Deliverables 9 – 12
Technology, roadmap & risks
01
Technology stack recommendations
| Layer | Choice | Why | Long-term cost |
|---|---|---|---|
| Frontend | React 19 + TypeScript, TanStack Start | Type-safe routing and server functions in one codebase; large hiring pool. | Low |
| Database | PostgreSQL (managed, via Lovable Cloud) | Row-Level Security gives database-enforced tenant isolation. | Low → Medium with scale |
| Auth | Managed auth with SSO + MFA | Avoid building identity in-house. | Low; per-user at scale |
| Storage | S3-compatible object storage | Tenant-prefixed buckets; portable across clouds. | Low |
| Server / APIs | Edge server functions + versioned REST APIs | Simple ops; signed service tokens between control plane and products. | Low |
| Background jobs | Queue + scheduled jobs | Provisioning, renewals, backups, notifications. | Low |
| Monitoring | Error tracking + uptime + structured logs | Required before onboarding paying customers. | Medium |
| Deployment | Git-based CI/CD, staging + production | Infrastructure-as-code for dedicated installs. | Medium (dedicated hosting grows linearly) |
| Payments | Hosted provider (Stripe or Paddle), Stage 4 | No card data on our servers; Paddle handles global tax as merchant of record. | % of revenue |
02
Development roadmap & complexity
Stage 1 · current
Foundation
Complexity: Low
- — Brand & design system
- — Navigation & dashboard shell
- — Architecture, security & roadmap docs
Stage 2
Core data & access
Complexity: Medium
- — Enable backend, staff auth + MFA, roles
- — Products, customers, company settings
- — Audit log
Stage 3
Subscriptions & support
Complexity: Medium
- — Plans, entitlements, renewals
- — Support tickets & access grants
Stage 4
Billing & deployments
Complexity: High
- — Invoicing + payment provider
- — Tenant provisioning, dedicated install registry
Stage 5
Scale & customization
Complexity: High
- — Custom modules, workflows, forms, reports
- — Monitoring, analytics, product integrations (PMS, NEXORA)
03
Risks and recommendations
- Risk: building every module at once. → Ship stage by stage with real users.
- Risk: tenant data leaks. → RLS on every table, automated isolation tests.
- Risk: dedicated installs drift. → One codebase, versioned packages, pinned upgrades.
- Risk: coupling to PMS. → Integrate via APIs only; no shared databases.
- Risk: global tax & invoicing. → Use a merchant-of-record provider.
- Risk: staff account compromise. → MFA, least privilege, audited support access.