Executive Summary
Bundeszulassung24 is a production-ready platform for fully digital vehicle registration processes in Germany. In roughly 5 months, an end-to-end system was built that guides end customers through a structured application process, processes payments via Stripe, analyzes documents using AI, manages internal teams through role-based panels, and maintains a complete audit trail for every application lifecycle event.
The platform runs on containerized infrastructure with automatic SSL management, serves a PWA-capable frontend with 30+ SEO-optimized pages, and integrates an AI chatbot for customer consultation. Conception, architecture, implementation, and operational stabilization were fully managed by Creatys, with overall technical leadership by Yılmaz Saraç.
Platform Architecture: Monorepo Structure
The decision for a monorepo (Turborepo v2 + pnpm v9) was architecturally central: type consistency from database schema to frontend input, shared validation rules, and a single package tree reduce integration errors and shorten the feedback loop for changes.
| Layer | Technology | Rationale |
|---|---|---|
| API | Fastify 4 + TypeScript 5 (strict) | ~2x faster than Express, native JSON schema, plugin architecture |
| Customer Frontend | Next.js 14 App Router | SSR + CSR hybrid for SEO-critical landing pages and interactive forms |
| Admin/Operator | Refine.dev 4 + Ant Design 5 | CRUD-optimized, built-in RBAC patterns, rapid panel development |
| Database | PostgreSQL 16 | ACID, JSONB for flexible form data, proven ecosystem |
| Cache / Sessions | Redis 7 | Rate limiting, session management, Fastify plugin integration |
| Object Storage | MinIO (self-hosted, S3-compatible) | Documents stay in Germany (GDPR), no cloud lock-in |
| Payment | Stripe | PCI-DSS compliant, multi-method (Card, Apple Pay, Google Pay, Klarna) |
| Document Analysis | OpenAI GPT-4o Vision | OCR + AI extraction from registration certificates, IDs, insurance confirmations |
| Gmail API (OAuth2) | Transactional emails without third-party services, full control | |
| Reverse Proxy | Traefik v2.11 | Automatic Let's Encrypt certificates, Docker-native |
| AI Chat | OpenAI GPT-4o | Domain-specific customer consultation with structured system prompt |
Data Model: 22 Tables, 13 Enumerations
The database schema is defined in Prisma 5 and fully maps the business domain: user accounts, submissions, vehicles, documents, payments, version history, comments, assignments, and SEO/AI management tables.
Core Models
| Model | Fields | Purpose |
|---|---|---|
| User | 25 | Customers + staff, 5-tier role model, corporate customer fields, security fields |
| Submission | 20 | Central process instance, reference number B24-XXXXXX, 11-stage status, JSON form data, price triple |
| SubmissionVersion | 10 | Audit trail: every change creates a new version with snapshot and change source |
| Vehicle | 23 | Complete vehicle data: VIN, license plates, plate type, security codes, insurance confirmation |
| Document | 14 | Uploaded documents with MinIO path, OCR flag, confidence score and extracted data |
| Payment | 14 | Stripe integration: PaymentIntent ID, 6 payment methods, partial refunds |
API Architecture: 14 Route Modules, 50+ Endpoints
The API is built as a modular Fastify plugin system. Every request passes through a fixed pipeline: Helmet CORS Rate Limiting (Redis, 100 req/min) JWT verification Zod validation Business logic Response.
Security Architecture: 12 Layers
HTTPS enforcement, JWT with token rotation, 5-tier RBAC, brute-force protection (account locking after 5 failed attempts), Zod input validation, XSS prevention (isomorphic-dompurify), CORS whitelist, Redis-backed rate limiting, security headers (@fastify/helmet), file upload limits, httpOnly/secure cookies, and global error handling with email notifications for 500 errors.
AI-Powered Document Analysis (GPT-4o Vision)
The analysis endpoint processes uploaded documents via GPT-4o Vision: up to 5 files simultaneously, domain-specific OCR + field extraction, 5 document type-specific mapping tables (Registration Certificate Part I: 14 fields, Part II: 3 fields, ID card: 9 fields, insurance confirmation: 3 fields, SEPA: 4 fields), and confidence scoring per field (0.0-1.0).
Intelligent Service Router
Instead of requiring customers to know the correct registration type, the Service Router (551 lines) implements a rule-based decision tree covering: Deregistration (EUR 29), New Registration (EUR 149), Re-registration (EUR 129), and Transfer (EUR 139). Each result shows price, required documents, estimated duration, and warnings.
Customer Frontend: Next.js 14 PWA with 30+ Pages
SSR-optimized content pages (pricing, FAQ, locations, knowledge base) and interactive client components (multi-step forms, dashboard, authentication). Cookie consent with 4-category granularity and accessibility toolbar (font size, high contrast, reduced motion).
Admin Panel & Operator Panel
Admin: Refine.dev 4 with real-time dashboard (14 parallel DB queries), submission and user management, Stripe payment overview, knowledge base editor (Markdown), and SEO management (6 sub-modules). Operator: separate Vite project with prioritized queue, document download, status changes with version tracking, and email-based document requests.
Email System & Infrastructure
Gmail API (OAuth2) with 12+ transactional email templates and automated abandoned-draft reminders. Production infrastructure: 8 Docker containers with Traefik reverse proxy, automatic SSL via Let's Encrypt, multi-stage builds with non-root users, and immutable.env files on server.
SEO & AI Visibility
Dynamic JSON-LD (8+ schema types), state-based geo-SEO pages, llms.txt endpoint, granular AI permissions, and E-E-A-T signals, all managed from the database via Admin panel.