Audit and production-harden a live Flask/Postgres/AWS SaaS platform

We are a small European B2B SaaS company. Our platform is live and in use by pilot customers. It was built quickly, first by an in-house developer and more recently with heavy AI assistance. It works. What it needs now is the engineering discipline that a production system carrying real customer data should have around it. Two technical advisors have already reviewed it and produced a prioritised list, so you would not be walking into an unexamined codebase. Roughly 150,000 lines of application code and a substantial existing test suite of about 8,700 tests. This is not feature development. The work sits in these areas: Consolidating parallel deployment environments into one, including a data migration Least-privilege database roles and row-level security across the tenant schema Moving production onto a properly hardened container and configuration Python dependency locking and supply chain hygiene A CI pipeline, built from scratch Replacing a copyleft-licensed dependency used in several modules Release versioning and deployment provenance GDPR data deletion, subject access export, and retention enforcement This posting is for phase one only: a two week written assessment. What is usable as-is, what needs rebuilding, what we have wrong in the list above, and a costed plan with your own prioritisation. We want the honest version, including "this part should be thrown away". Phase two, executing that plan, would be a separate contract if both sides are happy. Stack: Python 3.14, Flask, SQLAlchemy, Alembic, Celery, PostgreSQL, Redis, Docker, AWS (EC2, ECS, RDS, S3), Vite. You should have: strong Python backend experience plus real DevOps depth. A track record of walking into someone else's codebase and assessing it honestly. PostgreSQL beyond ORM level, specifically roles and row-level security. Container and CI experience on AWS. How we work: fully remote and async with a weekly call. The founder is technical enough to be a real counterpart but is not an engineer, so you get quick decisions rather than architecture arguments. Two advisors review the significant calls, which means a second opinion rather than a second boss. Work goes on branches with review before merging. Not a fit if your background is primarily AI/ML, data science, or greenfield full-stack JavaScript. Company details, repository access and the advisors' findings are shared under NDA with shortlisted candidates.