IDEMIA converts .NET 4x faster across a 45-tenant DMV platform.

# Public Sector Customer Story — 4x faster .NET conversion

**Industry:** Public Sector
**Cloud:** AWS
**Outcome:** 4x faster .NET conversion

## Summary
IDEMIA's civil identity platform ran thick-client and web applications on .NET Framework 3.5+ with SQL Server on Windows VMs, serving roughly 45 DMV tenants from one tightly coupled codebase — converted 4x faster to .NET 8 on Linux containers, with every tenant in its own AWS account.

## The Challenge
IDEMIA operates the civil identity platform behind driver licensing and vehicle registration for roughly 45 independent DMVs — dozens of separate tenants, each with its own statutes, forms, and audit expectations, all served from a single multi-tenant codebase.IDEMIA's codebase was thick-client and web applications built on .NET Framework 3.5+, backed by SQL Server databases running on Windows Server virtual machines in on-premises data centers. It was tightly coupled by construction, which blocked the two things the business needed most: onboarding a tenant quickly, and changing one tenant without regression-testing all of them.The pressure was compounding on three fronts at once. Performance — WOW64 translation overhead, inefficient memory management, and idle infrastructure sitting in racks. Cost — Windows Server and SQL Server licensing across deliberately overprovisioned hosts. Security — no TLS 1.3 support, a code access security model deprecated years earlier, and minimal CSRF protection on citizen-facing services. And the technical debt underneath ruled out every fix: containerization, automated scaling, and modern DevOps practice were all unreachable until the runtime itself moved.

## The Solution
CloudHedge modernized IDEMIA's applications and databases as one coordinated effort rather than two sequential projects, so schema changes and code changes landed together and the data layer never drifted from the application logic depending on it.CHAI DART ran a deep Trivector Assessment across the estate, analyzing runtime behaviour, workload characteristics, and source code together to grade each application and produce precise modernization recommendations — sequencing the work on evidence rather than on which system had the loudest advocate.CHAI Flow, powered by AWS Transform for .NET and SQL Server, then orchestrated the agent-driven workflows that did the work: automated code analysis, dependency mapping, refactoring, and validation. Developers stayed in the loop throughout via Visual Studio IDE extensions, reviewing and accepting changes in the editor they already worked in rather than reading a diff out of a black box. Legacy .NET Framework applications came out the other side as cross-platform .NET 8 and .NET 10 workloads running in lightweight Linux containers.The target architecture is multi-account by design: each DMV operates in a dedicated AWS account, which turns tenant isolation into an account boundary rather than a code path and keeps per-jurisdiction compliance scoped to one tenant. The platform spans multiple Availability Zones on Amazon EKS — React frontends in public subnets, containerized .NET services in private ones — with Amazon Aurora PostgreSQL and read replicas as the data layer. AWS KMS, Secrets Manager, CloudTrail, and CloudWatch supply centralized encryption, secrets handling, audit trail, and monitoring, aligned to AWS Well-Architected best practices.

## The Outcome
.NET Framework to .NET 8 code conversion ran 4x faster than the manual path. That was the change that made a 45-tenant modernization schedulable at all — per-tenant conversion was the constraint sitting in front of every other date in the plan.Operational costs fell by up to 40%, and most of that reduction is structural rather than negotiated. Windows Server and SQL Server licensing came off the bill when workloads moved to Linux containers, and Aurora PostgreSQL with EKS autoscaling replaced always-on overprovisioned VMs with capacity that tracks actual demand.The security gaps closed as a consequence of the runtime move rather than as a separate remediation project. Modern .NET runtimes brought TLS 1.3 and current CSRF protections; the deprecated code access security model left with the framework that carried it; and KMS, Secrets Manager, and CloudTrail put encryption, secrets, and audit trail under AWS-native controls every tenant inherits by default.What IDEMIA has now is a repeatable architecture — the same account pattern, the same EKS blueprint, the same data layer for tenant 46 as for tenant 1. Onboarding a new DMV became an instance of a known pattern instead of a bespoke engagement.


## Stack
- AWS
- Amazon EKS
- Amazon Aurora PostgreSQL
- AWS Transform
- AWS KMS
- Secrets Manager
- CloudTrail
- CloudWatch
- Linux Containers
- CHAI DART
- CHAI Flow
- .NET Framework 3.5+
- .NET 8 / .NET 10
- SQL Server
- React



## Contact
Book a demo: /contact/
Email: hello@cloudhedge.io