Case Study · Fan Intelligence Platform
A multi-sport fan-engagement platform that unifies attendance, predictions, and preferences across MLB, NFL, NBA, NHL, and NCAA into a single trusted record. I co-founded it, led the technical build, and managed a small team from concept through a hardened, partner-ready deployment.
My role
I developed the concept and defined the UI/UX alongside my co-founder, then led the technical build and managed a small team to deliver it. We brought on a developer partner whose work I directed — he stood up the initial infrastructure and the API feeds for ingesting sports data. From there I took ownership of the codebase: adding additional data-feed providers, expanding the database to support the full range of user-activity logging, and hardening the security posture. Deep Seats is proof that I don't stop at strategy — I build, and I lead the people who build with me.
What we built
Co-developed the category — a Fan Intelligence platform built on accumulated sports identity — and validated the opportunity through market research.
Defined the fan experience with my co-founder for capturing a longitudinal "Sports Story" of attendance, memories, and predictions.
Initial sports-data API feeds built by a developer partner I managed, then extended by me to add additional data-feed providers.
Amazon RDS for PostgreSQL with parameterized queries and point-in-time recovery. I expanded the schema to support the full range of user-activity logging.
OAuth 2.0 / OpenID Connect via Auth0 with federated Google sign-in. No end-user passwords ever stored or processed.
Every resource declared in AWS CDK and version-controlled — reproducible, peer-reviewable, and auditable environments.
Security architecture
Because the platform holds fan data on behalf of users and partners, I treated security, privacy, and availability as core product requirements — not operational afterthoughts.
Every authenticated request presents a signed JWT, independently validated against the identity provider's JWKS key set with issuer and expiration checks. Identity is resolved server-side and can't be influenced by the client. Each workload runs under a scoped, least-privilege IAM role.
TLS 1.2+ on all public endpoints with auto-renewing ACM certificates. S3 objects encrypted with AES-256; database volumes on encrypted GP3 storage with KMS-managed keys. Backups inherit encryption from the source.
Application containers run in private subnets with no public IPs and no inbound internet path — all ingress flows through the load balancer. The database sits in isolated subnets reachable only from named security groups.
Parameterized prepared statements resist injection. A code-generated GraphQL schema rejects malformed input at the protocol boundary. Uploads use short-lived presigned URLs — storage credentials never reach client devices.
Database credentials are generated at provisioning, stored in AWS Secrets Manager, and injected at container start. They never appear in source, images, or deployment config, and support centralized rotation.
Multi-AZ redundancy, 11-nines S3 durability, and infrastructure-as-code recovery. Production targets: RPO under five minutes via transaction-log shipping and RTO under one hour for full regional recovery.
Architecture at a glance
Traffic terminates at the AWS global edge, is served from isolated application tiers, and persists in managed data stores in private subnets with no direct internet route.
Amazon CloudFront (350+ edge locations, AWS Shield Standard) with TLS termination via AWS Certificate Manager.
Static web app on S3 with Origin Access Control, fronted by an HTTPS Application Load Balancer with health-checked targets.
Containerized GraphQL API and a serverless scheduled data pipeline — private subnets, no public IPs, least-privilege execution roles.
Amazon RDS for PostgreSQL, encrypted S3 object storage, and AWS Secrets Manager — isolated subnets, security-group restricted.
Privacy by design
Partner-facing insight is delivered as aggregated, de-identified audience intelligence. Data collection is minimized, monetization is explicit opt-in, and fans can access, export, or delete their data — with deletion cascading through database-level integrity constraints. Architected to support GDPR and CCPA/CPRA.
The business model
I designed Deep Seats as a compounding Fan Intelligence system across five layers — Identity, Memory, Achievement, Connection & Discovery, and Intelligence & Commerce. Each layer increases the value of those beneath it, creating a defensible data moat and a clear partner value proposition: enrich existing CRM with context, not replace it.
From concept to a secure, partner-ready deployment — building hands-on and leading the team around me — I can do for your product what I did for Deep Seats.
Start a conversation