Four markets, four languages, and an editor who no longer files a ticket.

Drupal was configured as a pure content backend, exposing everything through a hardened REST API and JSON:API. That decision was made for what comes next rather than what exists now — a separate JavaScript front end, a mobile app or a third-party integration can all read the same content without a second build.

Drupal's JSON:API and REST endpoints are open by default, which is fine for a blog and wrong for a corporate platform. Three custom modules closed it: one blocks every /jsonapi/ route at the routing layer for unauthenticated requests, one enforces role-based access on REST routes, and one validates a stateless auth-token header against a per-user API key on every JSON request. Multi-layer stateless security, without OAuth's overhead.

Multilingual SEO was solved once at the configuration layer rather than per page. Hreflang, translated metatags, language-aware URL aliases and per-language sitemaps are inherited automatically by all twelve content types, so a new service page is correctly internationalised the moment an editor saves it. Sixty component types were built as mix-and-match paragraphs, which is why the editorial team now composes hero banners, stat sections, compliance tables and job listings without opening a ticket.