This When | UK Regulatory Driver |
|---|---|---|---|
| Monolith vs Microservices | Modular Monolith (always) | Microservices when > 3 independent teams needed | FCA PS21/3: IBS isolation; NHS DTAC: evidence complexity |
| Database strategy | Single PostgreSQL (module schemas) | Database per service when teams own data | UK GDPR Article 25: data minimisation + RLS |
| API style (internal) | tRPC (TypeScript full-stack) | REST + OpenAPI when non-TS consumers | FCA/NHS/GDS: OpenAPI 3.0 for external APIs |
| Compute | ECS Fargate (NHS/FCA), Lambda (events) | Kubernetes when > 50 services | NHS DTAC D3: VPC isolation; FCA PS21/3: consistent latency |
| Authentication | AWS Cognito (regulated), Clerk (SaaS) | Auth0 enterprise when complex MFA needed | NHS NHS Login; FCA PS21/3: identity audit trail |
| CI/CD | GitHub Actions | GitLab CI if self-hosted required | Cyber Essentials A2: 14-day CVE patching evidence |
| IaC | AWS CDK TypeScript | Terraform for multi-cloud | FCA PS21/3: CloudFormation change sets as audit trail |
| Observability | CloudWatch + X-Ray | Datadog for complex multi-service | FCA PS21/3: IBS availability measurement; NHS DSP Toolkit |
FCA PS21/3 Important Business Service (IBS) Architecture
ClickMasters PS21/3 architecture review: included in every FCA-regulated project. We map your IBSs, design the failure domains, and configure the Impact Tolerance monitoring before Sprint 1 feature development begins.
UK GDPR Data Architecture — Privacy by Design
| GDPR Requirement | Architecture Implementation | Technology | Evidence |
|---|---|---|---|
| Article 25 (Privacy by Design) | No personal data collected unless required for stated purpose | Zod schema — strict() rejects extra fields | Zod schema reviewed in PR |
| Article 25 (Data Minimisation) | Select only needed fields at query level | Prisma select: { field: true } | Code review — no findMany({}) without select |
| Article 5(1)(e) (Storage Limitation) | S3 lifecycle policy — delete after retention period | S3 lifecycle rules in CDK | CloudFormation resource definition |
| Article 32 (Security) | Encryption at rest + in transit + access control | KMS, TLS, IAM + RLS | AWS Config compliance rules |
| Article 30 (ROPA) | Data flow diagram documents all processing | Mermaid diagram in project repo + dbt DAG | Updated in every sprint with data changes |
| Article 17 (Right to Erasure) | Erasure API endpoint per data subject | PostgreSQL RLS + soft delete → hard delete schedule | Erasure API tested in CI/CD |