This paper documents the architecture, security design, and database evolution of a two-tier system built to support an environmental-telemetry and micro-desalination business scenario, comprising a Flask REST API for Internet of Things (IoT) buoy telemetry ingestion and a Django eCommerce platform for product sales and subscription management. We describe the system’s modular separation of concerns (a stateless, JWT-secured ingestion API decoupled from a session-oriented commerce platform), the specific security controls applied at each layer (JWT-based stateless authentication for the API; Django’s built-in Cross-Site Request Forgery and SQL-injection middleware for the platform), and the database migration from SQLite to MySQL undertaken specifically in response to a measured concurrency limitation under bulk telemetry ingestion. We report the integration mechanism connecting the two otherwise loosely coupled services (token-based cross-service authentication and shared schema conventions) and the specific coordination overhead this integration introduced. We position the architecture against established microservice design literature and REST architectural-style principles, and we provide a candid account of which design decisions are well supported by that literature and which represent pragmatic compromises specific to a timeand resource-constrained development context, together with the concrete changes (CI/CD pipeline integration, containerisation, formal load testing) that would be required before the architecture could be considered production-ready rather than a validated prototype.