Deksie - The Operating System for Agencies — Suman Jana

gopostgresnext.jsreactvertex-airbac

Creative agencies run on WhatsApp threads, spreadsheets and five different tools. Deksie puts leads, deals, projects, tasks, client approvals, contracts, invoices and docs in one place, with an AI assistant that can answer questions about all of it.

I'm co-founder and CTO. I wrote about 83% of the 1,361 commits across the Go backend and the Next.js app.

Deksie dashboard with tasks, pipeline and health insights — The home dashboard: open tasks, pending approvals, pipeline, overdue work and recent activity.

By the numbers

598 API routes on a Go backend (Echo + GORM + Postgres)
~100 tables, 100 migrations, 385 Go tests
92 routes in the Next.js 16 / React 19 app
249 findings from a 20-agent audit, fixed across 14 PRs

Delivery: projects, tasks and approvals

Projects run on a 7-phase workflow. Tasks have board, list, calendar and timeline views, plus a review step with an SLA: when a task sits in review too long it gets flagged, and analytics shows the median review time.

Clients approve work from a link, without an account: approve, reject or ask for changes. That public endpoint is rate limited and idempotent, so a double click never creates two approvals.

Deksie task board grouped by status — Task board with review states.

Money that adds up

Finance is where bugs cost real money, so I built it to be boring:

invoice numbers come from a sequence inside the same transaction
payments are recorded with an idempotency key
a refund is a reversal row, never a delete
credit balance is derived from the ledger, never stored
billing schedules run from a cron worker that is safe to re-run
invoices render to PDF on the server

Deksie finance overview with cash flow and receivables — Finance: cash flow, receivables that need attention, and expenses by category.

The AI assistant

The assistant answers questions about the agency's own data: who is overloaded, which invoices are overdue, which deals are stuck. It queries through read-only SQL views on a read-only database pool, logs every action it takes in a write ledger, is throttled per turn, and fails closed before anything destructive.

Deksie AI assistant answering a question about agency data — The assistant answering from live agency data.

Security

Multi-tenant SaaS lives or dies on tenant isolation. My hardening work included an ORDER BY allowlist that closed a SQL injection, RBAC that fails closed for unknown roles, closing a cross-tenant file leak on legacy storage keys, rate-limited auth, email header-injection fixes, and a one-day batch of IDOR and permission fixes across approvals, inbox, webhooks and trash.

The 20-agent bug hunt found 249 issues. Seven of eight fix waves shipped within a week, across 14 PRs in both repos.

Stack

Go 1.25, Echo, GORM, pgx, Postgres · Next.js 16, React 19, Tailwind 4, TanStack Query, TipTap, Recharts · Vertex AI (Gemini) · Google Cloud Storage · Sentry · GitHub Actions.