LiveIT operations platform1-minute read

IT Hub

One secure workspace for IT requests, company assets, people, subscriptions and protected credentials.

Try Live Demo Next project

Built with

PHP 8.3
MySQL 8
Nginx
AES-256-GCM
Argon2id
Vanilla JS

Problem

Requests arrived by chat and email with no owner or status, devices changed hands without a record, and shared passwords lived in spreadsheets.

Solution

I built one secure web workspace where support requests, company assets, people and subscriptions share the same records. Permissions follow each person's role, and every sensitive action leaves an audit trail.

My contribution

Product planning, UX, full-stack build, security hardening and production deployment.

Key features

Tickets, assets, people, subscriptions and credentials in one workspace
Role-based access: each person sees what their job needs
Encrypted credential vault with an access log
Device custody history for every hand-over and return

Outcome

Every request has an owner and a status, every device a custody record, and renewals are visible before a service stops.

Built without a framework, hardened and deployed to production. The public demo runs on fictional data that resets every night.

Screens

Technical details and full write-upArchitecture, security, testing and decisions, for readers who want the detail.

Overview

IT Hub brings day-to-day IT operations into one secure workspace. It combines support requests, asset tracking, employee operations, subscription oversight and protected credential management with clear permissions and audit history.

The operational challenge

Requests arrived by chat and email, so nothing had a single owner or a status.
Devices moved between people with no record of who held what.
Shared credentials lived in spreadsheets and private notes.
Renewals were noticed when a service stopped working.
Arabic and English users needed the same system, not two.

The solution

One workspace for tickets, assets, people, subscriptions and credentials.
Role-based access so each person sees only what their job needs.
An encrypted vault with reveal-on-demand and a full access log.
Custody history that records every device hand-over and return.
A bilingual interface built in from the start, not translated on top.

My role

Product planning, UX structure, full-stack implementation, bilingual experience, security hardening, demo preparation and production deployment.

Core modules

Eight areas, each usable on its own and stronger together.

IT Support Tickets — priorities, assignment, replies, internal notes and attachments.
Asset Management — serial numbers, warranty dates and an append-only custody history.
Employee Operations — a searchable directory with departments, business units and locations.
Team & Role Management — administrator, IT agent and employee roles with distinct permissions.
Subscription Tracking — renewal dates, per-currency cost and one-click renewal.
Encrypted Credentials Vault — AES-256-GCM storage, two-factor unlock, reveal on demand.
Activity & Audit History — who did what, when, including every credential reveal.
Arabic & English Interface — full right-to-left layout, not a mirrored afterthought.

Role-based experience

The same system presents a different surface to each role — try all three in the demo.

Administrator

Full reach: users and org structure, the activity log, subscriptions and the credentials vault.

IT Agent

Handles tickets and device custody and can open the vault — but not user administration.

Employee

Raises and follows their own requests and browses the employee directory. The vault is not visible at all.

Security and privacy

Credentials encrypted with AES-256-GCM; the vault key is derived from a master passphrase and never stored.
Unlocking the vault takes two factors — the account password and the master passphrase.
Every reveal is written to an access log that administrators can review.
Prepared statements throughout, CSRF protection on every state-changing request, and password hashing with automatic rehash.
Content-Security-Policy, HSTS and Permissions-Policy set at the edge, each sent once.
Login throttling per account and per address, with a fixed lockout window.

How the public demo stays safe

The demo is a real, fully interactive instance — with guard rails.

Every record is fictional. There is no real employer, employee, customer or operational data anywhere in it.
You can create and edit tickets, assets and subscriptions freely.
Destructive actions — deleting records, changing passwords, sending invitations — are blocked and logged instead.
The database resets to a clean fictional state automatically every night, so the demo is always presentable.

Selected interface

Captured from the live demo. All names, devices and records are fictional.

IT Hub public landing page in English showing the headline and the live demo button — Public landing page — bilingual, with a direct route into the demo.

Sign-in page showing three demo roles: administrator, IT agent and employee, each with a Use this account button — Three demo roles, each one click away. Nothing is submitted for you.

Administrator dashboard showing open tickets, assets on record, vault records and yearly subscription cost — Administrator dashboard: workload, assets, vault records and yearly subscription cost.

Ticket list with status, priority, requester and assignee columns using fictional demo data — Ticket list with status, priority, requester and assignee.

Ticket detail view with conversation, attachments and status actions — Ticket detail with conversation, attachments and status actions.

Asset register listing laptops and a monitor with serial numbers, custody status and warranty dates — Asset register with serial numbers, custody status and warranty dates.

Asset detail page with hand over and return controls and an append-only movement history — Asset detail — hand over, return, and an append-only movement history.

Employee directory with employee numbers, job titles, departments, business units and work locations — Employee directory with departments, business units and work locations.

Subscription list showing renewal dates, monthly and yearly cost per currency and owners — Subscription tracking with renewal dates and per-currency cost.

Password vault in its locked state with every password masked and reveal disabled — The vault in its locked state — every secret masked, reveal disabled.

The same ticket list rendered right-to-left in Arabic with a mirrored sidebar — The same screen in Arabic: a genuine right-to-left layout.

IT Hub landing page on a narrow mobile viewport with stacked content and no horizontal scrolling — Mobile layout — stacked, readable, and free of horizontal scrolling.

Technology and delivery

Built from scratch without a framework, then hardened and deployed to production.

Stack

PHP 8.3
MySQL 8
No framework
nginx
AES-256-GCM
Argon2id
Vanilla JS
CSS design tokens
Arabic / English i18n
Automated test suites

Key takeaways

Bilingual is a structural decision. Retrofitting right-to-left is far more expensive than designing for it on day one.
An audit trail is a feature. People trust a credentials vault because it records who looked, not because it promises nobody did.
A public demo needs its own safety model — read-only would have been useless, so the guard rails sit on destructive actions instead.
No framework kept the dependency surface small and the behaviour easy to reason about.