Case study 02 · Multi-tenant SaaS
QuoteFlow
A quotation, approval, and follow-up platform for service businesses, designed around secure customer responses and dependable operational workflows.
Problem
Quotations involve more than generating a document.
Service businesses need to create accurate quotes, manage versions, share a secure customer link, record acceptance or decline, collect optional-item decisions, and follow up without sending stale or duplicate messages.
The system also needs tenant isolation, role-aware access, auditability, and strict money calculations.
Core workflow
From internal draft to customer decision and follow-up.
- OrganizeManage customers, catalog items, projects, members, and permissions.
- BuildCreate quotes using integer minor units and immutable versions.
- ShareGenerate a secure public quotation link using protected random tokens.
- RespondCustomers accept, decline, request revision, and choose optional items.
- Follow upBackground tasks re-check eligibility before event-aware reminders.
- OperateAudit logs, notifications, private storage, billing boundaries, and analytics support the workflow.
Architecture
Centralized authorization and protected integrations.
Application layer
Next.js App Router combines server components, route handlers, centralized authorization, Zod validation, and domain modules for money and quote-state rules.
Data layer
Supabase provides authentication, PostgreSQL, Row Level Security, private storage, transactional responses, and append-only events.
External services
Trigger.dev handles follow-ups. Resend and PayMongo integrations verify signatures and use idempotent webhook ingestion.
Security
Public links are not permission shortcuts.
- 256-bit public tokens stored as protected hashes
- Transaction-safe customer decisions
- Row Level Security for tenant isolation
- Private storage with organization policies
- Verified, idempotent webhook processing
- HMAC IP hashes instead of raw addresses
Next improvements
Complete production validation before real customer data.
The next stage focuses on production RLS review, cross-tenant testing, billing lifecycle verification, user testing, legal review, and documented restore drills.
View QuoteFlow live ↗