Case study
Kavlo
B2B Multi-Tenant SaaS Platform
Role
Scope
Stack
What I built.
- 01
Built the web app and the main API end to end, and maintain the three document-processing services another developer started, fixing and extending them as the product needs.
- 02
Gave every customer its own subdomain with complete data isolation, enforced by the database itself, so one company can never see another’s vendors or contracts.
- 03
Automated contract, invoice and purchase order processing: Kavlo recognises each document, extracts vendors, amounts, dates and renewal terms, and highlights where on the page each value came from.
- 04
Connected Gmail, Outlook, Google Drive, SharePoint, Box and Dropbox, so new documents flow in continuously without anyone uploading them.
- 05
Built a drag-and-drop workflow designer where admins draw approval paths (Business, Legal, Compliance, Finance), and the platform routes each item and logs every step.
- 06
Added AI legal review that flags risky contract clauses and suggests redlines.
- 07
Dashboards show spend, upcoming renewals, open issues and contract status in one place.
- 08
Added Okta single sign-on and role and department permissions for enterprise customers.
- 01
Built the frontend (Next.js 15 App Router, Redux Saga, Tailwind, Radix) and the main backend (NestJS, TypeORM) end to end; maintain and extend the FastAPI document API, the Celery worker engine and the original document-intelligence code it was split from.
- 02
Multi-tenancy through PostgreSQL Row Level Security: the tenant is resolved from the subdomain, app.customer_id is set on every connection, and a TenantAwareRepository base class means no query relies on a manual customer filter.
- 03
Template-based workflow engine: ReactFlow nodes and edges are stored as templates and instantiated into departmental stages, with each stage execution logged for audit.
- 04
AI legal analysis and redline generation on LangGraph and LangChain (Anthropic and Google GenAI), plus an MCP tool registry that exposes backend functions to AI agents.
- 05
Document pipeline: FastAPI queues work through a seven-task Celery contract on Azure Redis; workers classify and extract with Gemini and Google Document AI, map field bounding boxes for PDF highlighting, and report status over WebSockets.
- 06
Continuous sync from Merge.dev file storage and Nylas email, with cursor-based discovery and deduplication by message ID, filename and SHA-256 hash; integration credentials encrypted at rest.
- 07
JWT in HTTP-only cookies shared across .kavlo.com, Okta SSO, and role- and department-based guards; SSL enforced to Supabase, NEON and Redis, with the API docs behind admin middleware.
- 08
Deployed on Azure Container Apps (1 to 10 replicas) and Azure VMs, with Redis and BullMQ, Azure Blob Storage, Supabase and NEON Postgres.