Chatbot SaaS

Small and mid-sized businesses across e-commerce and services want an AI chatbot that actually knows their business, works on the channels their customers already use, and hands off to a human when it matters, without stitching together five separate tools. The goal was a single platform they could sign up for, train on their own content, and run as a lead-capture and support engine.

• SMBs needed one assistant across Web, WhatsApp, Instagram, Messenger and email, not a different bot per channel.

• Generic chatbots hallucinate; answers had to be grounded in each tenant's own knowledge base.

• A real product needs multi-tenant isolation, metered billing, background processing and a human-takeover path, which is where most 'wrapper' products fall over.

1. Built a Turborepo monorepo with a Next.js app plus dedicated Node services for background jobs and real-time, so heavy work never blocks the request path.

2. Implemented retrieval-augmented generation over pgvector with an embedding + reranking pipeline, so answers are grounded in the tenant's crawled content.

3. Added a shared human-takeover inbox over self-hosted Socket.IO, letting agents jump into any conversation live.

4. Wired Stripe subscriptions plus metered usage and a customer portal, with per-tenant limits enforced across the stack.

5. Enforced tenant isolation structurally at the ORM layer and hardened every phase against IDOR, SSRF and prompt injection, with PII redacted before messages are ever stored.

Each customer's data stays walled off

Isolation is structural, not a setting someone could forget, so one client's conversations, billing and limits can never leak into another's.

Slow work never blocks a reply

Heavy jobs like crawling a website or generating embeddings run in the background, so the chatbot stays fast for customers even under load.

Hardened before it ever launched

Every phase was checked against common attack patterns first, and personal information is stripped out before anything is stored.

Grows with the business

Billing, usage limits and channels all scale per customer without needing a rebuild as the tenant list grows.

500 businesses now run this daily across their websites, WhatsApp, Instagram, Messenger and email. That number is the real test of the architecture: tenant isolation, per-customer billing and background processing had to hold up under hundreds of separate businesses with their own knowledge bases and traffic patterns, not just one.