Norvelo — AI-Powered Sales & Ad Intelligence SaaS

The Problem

Small businesses were stuck choosing between expensive tools and hours of manual research to find prospects and track competitor ads. At the same time, letting AI send bulk messages on its own was unacceptable from both a brand and a legal standpoint.

The Approach

Designed a modular monolith where ASP.NET Core owns identity, policy, workflows, auditing and persistence, React provides the operator experience, and a bounded Python/Playwright worker handles browser-based discovery. New workspaces start in draft mode with external actions locked; 70 architecture decisions are recorded as ADRs.

Engineering Highlights

• A transactional outbox: approving a draft isn't sending it; the dispatcher re-checks suppression, the safety lock, quiet hours, limits and idempotency.
• AI drafts must cite stored evidence, and a rule-based content check rejects claims the evidence doesn't support.
• SSRF protection for website enrichment; scraped content is treated as data, never as instructions.
• Layered tenant isolation, secrets encrypted with AES-GCM, and audit records that redact personal data in their constructor.
• Agent tool permissions are deny-by-default and tied to each tool's risk level; full automation is refused in domain code.