SBALOANSHQ
Multi-tenant SaaS running the full SBA acquisition-financing lifecycle: four portals from one codebase, a blind-listing deal marketplace with e-sign-gated PII release, a 10-stage enforced pipeline, and AI document intake — $33M+ in loans processed.
01 / Overview
"Borrowers, brokers, lenders, and outside requestors — one pipeline instead of four disconnected inboxes."
SBA acquisition-financing consultancies run deals through email threads, spreadsheets, and CRMs that don't understand underwriting — no shared pipeline truth, manual document chasing, and no way to shop a deal to lenders without leaking the borrower's identity. SBA Loans HQ replaces all of it: four portal experiences from one codebase, a 10-stage pipeline whose rules are enforced in the UI itself, stage-gated document bundles, and a deal marketplace where lenders evaluate anonymized deals and borrower PII is released only after a referral agreement clears e-signature. It's a live production platform — ~12 months of weekly shipping and $33M+ in loans processed.
I led full-stack delivery as team lead across ~12 months of continuous production shipping — 3,849 commits and 798 merged PRs. Owned the Next.js frontend (426 components, 75 routes across four portal experiences) against a Django REST + Celery backend on AWS, including the marketplace's agreement-gated access model, the qualification rule engine, and the embedded DocuSeal integration. Delivered with Arithmiks as the consulting partner to SBA Loans HQ.
02 / System Architecture
hover to explore
SBA LOANS HQ system architecture: Browser (Redux · JWT); Next.js 16 (Pages Router · SSR); Nginx (TLS · Certbot); Django + DRF (JWT · RBAC · v0/); Redis (Broker + Results); Celery (Workers · Beat); PostgreSQL (psycopg2 · MatViews); AWS S3 (boto3 · 3 Buckets); AWS Textract (OCR Engine); Gemini (google-genai SDK); DocuSeal (JWT builder tokens); Postmark (stage-driven email).
Connections: Browser → Next.js 16 (HTTPS); Next.js 16 → Nginx (HTTP/2); Nginx → Django + DRF (proxy_pass :8000); Django + DRF → Redis (Task.delay()); Django + DRF → PostgreSQL (psycopg2 ORM); Django + DRF → AWS S3 (pre-signed URL); Django + DRF → DocuSeal (per-request JWT); Redis → Celery (BRPOP); Celery → PostgreSQL (save results); Celery → AWS S3 (multipart PUT); Celery → AWS Textract (boto3 client); Celery → Postmark (outbound email); AWS Textract → Gemini (OCR chunks).
03 / Features
Four Portals, One Codebase
Staff, borrower, lender, and external-requestor experiences ship from a single Next.js app — a useBrandTerms hook swaps 'Lender' for 'Approver' across the entire UI for white-labeled partners, so nobody maintains a fork.
Blind-Listing Deal Marketplace
Lenders evaluate deals as anonymized metrics — loan size, credit profile, terms — and borrower identity is released only after the referral agreement clears e-signature, enforced by an AwaitingAgreement state machine.
Lead Qualification Rule Engine
Auto-qualify and disqualify rules over 15 underwriting fields, AND within a rule and OR across rules — with server-side rejection of unsatisfiable or mutually conflicting rule sets, not just form validation.
Stage-Enforced Kanban
Drag-and-drop with the business rules resolved before the API call fires: forward-only moves through 10 stages, automatic hidden-stage skipping, and optimistic updates that roll back if the move is rejected.
Embedded E-Signature
DocuSeal's builder embedded on short-lived, per-request JWT tokens — the client never holds a standing API key — with 30-second status polling that self-cancels the moment a document hits a terminal state.
Stage-Gated Document Bundles
Each deal auto-requests the right financial documents for its stage and loan purpose; outside accountants and attorneys get a scoped, searchable dashboard for their single ask.
Dynamic Financial Memorandum
A year-column spreadsheet view that reshapes whatever periods the backend returns into business, debt, and personal blocks with an auto-computed SDE row — and re-lays out for lender-facing PDF export.
Per-Deal Chat
A threaded drawer scoped to each deal — participants, history, composer — replacing the email back-and-forth brokers were drowning in.
Six-Domain Analytics
Deal, lead, lender, partner, staff, and requestee metrics on ApexCharts, plus an origination funnel deliberately built Leads → Deals → Closed so it narrows monotonically even when deals skip the lead stage.
Defense-in-Depth RBAC
Staff, lender, and partner roles enforced server-side and again in the client — brokers are hard-limited to Leads and Deals, with off-limits nav, bundle actions, and tours hidden outright rather than disabled.
04 / Process
Domain Modeling & Multi-Tenancy
Mapped how SBA consultancies actually close deals — DSCR, SDE, stage-gated documents, referral agreements — into a product model no generic CRM covers. Structured the frontend as four independently-routed portals over one design system, with RBAC enforced in the API and enforced again in the client's own navigation.
Workflow Enforcement & AI Intake
Encoded the 10-stage lifecycle as enforced behavior, not convention: forward-only Kanban, stage-gated document auto-requests, and the marketplace's e-sign-gated PII release. Layered AWS Textract OCR and Gemini over document intake so financial PDFs become structured data, intelligent file names, and lead scores instead of attachments.
Production Hardening at Velocity
Kept a live platform shippable for ~12 months: a 268-code centralized error taxonomy behind a single useErrorHandler pattern, a database-backed error log with full user context, and self-terminating status polling everywhere. Marketplace phase 2 — agreement-gated access — shipped within a month of phase 1.