Tesco is a British multinational grocery and general merchandise retailer. With a 61 billion pound revenue in 2022, the company continues its steady growth. Tesco has shops in Ireland, The UK, Czech Republic, Hungary and Slovakia and is a market leader in groceries in the UK with a 28% market rate.

Tesco's team needed to rework the internal portal to ensure smooth communication between all company employees. Before, they had separate portals built on WordPress for each Tesco region. Because of that, there was no single source of truth and no consistency in communication.

The processes were inefficient as the account managers, business, and communication teams had to use many different portals. There was a strong need of application rationalization, cost reduction and operational streamlining.

We were looking for a headless solution, as we wanted to build a multi-channel internal employee portal. After shortlisting and testing 8 different solutions, we decided to choose Strapi for its flexibility, customization capabilities, and active community. We also needed a self-hosted solution that we could deploy on-site, for GDPR and security compliance.

Strapi’s huge advantage is the fact that it’s open-source and extensible - we can customize it as we see fit, build our own features exactly in the way we need them, and exchange them with the community.

We use Strapi as our go-to CMS and one single source of truth and deliver content via APIs to different channels. For instance, the content is delivered to a communications portal with tenancies for UK, ROI, Central Europe (divided into SK, CZ, HU), there’s also a benefits portal for the UK, and a One Stop Shop application with 20+ Micro Frontends included (metadata, static content, configurations).

We use TypeScript, Redis for caching API, PostgreSQL database, Microsoft Azure and Kubernetes along with Strapi.

The communications team can independently add content (for instance, Christmas communications, and important news) in the admin panel. The dynamic zones and components provide additional flexibility.

Strapi is also delivering important metadata to our system. This data is used to personalise the communications and the content displayed for each person.

We customized Strapi a lot, mainly by building and using open-source plugins, such as Comments for custom approval flows and Navigation (virtual multi-tenancy applied). We changed the business logic and added the features that we needed, some of them are intertwined with the role-based-access control system.

For instance, we added virtual multi-tenancy and context separation depending on the user’s role in Tesco structures, tenancy boarding based on config files, custom approval flows, plugin for import & parse WordPress content to support channels migration.

We also added a plugin for remote management of maintenance, configuration & in-app notifications, to ensure that everything is scheduled in time.

To reinforce the security, we set up a custom SSO provider which works with Active Directory roles to map them to Strapi Role-Based Access Control on a first login and update on change.

We needed to comply with the security requirements, such as Single Sign On, custom roles and permissions, and audit logs. These features minimize the risk of security breaches and data leaking and make sure that everyone only accesses the data they need, not more.

Also whenever we have questions or need help, we can rely on Strapi support - it’s reassuring and saves us a lot of time. That's why we didn't hesitate to choose Strapi Enterprise Edition.

With Strapi, we have enough flexibility to modify the solution on the fly as our needs evolve. We can tweak the system so that it matches our processes and allows us to be efficient.

We delivered the project in 3 months and developed custom plugins in less than a week, which allowed us to meet deadlines.

Our communications team can easily spread information to 24 different channels, using one single source of truth.

We’re also compliant with all the security requirements and GDPR, thanks to on-premise hosting, SSO, API tokens, as part of the custom Policy for every public API call, audit logs, and custom roles feature.