Challenge
The owner runs several online shops selling e-prescription products. Each shop has its own orders and reports, so there was no single view of sales, products and trends.
The constraint was health data. Information about patients goes to doctors and cannot be collected in an analytics tool. Centralisation therefore could not move it to a new place.
Approach
The dashboard does not store personal data at all. It counts returning customers by a pseudonymous hash from which identity cannot be reconstructed. As a result, GDPR obligations for the dashboard are minimal.
Data arrives through two channels: signed notifications from the shops in real time, and API polling for importing history and reconciling every hour. We rejected polling alone (delays) and direct access to the shops' databases (brittle and breaking isolation).
Implementation
Each shop runs a lightweight plugin that sends order events signed with HMAC and without personal data. The dashboard verifies the signature in a way that resists timing attacks, encrypts the shops' secrets and acknowledges receipt immediately, while a queue worker does the write. The write is idempotent, so a repeated event does not corrupt the data.
The dashboard shows revenue, each shop's share, statuses, best-selling products and the change against the previous period, with filters and export. From the start the database has a vector extension for a future AI assistant that will answer questions about sales.
Results
In a test on a development shop, the dashboard imported 4,758 orders from 2021-2026 without a single error. The test also confirmed that events with an invalid signature are rejected and that writes are idempotent.
The project is at the pilot stage. The next steps are connecting all shops in production, user roles and alerts for missing events.
