Insurance brokerage · Business tool
From a Lovable prototype to a secure business application for Cabinet Devorsine
Cabinet Devorsine is an insurance broker that brings together several legal entities (Devorsine Assureur Conseils, Devorsine Immobilier, Green Risk Courtage) and manages a multi-risk portfolio: businesses, vehicle fleets, buildings and individuals.
To run its business, the firm had built a very comprehensive business application on its own, using the AI tool Lovable. It covers prospecting, quotes, contracts, claims, brokerage accounting, document management, Microsoft 365 email and many AI assistants. The prototype had proven itself: the team used it every day and had made it their central tool.
But the code had been generated without a secure software architecture. Before entrusting it with client data for the long term, the firm asked Scroll to take the application in hand: security and performance audit, rebuild on a professional foundation, hosting in France, data migration and go-live. About 10 weeks, from the audit in late July 2026 to stabilization in early October; the new application has been live since 18 September 2026.
Problems and challenges
Critical security flaws. Scroll’s audit found 21 vulnerabilities, 3 of them critical. One of them allowed someone without an account to access any employee’s Microsoft mailbox, then read, send and delete their emails.
Surface-level protection. Access rights were enforced in the interface: the screen was hidden, but the data remained reachable by anyone querying the database directly.
Structural slowness. At login, the application loaded the entire CRM into memory. It also downloaded all its screens in a single bundle and read entire rows where a few columns would do.
Platform dependency. Hosting, the database and the AI (Gemini, through the Lovable gateway) were all tied to the tool. The firm controlled neither where its data lived nor its AI provider, and it had no separate test environment.
A continuity requirement. Everything under the hood had to change without losing a single piece of data or feature, and without interrupting the team’s work.
The solution: an audit, then a rebuild on a professional foundation
Phase 1: audit (late July 2026). A full security audit of the code, database, server functions and dependencies: 21 vulnerabilities ranked by severity, each with the fix to apply. A performance audit measured the real causes of slowness and their cost. Conclusion: rebuild the application rather than patch it, porting it in full.
Phase 2: a new architecture (August to September 2026). Next.js 16, React 19 and strict TypeScript. In total, 62 screens and 41 server-side processes, with every business feature carried over: portfolio, quotes, contracts, claims, brokerage accounting and EDI, document management, Microsoft 365, AI assistants.
Access controls truly enforced by the server. The session is checked, and two-factor authentication or a password change is required before any screen is even displayed. The database keeps its own access rules as a last line of defense.
The three critical flaws closed. The user’s identity always comes from their session, never from the request. Internal calls are protected by a dedicated secret. Accounts and passwords are better protected.
Protected documents. All 9 file storage areas are private, and each file is only served through a signed, time-limited link.
Controlled deletion. Nothing is permanently erased anymore: a deleted item goes to a trash bin from which it can be restored, along with everything it took with it. Only administrators and managers can delete.
European AI. Mistral replaces Gemini for every AI task (transcription, meeting notes, rewording, document reading). A single access point makes it possible to switch model or provider in one place.
Performance rethought. Each screen only loads the data it displays, with server-side pagination.
Hosting, data migration and go-live
Hosting in France, on an OVH server. The Supabase database is self-hosted: the firm is in control of its data.
Two separate environments: a staging environment to try things out, a production environment to work in. Each version approved in staging goes to production as is, with rollback possible.
A complete migration of the data from the Lovable application, and the team’s switchover on 18 September 2026.
A safety net: 74 automated test files, 13 end-to-end scenarios, systematic checks before every release, and an encrypted daily backup of the production database, copied off the server.
The firm’s autonomy. Its staff, who are not developers, can evolve the tool with Claude within a clear framework: one working branch per change, mandatory checks, sensitive areas subject to approval and a pass through staging.
Results
Security on sound foundations. The three critical flaws of the original application are closed, and access controls are enforced by the server, not just by the interface. What remains to be addressed is identified, documented and tracked.
Continuity for the team. Staff got all their tools back, with all their data, on a robust platform.
Sovereignty. Data is hosted in France, the AI is European, and the firm no longer depends on a prototyping platform.
Controlled change. Thanks to staging, tests, the trash bin and rollback, every change is checked before it touches real data.
A tool that can grow. The firm can keep evolving its application itself, on a foundation built to last.