Institutional Client Portal
A structured multi-tenant institutional management platform built to centralise CRM, contract lifecycle, grant reporting, and billing at scale.
This system was developed to create a scalable management infrastructure for institutional clients in Albania — NGOs, foundations, and EU-funded organisations. It centralises client relationships, contract workflows, milestone tracking, grant reporting, and financial operations into a single bilingual platform. The architecture replaces fragmented spreadsheet-driven operations with structured automation and audit-ready transparency.
Institutional clients in Albania had no purpose-built digital management infrastructure. Operations were conducted through disconnected email chains, spreadsheets, and PDF documents — with no centralised client database, no structured contract versioning, no automated billing, and no grant reporting workflow. Data lived in multiple formats with no audit trail, no access control, and no scalability mechanism. Compliance requirements from EU funding frameworks compounded the problem: manual reporting was error-prone and chronically delayed.
An edge-native serverless architecture was chosen to eliminate infrastructure maintenance overhead while ensuring global performance. The decision to use Cloudflare Workers (rather than a traditional server) was driven by the requirement for sub-50ms response times without managing persistent compute. Supabase was selected for its PostgreSQL compatibility, built-in Row Level Security, and the ability to enforce per-organisation data isolation at the database layer — not at the application layer — which is the correct place for it. The separation of concerns across three Workers (api-gateway, invoices, proposals) ensures each service has a single responsibility and can be independently deployed, scaled, or replaced.
System Layers
- Multi-tenant CRM with organisation-scoped data isolation
- Contract lifecycle management with version history
- Grant milestone tracking and structured reporting
- Approval-gated proposal state machine
- Automated PDF invoice generation (HTML→PDF, server-side)
- Albanian VAT computation and fiscal line items
- Role-based access control (admin / manager / viewer)
- Bilingual UI — English and Albanian
- Audit log on all state transitions
- Structured database views for reporting aggregation
The schema is normalised to third normal form across organisations, contacts, projects, contracts, milestones, invoices, proposals, and activities. Status fields use PostgreSQL enums — not nullable strings — to enforce valid state transitions at the database layer. Slug columns are unique-indexed for predictable URL routing. All tables carry created_at and updated_at timestamps, with an auto-trigger maintaining updated_at on every write. Row Level Security policies enforce organisation-scoped isolation: no query can return rows from a different organisation regardless of application-layer logic.
The interface follows a minimal, information-dense layout optimised for operational efficiency rather than visual impression. The primary design constraint is that institutional users spend hours per day in this system — so clarity, predictability, and speed of navigation take precedence over aesthetic elaboration. The dark-first colour system reduces eye strain for administrative users. CTAs are positioned inline with workflow steps to minimise context switching. Bilingual support is handled via locale switching, not page duplication, to avoid content drift between language versions.
Security is enforced at four layers: network (Cloudflare WAF and DDoS mitigation), transport (TLS enforced by Cloudflare), application (Supabase Auth JWT validation on every Worker request), and data (PostgreSQL Row Level Security). HTTP security headers are set globally: X-Frame-Options: DENY, X-Content-Type-Options: nosniff, Referrer-Policy: strict-origin-when-cross-origin. All admin UI overlays implement body scroll lock and ARIA dialog roles. External links use rel="noopener noreferrer". The robots.txt restricts crawler access to /admin. No secrets are held in client-accessible code — Supabase service role keys are Worker-only, never exposed to the frontend.
All frontend pages are deployed to Cloudflare Pages with global edge caching — eliminating origin server latency for static and ISR-generated content. Server components run at the edge, not in a centralised region. Supabase queries use selective column projection (no SELECT *) on listing endpoints to minimise payload. Status-filtered indexes (partial indexes on status = 'upcoming') reduce index size and scan time for the most frequent query patterns. Images are served in AVIF/WebP via Next.js image optimisation. The three-Worker architecture prevents any single service from becoming a bottleneck.
The platform replaced a fragmented manual workflow across email, spreadsheets, and disconnected PDF documents. Institutional clients now have a structured, audit-ready system for managing their full operational lifecycle — from initial contact through proposal, contract, milestone delivery, and invoicing. Internal operations that previously required multiple tools and manual reconciliation are now handled in a single platform with enforced state transitions and complete audit history. The system is deployed and in active institutional use.
The multi-tenant architecture provides a direct upgrade path to federation-level deployment — enabling multiple institutional networks to operate on shared infrastructure with complete data isolation. Planned extensions include an AI-assisted reporting layer using pgvector for semantic search across historical grant reports, a public-facing proposal status portal for stakeholder transparency, and integration with Albanian government fiscal APIs for automated tax reporting. The Worker-based separation of concerns means any layer can be upgraded independently without system-wide downtime.
Build similar infrastructure for your organisation.