Fintech platform
Gated reports and a compliance team that reviews every published word, without buying the marketing-automation suite that usually comes with that sentence.
The brand studio had done the hard part: making a payments platform look like something other than stock photography of people pointing at laptops. The build brief underneath it was mostly about the resource library, reports and guides that earn leads, gated without being hostile about it.
Where it started
The brief arrived as a deck, which usually signals trouble, except page nine was a diagram of the exact approval path every published word had to survive. That diagram ended up running the build. We mapped each box on it to something Craft already does, sent it back annotated, and had the compliance team approve the workflow before a line of Twig existed, which is the right order and almost never the one that happens.
The resource library went up first and was gated from day one on staging, so the review team rehearsed on real drafts for five weeks while we built everything else. By launch they'd approved eleven pieces through the live workflow, and the planned training session was cancelled as unnecessary.
The build
Gating works the way visitors wish it always did. You fill in one form, once, after which a cookie remembers you and every later download is a click. Submissions go straight to the client's CRM over a webhook, with no marketing-automation suite, no monthly platform fee, and no third-party script dragging the performance budget under.
The quieter requirement was compliance. Every public word needed an approval trail, which sounds like a procurement question until you notice that Craft's drafts and revisions already are one. Reviewers approve a draft, the diff is on record, and the compliance officer got a login instead of a PDF workflow.
The plumbing under the gate
The cookie is first-party and holds nothing but a signed yes, which kept the consent-banner conversation short. The CRM webhook runs as a queued job with retries, and a submission that still can't be delivered after an hour falls back to a plain email, because a lead lost to somebody's API outage is the one failure the client would never forgive.
Publish permission is held by two named people while everyone else works in drafts. The compliance officer reads diffs rather than PDFs, and the audit question that used to take a week of inbox archaeology is now a revision-history lookup.
The performance budget was written into the quote: 200KB of JavaScript, no exceptions. That killed the marketing-automation embed in week one and forced the webhook design, which turned out better anyway. The client's security team ran their own review before launch. It came back with two findings, both header configuration, both fixed the same day, and the report now gets shown to their auditors annually as part of the platform's own compliance story.
Forms that behave
The gate form is native inputs with labels that never disappear into placeholders, errors written in sentences and announced through a live region, and a keyboard path tested before the pointer one, because this audience downloads reports at work on locked-down machines where the mouse is optional and the screen reader sometimes isn't. The whole gate, cookie and webhook is a few hundred lines of module code in the project repo rather than a plugin subscription. Less to buy, and less to explain when the security team came asking.
The library itself is a filterable grid that collapses to a single column without losing the filters. The only motion on the site is the gate easing open after the form succeeds, which under reduced motion is simply open. Craft's project config paid off at review time: the security team asked what had changed since their last look, and the answer was a git log rather than a meeting.
After launch
Quarterly campaign pages come out of the block kit, the library grows a few entries a month, and the site sits on our hosting with updates inside the major version handled as part of the fee. The studio invoices for the design work and we stay invisible, per the contract. The library passed sixty entries this quarter, and the webhook has delivered every submission since launch. The email fallback has fired once, during a spring CRM outage, and nobody lost a lead.