Vekilim — Multi-Tenant Management Platform for Law Firms

The Problem

Law firms were running client communication, case tracking and document sharing scattered across WhatsApp, email and Excel. With attorney-client privilege and data-protection law at stake, they needed a platform where one firm's data can never leak to another and every access is on record.

The Approach

Built a modular monolith on .NET 10 with Clean Architecture and CQRS (MediatR); a Hangfire worker runs as a separate process from the same image. The tenant is read only from a signed JWT and isolated across three independent layers: EF Core filters, a SaveChanges check and SQL Server RLS. The mobile side is built with Expo, and the web panel with a Next.js BFF that never hands tokens to browser JavaScript. Documented 90+ architecture decisions with their rationale.

Engineering Highlights

• An interceptor writing the tenant into the session context on every connection, plus SQL Server Row-Level Security with FILTER/BLOCK predicates.
• Tamper-evident audit/access/finance/data-protection logs, hash-chained per tenant and log type and written in the same transaction as the operation.
• Short-lived ES256 access tokens, family-based rotating refresh tokens (reuse revokes the whole family), TOTP 2FA for staff and SMS OTP for clients.
• Permission + record scope applied at query level: listings, search, counters and notification targeting share one rule; out-of-scope records return 404.
• Production on Docker + Caddy with ClamAV file scanning, encrypted file storage and documented backup/restore scripts.