The State Human Rights Commission of Baja California Sur (Mexico) needed to digitize and control the complete cycle of citizen complaint management, ensuring compliance with legal deadlines and the confidentiality of highly sensitive data (identities of victims, accused authorities, data of minors, and vulnerable groups). The solution had to go far beyond a simple web form:
- Control legal deadlines with automatic file numbering and a complete history of status changes.
- Compliance with the Federal Law on the Protection of Personal Data Held by Obligated Subjects (Mexico).
- Node-level access control: only the assigned officer can view/edit a file; not even an administrator can delete it.
- Hierarchical multi-role management (presidency, area leaders, officers, staff, assistants, visitor's office, deputy visitor's office) with visibility limited to their own area.
- Capability to branch a file into two independent follow-ups without losing traceability of the origin (cases with multiple authorities or victims).
- A secure channel for public defenders ("autoridad") to file multiple complaints on behalf of third parties, with auto-fill of their own data.
- Public transparency of statistical data (gender, age, municipality, disability, priority group...) without ever exposing identifiable information.
Screenshots
Quina Solució es va donar?
A hybrid Drupal 10 + React architecture was designed, clearly separating internal (confidential) management from the public transparency experience: Drupal manages the entire backend, files, and security, with 18 custom modules that automate the entire file lifecycle. Meanwhile, a React frontend exclusively consumes the public statistics API (cedh_doq_public_api) to display a dashboard of aggregated and anonymized data, without ever accessing sensitive data or the internal structure of the files.
Flux de treball clau:
Ciutadà/Advocat → Webform → migra_webform_nodo (validació + numeració)
→ Assignació de responsable per àrea (cedh_jerarquia)
→ Workflow d'estats (evaluación → orientación/canalización/acompañamiento/queja)
→ Notificacions automàtiques (tarea_correo)
→ Historial i bifurcacions si el cas ho requereix
↘
API pública anonimitzada → dashboard React (només estadístiques agregades)
Resultados
| Indicador | Antes | Después | Impacto |
|---|---|---|---|
| Tràmits digitalitzats | 0% | 100% | Control centralitzat i certesa de les dades |
| Temps mitjà de resposta | ~15 dies | ~5 dies | Reducció del 66% en temps de gestió |
| Incidències de seguretat | N/A | 0 incidents | Compliment normatiu garantit |
| Accessibilitat web | No auditada | Nivell AA verificat | Inclusió de ciutadania amb discapacitat |
| Dades públiques | Informes manuals mensuals | API actualitzada/hora | Transparència institucional millorada |
| Usuaris formats | 0 | +12 persones | Autonomia tècnica de l'entitat |
Valor afegit
- Scalable modular architecture: each process (numbering, branching, appointments, official letters) is an independent module, easy to extend (e.g., maintenance module aligned with the AURA philosophy).
- Field and node-level access control, not just role-based, guaranteeing real privacy in a highly sensitive context (victims of human rights violations).
- File branching system, uncommon in standard Drupal implementations, specifically designed for cases with multiple authorities or affected parties.
- Comprehensive technical documentation and user manuals in Spanish for knowledge transfer to the internal team.
- Architecture ready to integrate local AI models for automatic complaint classification.
