YC

GPEEC

A national workforce-planning platform for the civil servants of Morocco’s communes, running on air-gapped government servers.

status
pre-prod live and audited · production next
role
tech lead · architecture, security, on-prem ai, infra, delivery
timeline
2026
delivered
through UDAT
stack
React 19 · TypeScript · Bun · PostgreSQL + pgvector · Redis
GPEEC home dashboard on a laptop
home dashboard

the challenge

GPEEC (Gestion Prévisionnelle des Emplois, des Effectifs et des Compétences) holds the national register of the communes’ civil servants: about 62.7k records across 11 regions. Every change has to go through a request and approval workflow, regional Excel files have to be imported, and real staffing has to be compared against the theoretical model.

The data is messy: job positions are free text, typed differently by every commune, in French and in Arabic. The security bar is strict, and the servers have no internet, so everything, the AI included, has to run on-prem.

what i built

One system to hold the register, control every change to it, compare real against theoretical staffing, and classify job data with an on-prem AI engine.

GPEEC overview: what the platform does, key numbers, role and stack
overviewfig. 1

Simple on the outside, hardened inside

One web entry point. Everything else lives on a closed government network with no internet access, and stays up when a non-critical service fails.

Architecture: one web gateway in front of the API, database, cache and on-prem AI, inside an air-gapped network
architecturefig. 2

Messy job text in, standard positions out

Every commune writes job titles its own way, in French or Arabic. The on-prem engine proposes a standard position with 92–94% measured precision, and a human reviews every change.

AI classification engine: free text normalized, matched, then confirmed by a human
ai enginefig. 3

Every edit is a request, every decision is traced

Field agents propose changes, central reviewers approve or reject them. The register only moves when the rules say it can, and every step lands in the audit journal.

Change control: request, review, then approve or send back
workflowfig. 4

Security by default, layer by layer

Mandatory 2-factor login, 28 granular permissions, regional scope enforced on the server and an append-only audit journal. Built to pass external audits.

Security layers: identity, access, data and platform
securityfig. 5

From commit to production, repeatable every time

Every release is tested and packaged automatically, then carried into the closed network. Dev, pre-prod and prod run the same build with the same checks.

Delivery pipeline from commit to the three environments
deliveryfig. 6

results

62.7krecords
129api endpoints
92–94%ai precision
6air-gapped servers

129 API endpoints, 28 granular permissions, mandatory 2-factor login and an append-only audit journal. Three environments on six air-gapped servers.

next

Building something that has to run inside a closed network?