Case studies · Soulside
Soulside cut deployments from hours to minutes and holds 99.9%+ uptime at peak
Soulside moved from tightly coupled EC2 servers to containers on Amazon ECS with automated CI/CD, centralized secrets and proactive monitoring.
- Client
- Industry
- Behavioral health technology
- Location
- Mountain View, California, United States
- Engagement
- DevOps and infrastructure management
What Cypik delivered
- Containerized the application and moved it to Amazon ECS on AWS Fargate across two Availability Zones
- Automated build and release with GitHub, AWS CodePipeline, CodeBuild and Amazon ECR
- Centralized secrets and tightened IAM across development, UAT and production
- Built proactive monitoring and log analytics with CloudWatch, OpenSearch and Athena
Results in brief
- 99.9%+ uptime at peak usage
- Deployment time reduced from hours to minutes
- No hard-coded credentials in code, images or pipelines
- Capacity follows real-time demand, with no manual scaling
The client
About Soulside
Soulside is a healthcare technology company that specializes in AI solutions for behavioral and mental healthcare providers. Its platform supports clinical documentation, chart auditing, compliance monitoring and revenue cycle management, helping organizations streamline administrative processes and improve operational efficiency.
The platform provides automated assessments, admission records, treatment plans, individual and group therapy notes, and analytics to support clinical supervision. It also supports billing workflows with coding insights, claim denial prevention and appeal assistance, and integrates with existing electronic health record systems.
Soulside serves outpatient programs, residential treatment facilities, community mental health clinics and specialized care providers, helping healthcare teams reduce documentation workloads, strengthen audit readiness and spend more time on patient care.
Challenge
A fast-growing platform held back by manual infrastructure work
Soulside's platform supports clinical documentation and billing for behavioral health providers, so slow releases, outages or weak controls reach its customers directly.
The application ran entirely on EC2 instances with tightly coupled services. Every release, scaling decision and patch cycle needed hands-on effort from a small engineering team.
- 01
Downtime risk. traffic was unpredictable, and spikes created performance bottlenecks that manual scaling could not absorb in time.
- 02
Release risk. deployments were partly manual, which lengthened release time and raised the chance of human error.
- 03
Exposure. secrets were not centralized and IAM boundaries needed to be stricter, which put credentials and access at risk.
- 04
Visibility. logs were distributed and monitoring was reactive, so incidents were found late and troubleshooting was slow.
- 05
Operational drag. OS patching, scaling and environment consistency across development, UAT and production consumed engineering time.
Solution
What Cypik delivered
Architecture
- We containerized the applications and migrated them to Amazon ECS on AWS Fargate, which removed EC2 management and lets capacity follow real-time demand.
- Front-end and back-end ECS services run in private subnets across two Availability Zones, with auto scaling and automatic service recovery. FluentBit ships container logs from each service.
- An Application Load Balancer in a public subnet is the only entry point, with Cloudflare in front providing WAF and DDoS protection.
- Each zone has its own data tier, with Amazon RDS (Multi-AZ, with Aurora), ElastiCache for Redis and Amazon EFS, so a zone failure does not take the data layer down.
- Amazon CloudFront delivers static assets, Amazon S3 holds media assets and ALB logs, and Amazon SES sends application email.
Delivery
- Developers push to GitHub, and AWS CodePipeline runs Source, AWS CodeBuild and Amazon ECR to build, scan and release container images.
- Security scans and automated deployments are part of the pipeline, which reduces manual intervention and release time.
Security
- Secrets live in AWS Systems Manager Parameter Store and AWS Secrets Manager, accessed through IAM roles, so nothing is hard-coded.
- A least-privilege IAM model applies across development, UAT and production, with AWS Systems Manager providing controlled operational access.
Operations
- Amazon CloudWatch collects logs and alarms, Amazon OpenSearch provides application log analytics, and Amazon Athena queries ALB logs stored in S3.
- Amazon SNS alerts surface problems proactively, and AWS CloudTrail records API activity for audit.
Architecture
How it is built.
Select a diagram to open it at full size.
Outcome
A scalable, secure, cloud-native foundation
- 99.9%+
- Uptime at peak usage
- Hours to minutes
- Deployment time
The new architecture lets the platform handle peak usage with 99.9%+ uptime and gives Soulside a foundation to keep growing without adding infrastructure headcount.
- 01
Fully automated CI/CD pipelines cut deployment time from hours to minutes, so fixes and features reach customers sooner.
- 02
Running across two Availability Zones with automatic service recovery removes the single-server failure mode of the earlier EC2 design.
- 03
Infrastructure costs were optimized through on-demand container scaling and right-sized resources.
- 04
Security improved through least-privilege IAM, encrypted secret storage and continuous vulnerability scanning in the pipeline.
- 05
Centralized logging, alarms and log analytics replaced reactive monitoring, which speeds incident detection and resolution.
Security
How the environment is secured
A combination of identity management, network controls, continuous monitoring and automated governance keeps the platform secure, compliant and highly available.
Identity and access management
- A least-privilege access model is applied across DEV, UAT and PROD.
- ECS tasks and CI/CD systems use IAM roles to avoid long-lived credentials.
- Access boundaries rely on role-based permissions and separation of duties.
Network security
- All ECS services, RDS, EFS and ElastiCache components run inside a secure VPC.
- Security groups enforce strict inbound and outbound rules, limiting communication to approved ports and services.
- Public-facing traffic passes through Cloudflare, which provides WAF and DDoS protection, and then an Application Load Balancer, while back-end services stay isolated in private subnets.
Secrets and data protection
- Application secrets, database passwords and tokens are stored in AWS Systems Manager Parameter Store and Secrets Manager, with automatic encryption and auditing.
- There are no hard-coded secrets in application code, Docker images or pipelines.
Monitoring, logging and audit
- AWS CloudTrail is enabled across the account to capture API-level activity for auditing and forensic analysis.
- Amazon CloudWatch is configured with dashboards, alarms and log groups for ECS, ALB and application logs.
- ALB access logs are stored in Amazon S3 and queried with Amazon Athena.
- Amazon OpenSearch is integrated with Fluent Bit for centralized log analytics, latency monitoring and error trend analysis.
Backup, recovery and high availability
- Automated daily backups are configured for RDS, with retention policies applied as the business requires.
- ECS services are designed for high availability across multiple subnets with auto-scaling.
- Multi-AZ database configurations provide fault tolerance.
Services and technology
What the environment runs on.
Compute and containers
- Amazon ECS on AWS Fargate
- Amazon Elastic Container Registry (ECR)
- EC2 Auto Scaling
Networking and delivery
- Amazon VPC
- Application Load Balancer
- Amazon CloudFrontStatic assets
Storage and data
- Amazon RDS and Aurora
- Amazon ElastiCache (Redis)
- Amazon EFS
- Amazon S3Media assets and ALB logs
Identity and security
- AWS IAM
- AWS Systems Manager Parameter Store
- AWS Secrets Manager
- AWS CloudTrail
CI/CD
- AWS CodePipeline
- AWS CodeBuild
Monitoring and logging
- Amazon CloudWatchLogs and alarms
- Amazon OpenSearch ServiceApplication logs
- Amazon AthenaALB log queries
- Amazon SNSAlerts
Communication
- Amazon SESEmail
Other technology
- CloudflareWAF and DDoS protection
- GitHubSource control
- FluentBitLog shipping from containers
More case studies
Related work.
Sinclair Customer Metrics
Centralized security and governance across Sinclair's multi-account AWS environment
PrimaSolv
PrimaSolv removed a single point of failure and automated patching and file transfer on AWS
AppsTek Corp
A secure, highly available EC2 container platform for AppsTek's enterprise workloads
Want results like these in your environment?
Start with a read-only assessment. You keep the written findings either way.