TRC — Legal-Tech Integration Middleware

The problem

A law firm's workflow for medical-record requests was split across three systems — a case platform (Litify on Salesforce), a document system (Filevine), and a support desk (Zendesk). Status lived in all three and agreed in none. The work was a middleware that keeps them in sync automatically, without losing or duplicating updates, and without leaking protected health information along the way.

In legal-tech, "mostly synced" isn't acceptable: a missed status change is a compliance problem, and a mishandled record is a privacy one.

The architecture

A Laravel service sits between the systems, consuming their webhooks and pushing normalized status back out, with MySQL as the system of record and queues smoothing over each provider's quirks.

Idempotency and verification

Every inbound webhook is HMAC-verified before it's trusted, and every job is idempotent — the same event delivered twice produces the same result once. That's what makes bidirectional sync safe: a retried or duplicated webhook can't double-apply a status change.

Tokens, audit, and redaction

OAuth 2.0 tokens for each provider are managed and refreshed centrally. Every state change is written to an audit trail for compliance, and PHI/PII is redacted before anything is logged or forwarded, so sensitive medical data never lands somewhere it shouldn't.

Outcomes

What this taught me

Integration middleware is unglamorous until it's wrong. Idempotency, HMAC verification, and redaction weren't nice-to-haves here — they were the whole point, and the test suite is what let me trust the sync in a domain where mistakes have legal weight.