Fractional CTO / Principal AI SaaS Architect — Launch Due Diligence

SustainPro is a near-graduation enterprise sustainability and AI platform. We need one senior, hands-on Fractional CTO / Principal AI SaaS Architect to inspect the complete frontend and backend codebases and give the non-technical founder an honest, practical launch recommendation. This is a focused 30–50 hour technical due-diligence assignment. It is not an endless theoretical audit, a general development-team engagement, or an IoT/electrical/building-automation role. You must personally inspect the code and be able to explain findings clearly to both a non-technical founder and enterprise IT/security stakeholders. Responsibilities - Review frontend and backend code, architecture, deployment, databases, security, tests and graduation evidence - Identify genuine launch blockers without inflating scope - Review tenant isolation, authentication, RBAC, secrets, APIs and data flows - Review RAG accuracy, evaluation, prompt-injection risk, privacy and cross-tenant leakage - Assess production deployment, observability, backup, restore, disaster recovery, vulnerability management and incident readiness - Provide clear recommendations, supervise future developers, and join client IT/cybersecurity/data-protection/procurement meetings when needed - Help answer enterprise security questionnaires and technical RFPs Mandatory experience - 10+ years in professional software engineering or architecture - Hands-on Next.js, React and TypeScript - Hands-on Python and FastAPI - PostgreSQL with strong multi-tenant isolation knowledge; Redis; vector databases such as Qdrant - Production LLM APIs, RAG systems, AI evaluation and AI security - Vercel, Azure, Linux, Docker and production deployment - Authentication, RBAC, encryption, API security and secrets management - CI/CD, automated testing, Playwright and production observability - Backup, disaster recovery, vulnerability management and incident response - Excellent spoken and written English - Demonstrated enterprise customer-facing experience - Evidence of at least three relevant completed projects Strong advantages - Fractional CTO or principal architect history - Enterprise ESG, sustainability or reporting software - GRI, ISSB, CSRD or carbon-accounting familiarity - ISO 27001, SOC 2, GDPR and AI-governance readiness - UAE/GCC data-residency and enterprise procurement experience - Experience presenting to CIOs, CISOs or enterprise architecture boards Required output 1. Honest launch/graduation recommendation 2. Current architecture and data-flow map 3. Prioritized security and reliability findings, each tied to concrete evidence 4. Tenant-isolation and permissions review 5. AI/RAG accuracy, evaluation, security and privacy review 6. Production deployment, observability, backup and recovery assessment 7. Client IT/security Q&A document 8. Practical 30/60/90-day technical plan 9. Founder briefing and technical handover Individual candidates only. You must personally perform the audit and attend meetings. Do not apply as an agency or offer an unidentified or rotating team. We will reject junior/generalist developers, prompt engineers without production software depth, non-coding CTOs, and security auditors unable to assess application architecture. In your proposal, answer: 1. Link to three completed projects most similar to this assignment. State what you personally did, the stack, client type and outcome. 2. Describe one codebase/architecture audit where you separated true launch blockers from lower-priority improvements. 3. How would you test PostgreSQL tenant isolation across application users, background jobs, support/admin paths and AI retrieval? 4. Describe a production RAG evaluation and privacy/security approach you implemented. 5. Which enterprise security questionnaires, RFPs or CIO/CISO reviews have you personally handled? 6. Confirm that you—not a team or substitute—will personally perform the work. 7. Identify any mandatory technology above where you are not currently hands-on. The initial engagement will be capped and evidence-driven. No production changes are expected during the audit unless separately approved.