AVNZ: a multi-tenant payment platform built from scratch.

The challenge

AVNZ needed a full payment platform: funnels, checkout, subscriptions, customer management, refunds, audit logging, multi-gateway routing, AI customer service, all of it. The kind of thing most companies build over years with large teams. The constraint was that it had to ship in weeks, not quarters, and it had to be production-ready, not a prototype.

A platform like this has three traps. The first is the data model. Get it wrong and every feature that comes after fights the schema. The second is multi-tenancy. Get it wrong and you ship a security incident. The third is integration sprawl. Every payment gateway has its own auth, its own retry semantics, its own webhook format. Hard-coding any of them means the next gateway is a rewrite.

The solution

The architecture starts with a four-tier hierarchy: organization, client, company, and the entities under each. Every record carries its scope. Every query enforces it. Every API endpoint validates it through a hierarchy service before it touches the database. Multi-tenancy is not a feature. It is the spine the rest of the system hangs from.

Integrations are abstracted behind an Integrations Framework. Every provider, payment gateway, AI model, communication tool, has a definition file and a service implementation. Credentials are encrypted with AES-256-GCM and stored per-client. The platform ships with first-class support for Stripe, PayPal, NMI, Authorize.Net, Anthropic, Twilio, Cloudinary, AWS SES, and more. Adding a new provider is hours, not weeks.

The funnel builder lets clients spin up sales funnels with hero, product selection, checkout, and thank-you stages. Every funnel captures session data, lead data, and conversion data, all linked back to the customer record once the purchase happens. That is the join that makes closed-loop attribution possible downstream.

What we built

The backend is a NestJS monolith organized into 20+ modules: orders, products, customers, transactions, refunds, audit logs, email, leads, funnels, integrations, and more. PostgreSQL with Prisma sits underneath, with migrations tracked in a schema changelog so every deploy goes through a documented data contract. Redis backs BullMQ for async jobs: email queues, import jobs, retry pipelines, anything that should not block a request.

The admin dashboard is Next.js 14 with Tailwind. It supports dark mode end-to-end (mandatory on this codebase), mobile responsive layouts, role-based navigation, and inline UX for most CRUD flows. The company portal is a separate Next.js app for public-facing funnels, optimized for conversion with intervention components like urgency banners and social proof.

On top of all of that sits the CS AI module: a tiered customer service AI with three escalation levels, voice and chat channels, and configurable rules per company. We covered that in its own case study, but it is one of the modules running inside AVNZ today.

Hard problems we solved

Encryption at rest had to work the day the first integration shipped. We built a credential encryption service that loads its key from AWS Secrets Manager in production and from an env var in dev, with the server refusing to start without one. That hard fail is the only thing that prevents a future "oops we stored credentials in plaintext" disaster.

Audit logging covers SOC2, ISO 27001, GDPR, and PCI-DSS requirements with 150+ action types and data classifications (PII, PCI, PHI, etc.). Every sensitive operation writes a log with the user, the action, the entity, and the data classification. Compliance reviews are now a query, not a fire drill.

Soft deletes work end-to-end. Every entity has deletedAt, deletedBy, and a cascadeId so a parent delete groups its children. The deleted-items page lets administrators restore accidentally-deleted records, which has saved real data more than once.

The result

AVNZ is in production, processing real transactions, running real funnels, and supporting real customers. The platform ships daily, sometimes multiple times a day, because the underlying architecture is built for change. The hierarchical data model and the Integrations Framework mean that almost every new feature plugs into existing patterns instead of inventing new ones.

The longer-term proof point is that AVNZ has now spawned adjacent products on the same foundation. Always 305 (a coffee subscription), ShipKeeper (shipping protection), Adley (paid search optimization). Every one of those reuses the platform spine. That is what good architecture is for: the second product is faster than the first.

Why this case matters

AVNZ is the proof that "ship in weeks" applies to systems much larger than a single feature. The compression comes from treating multi-tenancy, integrations, audit logging, and security as load-bearing primitives from day one, not as features added later. When the foundation is right, the rest of the platform builds itself, fast.