RISC (Radical Innovation for Social Change) was a University of Chicago non-profit founded by economist Steve Levitt to build solutions for social good across education, health care, climate change, and criminal justice. Its criminal justice project centered on an electronic monitoring application that supported house arrest as an alternative to incarceration, designed to replace radio-frequency systems that could only detect whether a person was home at night. The application was built as microservices in Go, React, and Elixir, processed personal data from agencies across different industries, and was offered to law enforcement at no cost. Two full-time developers built and ran it, alongside about two dozen other employees.
The project was funded by donors and University grants and generated no revenue by design; the application was free to agencies to encourage adoption and keep feedback honest. That squeezed the budget from both sides. The development team had to stay at the bare minimum, and a full-time DevOps engineer was off the table. Meanwhile the early prototype ran on rudimentary processes, CSV files and FTP file sharing for data transfers, and demand was pushing the team toward a fully operational version with real-time GPS alerts. The team needed to deploy without a DevOps team: infrastructure that was easy to set up, quick to execute, and cheap enough for a non-profit.
The application sat at the center of many agencies and processed large volumes of sensitive personal data from siloed sources across different industries. That data had to stay siloed: no cross-agency access, no public access. The team restricted access to approved IP addresses and needed fine-grained data access control through network segmentation and tenant separation. On top of the architecture, the agency agreements required compliance with Criminal Justice Information Services (CJIS) Security Policy requirements, with agencies specifying how data had to be processed. Balancing a public-facing application, segmented networks, and per-agency access restrictions presented real data access challenges for a two-developer team.
The team standardized on AWS because it was the platform they knew best, and they wanted a scalable, DevOps-enabling architecture built on modern container orchestration. Convox fit the constraints. Builds and deploys were easy to set up and execute with little effort. The platform accommodated the microservices architecture and gave the team a workable access control solution for the segmented, multi-tenant setup. Compliance mattered too: Convox could be adapted into AWS GovCloud environments. And logging and tracing came at no extra cost, real value on a non-profit budget. The team rolled out the application without adding DevOps expertise.
With Convox handling the infrastructure requirements, the two developers spent their time on product development and improvement instead of deployment work. The prototypes became real-time production applications: the CSV and FTP era gave way to an operational electronic monitoring system handling real-time GPS alerts and output. And the platform scaled. The user base grew from 200 to 3,000 in about four months, still with no full-time DevOps engineer. That was the point for a donor-funded organization: productive hours went into the monitoring program itself rather than into managing infrastructure.
First, compliance: the requirement here was CJIS, a different regime from HIPAA, and the compliance obligations under the agency agreements remained RISC's to meet. Convox supplied the secure deployment layer, access control, and adaptability into AWS GovCloud. Teams evaluating Convox for HIPAA or similar regimes should read this as adjacent evidence, not equivalence. Second, this story reflects the period when it was originally written, and details like team size, user counts, and tooling reflect that period. What holds up is simpler: a two-developer non-profit ran security-sensitive, multi-agency infrastructure without hiring a platform team.
