Senior Frontend Engineer / Frontend Team Lead at Untap

Untap

Multi-tenant platform for hiring, innovation programs, competitions, and grants

When: Dec 2022 – Apr 2026
Team: Frontend Team Lead from Jan 2025: architecture decisions, code reviews, and mentoring.

Vue 3
Multi-tenant SaaS
SurveyJS
GrapesJS
AI screening
Stripe
ISO 27001

In short

Untap gives organizations one platform to run hiring campaigns, innovation challenges, awards, and grant programs; its site reports more than 400 programs, one million participants, and 100 customers. Each client gets its own branded platform on a subdomain or custom domain. I joined in December 2022, became the main frontend contributor, and led the frontend team from January 2025 until I left in April 2026. The work ranged from the multi-tenant foundation to the AI layer, payments, performance, and the security remediation behind the company's ISO 27001 certificate.

My role and scope

I owned the frontend architecture: the multi-tenant foundation, the builders and the AI layer on top of them, the Stripe integration, the performance work, and the security remediation. As Frontend Team Lead from January 2025 I made the architecture decisions, ran code reviews, and mentored the frontend engineers. Backend services and the AI models were built by other teams; I integrated them.

Promoted to Frontend Team Lead in January 2025 after becoming the primary frontend contributor. I set the frontend standards, reviewed the team's pull requests, and paired with engineers on the harder pieces: tenant configuration, the builders, and the performance work.

The problem

A hiring team, an innovation office, and a national award run very different programs, yet all of them need the same building blocks: a branded public site, a submission form, rounds of evaluation with judges and rubrics, and reporting. Untap had to serve dozens of clients, each with its own theme, roles, domain, and configuration, from one product.

On the frontend that meant one codebase for three experiences (admin, customer dashboard, public portal), builders that program teams could use without developers, and dashboards that stayed fast as the data grew.

How it is built

One Vue 3 codebase serves the three experiences. At boot the app reads the subdomain and routes into the admin, the client dashboard, or the public portal; per-client theme, permission roles, and runtime configuration are loaded for that tenant, so dozens of distinct client deployments run from the same build.

Program teams configure their programs through two builders I customized heavily: a schema-driven submission and evaluation form builder on SurveyJS, and a drag-and-drop page builder on GrapesJS. On top of them I added an AI layer that generates forms and pages from a prompt and screens participant submissions before judge review. Stripe lets clients charge participants for submissions.

Initial dashboard load dropped by 40% after Vite build optimization, route-level code splitting, and a state-management refactor. During the ISO 27001:2022 certification I owned the frontend remediation: auth tokens moved from localStorage to HTTP-only cookies and vulnerable dependencies were replaced until the audit passed.

One Vue 3 codebase, routed by subdomain at boot
        ├── Admin (Untap staff)
        ├── Client dashboard (per tenant: theme · roles · runtime config)
        └── Public portal (program sites on client subdomains or custom domains)
                    │
        ┌───────────┴───────────┐
   SurveyJS form builder    GrapesJS page builder
   (submission · evaluation)  (public pages)
        └───────────┬───────────┘
          AI layer: generate from a prompt · screen submissions
                    │
   Stripe (paid submissions) · HTTP-only cookie auth (ISO 27001)

Key decisions

One codebase, routed by subdomain

Admin, customer, and public experiences share components and tenant configuration; three apps would have tripled the work on every feature.

Customize established builders instead of writing our own

SurveyJS and GrapesJS already solve schema editing and drag-and-drop layout; our effort went into tenant theming, program logic, and the AI layer on top.

HTTP-only cookies over localStorage for auth

Tokens in localStorage are readable by any injected script; cookies the browser controls closed the finding raised in the ISO audit.

Measure load before and after

The 40% figure comes from comparing initial dashboard load before and after the Vite, routing, and state changes, not from an estimate.

What it changed for the product

Lets Untap onboard a new client as configuration, not a new deployment.
Lets program teams build forms and public pages themselves, with AI drafting the first version.
Opened paid submissions as a revenue option for clients through Stripe.
Contributed the frontend part of the company's ISO 27001:2022 certification.

Hard parts and how I solved them

Dozens of clients from one codebase

What I didDesigned the multi-tenant foundation: subdomain-based routing into the three experiences, per-client theming, permission roles, and runtime configuration loaded per tenant.

Builders that non-developers can use

What I didIntegrated and extensively customized SurveyJS and GrapesJS, then added an AI layer so program teams generate a form or a public page from a prompt and let AI screen submissions before judges see them.

Dashboards that got slower as clients grew

What I didCut initial dashboard load time by 40% with Vite build optimization, route-level code splitting, and a state-management refactor.

Passing the ISO 27001:2022 audit on the frontend

What I didMoved auth tokens from localStorage to HTTP-only cookies and replaced vulnerable dependencies, iterating with the auditors until the certificate was granted.

Charging participants

What I didIntegrated Stripe so clients can charge participants for submissions as part of the program setup.

What I would do differently

Auth tokens lived in localStorage for the first years and the ISO audit forced the move to HTTP-only cookies. I would make that the default on day one, together with a dependency-audit step in CI, so security work is routine instead of a certification sprint.

Stack and what each part does

Vue 3 + ViteOne codebase for admin, customer, and public experiences; route-level code splitting
SurveyJSCustomized schema-driven form builder for submissions and evaluation
GrapesJSCustomized drag-and-drop page builder for public program pages
AI layerForms and pages generated from a prompt; screening of submissions before judges
StripePaid submissions for client programs
Access controlPermission roles per tenant, HTTP-only cookie sessions