Technical note · Published on 25 September 2026
Six hundred PhD students and not one spreadsheet left
A request from Université Paris Cité, one monitoring committee a year per PhD student, and an application that takes the whole chain, from the file to the final PDF, alongside FileMaker.
Université Paris Cité contacted me for this project. Every PhD student must be seen once a year by an individual monitoring committee, required by the French decree of 25 May 2016, and its report conditions re-enrolment. For around 600 PhD students across five departments, everything ran on Word forms, e-mails and spreadsheets. The school wanted to recover the hours that circuit cost every year.
The application takes the whole chain. Administration imports a FileMaker export, tolerant on encoding and columns, and sends the links, one by one or in bulk. The student fills in their file and uploads their report. A committee member writes the report, with a confidential section reserved for the management. The department head receives everything, and the final report goes to the student, thesis supervisor in copy. A PDF at each step.
The questionnaire is configured without me. Ten question types, mandatory or not, visible or not in the PDF, confidential or not, and a bulk export to prepare a campaign on the side. A confidential question is hidden in the student's version regardless of its visibility flag, and the anomaly is logged.
FileMaker remains the administrative reference. Six flags describe a file's progress and form the identifier sent back to FileMaker, and three key-protected export routes feed its connector. On the application side, MongoDB is the source of truth.
On security, a hashed password then a single-use code by e-mail, a global guard on every route, uploaded files no longer freely accessible, and a log of every request, in the database with a twelve-month purge, also forwarded to an external syslog collector so it survives a compromise of the machine.
About 16,000 lines of TypeScript, NestJS and React, on Debian 13 with PM2 and nginx. Known limits, such as the student link without a token, are documented in the file handed to the security officer rather than left unsaid. The project page is a case study, with reconstructed screens and fictional data.