Novem Digital Risk Platform

The challenge

Novem's operations teams were working across four disconnected tools: a ScriptString EAA dashboard, a BigWave analytics export, manual Excel capital planning sheets, and a separate mapping tool. There was no single source of truth for risk. A site could show Green in one system and Yellow in another, depending on which data feed was most recently synced. The client needed a platform that spoke one risk language - a consistent 0–100 score visible at a glance - while still preserving the depth of each underlying data source. Integration complexity was high: ScriptString and BigWave use different data schemas, update frequencies, and authentication methods. On top of that, the platform needed to accommodate future IoT sensors and AI-driven predictive modules without requiring a full rebuild. Security and auditability were non-negotiable - the platform would eventually be used for insurance and compliance reporting.

The solution

We started with a two-week discovery sprint to map every data source, define the risk model, and agree on the health matrix scoring logic with Novem's domain experts. This upfront investment meant the architecture was locked before a line of production code was written. The frontend was built with React 19 and TypeScript, using TanStack Query for server-state management, Recharts for risk visualisations, and a custom map layer for geographic portfolio views. We embedded Apache Superset for advanced analytics, configuring it to run within the app's auth context so users never leave the platform for reporting. The Node.js/Express backend acts as an integration hub: it normalises data from ScriptString EAA and BigWave into a unified schema, runs the configurable risk engine, and exposes typed REST endpoints. The risk scoring logic is fully configurable via JSON - Novem's team can adjust thresholds and weighting without a code deployment. Predictive modules (Arc Flash, Wildfire, Transformers, Mechanical, Water Leak) were built as independent services plugged into the main risk engine, so they can be updated or extended without touching the core platform. The IoT sensor layer uses a webhook-ready architecture, ready to receive vibration, air quality, weather, and energy readings from any connected building system.

Project details

Novem Digital operates in a high-stakes world: facility managers and risk officers responsible for large building portfolios need to act fast when something goes wrong. Before the Digital Risk Platform (DRP), their teams were switching between spreadsheets, disconnected sensor dashboards, and manual capital planning tools - losing hours every week to data reconciliation and missed early warnings.

We were brought in to architect and build a unified, cloud-ready web application from scratch. The DRP ingests live and historical data from ScriptString's Enterprise Asset Advisor (EAA) and BigWave, runs a fully configurable risk-scoring engine, and presents everything in a single React dashboard. Every site in a portfolio gets a 0–100 risk score with a clear Green/Yellow/Red status - giving operations teams an instant read on where to focus.

The platform includes five predictive hazard modules - Arc Flash, Wildfire, Transformer failure, Mechanical degradation, and Water Leak detection - each pulling from their own data pipeline and surfacing actionable thresholds. A 'Know Your Building' intelligence layer connects to IoT sensors for vibration, weather, decibel levels, air quality, and energy consumption, setting the foundation for AI-driven anomaly detection in future phases.

Capital planning is built in as a first-class feature. Facility managers can model machinery risk, prioritise replacement cycles, and generate reports for internal finance teams - all without leaving the platform. Embedded Apache Superset handles complex analytics and custom reporting, while interactive maps give geographic context to risk distributions across a multi-site portfolio.

The entire stack was delivered with enterprise-grade security: Helmet headers, strict CORS policies, rate limiting, and role-based access control. We shipped documentation for both operations staff and compliance teams, and the architecture is structured for sensor expansion and AI module integration in subsequent releases.