Conformity / IronStratus
"From founding vision to enterprise-grade security and a multi-million dollar acquisition by Thales."
IronStratus (formerly Conformity) recognized a massive structural gap in the early cloud era: while enterprises were moving workloads to AWS, their identity management remained tethered to legacy, local Active Directory environments. They partnered with NexaSoftAI to build a bridge—a cloud-native Identity as a Service (IDaaS) platform capable of meeting the rigorous security, auditing, and scalability demands of Fortune 500 companies. This partnership didn't just build a product; it built an enterprise-grade security asset that eventually led to a successful strategic acquisition by Gemalto (now Thales).
01Project Background
The early 2010s marked a chaotic transition period for enterprise IT. The "Consumerization of IT" and the rise of SaaS meant that corporate data was suddenly scattered across dozens of platforms outside the traditional perimeter. IronStratus saw that the bottleneck for cloud adoption wasn't just "the cloud" itself, but the lack of a centralized, secure control plane for identity. Existing solutions were either too "on-premise" (like IBM or CA) or too "consumer-grade." They needed a platform that felt native to the cloud but spoke the language of the enterprise CIO—Security, Compliance, and Control. This required more than just simple authentication; it required a deep understanding of corporate governance, cross-domain trust relationships, and the emerging standard for web-scale identity. NexaSoftAI was brought in to provide the heavy architectural lifting required to turn this high-level vision into a production-ready, security-hardened SaaS platform that could confidently sit in the critical path of every enterprise user interaction.
The Challenge
The technical challenges were multifaceted and high-stakes. First, we had to solve the "Multi-tenant Security Paradox": building a system where data from competing global banks could reside on the same infrastructure while being mathematically and architecturally isolated. A single leakage between tenants would have been fatal to the company. Second, the platform required a high-performance "Policy Decision Point" (PDP) that could evaluate complex access rules in under 100 milliseconds to avoid degrading the user experience during every login attempt. Third, we had to build "Universal Connectors" for legacy systems like LDAP, Active Directory, and early SAML implementations, many of which had non-standard behaviors that varied across different versions and vendors. Finally, the platform needed to be "Compliance-Native" from day one—every single action, from a login attempt to a policy change, had to be recorded in an immutable, cryptographically signed audit log to satisfy SOC 2, HIPAA, and internal corporate auditors. We were essentially building a fortress that had to look and feel like a modern, agile web application.
02Implementation Process
Our implementation followed a "Security-First" Agile methodology that was ahead of its time. Each two-week sprint concluded with not only a feature demo but a mandatory code review by a dedicated security architect and a "Red Team" session where we intentionally tried to break the new functionality. We started with the "Identity Primitives"—building the core user, group, and permission models—and then radiating outward to build the access policy engine and the connector framework. We heavily utilized "Threat Modeling" sessions before starting work on any sensitive component, identifying potential attack vectors and building mitigations into the design itself. Continuous Integration (CI) included automated penetration testing tools and static analysis to catch common vulnerabilities (like those in the OWASP Top 10) before they ever reached a staging environment. We also maintained a "Developer Sandbox" environment that allowed the IronStratus sales team to demonstrate the platform to prospects with real-time configuration changes, proving the platform's agility alongside its security.
Our success was rooted in a "Systems Thinking" approach that looked beyond immediate features to the long-term health of the ecosystem. We didn't just write features; we built a foundation based on the hardest problems first—multi-tenancy, immutable auditing, and high-performance policy evaluation. By de-risking the core architecture early, we ensured that the platform wouldn't hit a "technical wall" as it grew. Our deep partnership with the client's vision, combined with our uncompromising stance on security-by-design, created a product that wasn't just technically sound, but strategically valuable. We treated the product as a "Security Asset," knowing that for an acquirer like Thales, the technical integrity was the most important part of the deal. This strategic alignment between engineering and business outcomes is what allowed us to deliver a world-class exit.
Our engineering services focus on delivering high-impact solutions through a methodology that balances speed with long-term stability.
Technical Architecture
The technical architecture was designed around the principle of "Defense in Depth." At the infrastructure level, we utilized AWS VPCs with strict security group isolation and private subnets for all database and processing nodes. Each microservice was containerized and communicated via an encrypted internal service mesh, ensuring that even internal traffic was secured. For data persistence, we utilized a "Sharded Database per Tenant" strategy for the most sensitive identity metadata, ensuring that even a catastrophic database breach would be contained to a single customer. The authentication layer featured an extensible "Plugin Architecture," allowing us to rapidly add support for new Multi-Factor Authentication (MFA) providers like Duo, RSA, and emerging SMS-based tokens. We also implemented a sophisticated "Identity Resolution Engine" that could merge user records from multiple fragmented sources (e.g., an HR system like Workday and a marketing database) into a single, authoritative global identity. This was built using a combination of Java/Spring for the core logic and a high-performance C++ module for the most latency-sensitive cryptographic operations.
Key Features
Business Impact & Outcomes
The business outcomes were transformative and measurable. By the end of our 18-month engagement, the platform was handling millions of identity transactions per month for a client roster that included Fortune 100 leaders and government agencies. The robust security architecture and "Enterprise-Ready" feature set allowed IronStratus to move from seed stage to being a major contender in the IDaaS space, competing successfully against established giants. The technical due diligence performed by Gemalto’s (now Thales) acquisition team was exhaustive, spanning three months of deep code review and penetration testing. The quality of the codebase, the rigor of the security practices, and the scalability of the architecture were cited as primary drivers for the final purchase price. The exit provided a massive return for founders and investors, and even more importantly, the technology we built became the core of Gemalto’s cloud security strategy, providing a sustainable competitive advantage in the global cybersecurity market.
Lessons Learned
Building for the enterprise taught us that "good enough" security is never enough—it must be verifiable, auditable, and resilient. We learned that performance and security are often in tension, but through careful asynchronous processing and optimized data structures, they can co-exist without compromise. We also learned the value of "Operational Transparency"—the more visibility you give an enterprise customer into how you are securing their data, the more they trust your platform. Finally, we proved that a small, highly disciplined engineering team with the right architectural approach can out-build much larger competitors by focusing on core technical excellence and a deep understanding of the client's strategic roadmap. This project cemented our belief that engineering choices should always be aligned with the long-term M&A value of the company.
Future Scalability
The architecture we designed proved to be remarkably resilient and forward-looking. Post-acquisition, the platform continued to scale under Gemalto/Thales’ global umbrella, supporting even larger datasets and more complex international compliance requirements (like GDPR) without needing a fundamental re-platforming. The modular nature of the microservices allowed Thales to integrate the identity engine into their broader cybersecurity portfolio, including their hardware security modules (HSMs). The platform eventually scaled to support tens of millions of users globally, proving the long-term value of our "built-to-last" engineering philosophy. The code we wrote in 2012-2013 remained in production for over a decade, a testament to the durability of the initial design decisions.
Related Success Stories
View AllNeed Similar Results?
Whether you're looking for cloud infrastructure consulting or AI-driven development, our team is ready to accelerate your roadmap.