The challenge

The founder had a clear product vision and a Shopify storefront, but no engineering team. The brief called for an AI assistant that knows each customer's business profile, respects Australian data-residency rules (Privacy Act 1988), gates features by subscription tier, and can be handed to another developer later without a knowledge-transfer meeting. The scope then grew twice mid-build — from 7 feature areas to 22 — so the architecture had to absorb new entities (matters, compliance obligations, health reports) without a rewrite.

What we built

• Seven-step onboarding that persists to the database — Business name, state, location type, industry, structure, headcount and legal concerns — captured once and injected into every AI conversation as a structured profile.
• Streaming AI chat on a three-layer prompt — Environment prompt + business profile + per-tier instruction block, served from Supabase Edge Functions in Sydney with streaming responses, conversation history, soft archive, pagination and automatic categorisation into ten legal topics.
• Matters as a first-class entity — Create a matter, assign chats and documents to it, and get an AI-generated summary and downloadable matter report — the right rail updates live.
• Document vault with Q&A — Uploads with type badges and image previews, a simplified tagging taxonomy, expiry metadata with 90- and 30-day reminders, and an assistant that reads stored documents when answering.
• Compliance checklist and monthly legal health report — A curated obligation list with government source links and a live score, plus a persisted monthly AI report — both exportable as clean PDFs, with a one-click regenerate.
• Three-tier billing (Aware / Assured / Ahead) — Stripe Checkout, Customer Portal and five webhook events drive calendar-month entitlements with soft warnings, hard blocks and per-feature usage tracking.
• Engineering foundation — 19 database migrations with default-deny row-level security, six Edge Functions, 480+ unit tests, Playwright end-to-end tests and a /docs folder covering architecture, theme and conventions.

How we worked

Weekly written progress updates listing exactly which routes were clickable, what was under the hood, what was placeholder and what we were waiting on. Every scope change was logged against the original spec so the commercial conversation stayed factual. Brand tokens, industry lists and tier copy live in single files so the client's final wording is a one-file swap.

Outcome

A production-ready, AU-region-compliant SaaS running on the client's own Vercel, Supabase, Anthropic and Stripe accounts — not ours — with the whole surface (onboarding → chat → matters → vault → compliance → reports → billing) working end to end and covered by tests before launch marketing went live.