From prototype to first real customer in three weeks

The context

The founder, with no engineering background, built a financial platform for SMEs on his own with AI tools and Supabase: a dashboard that translates accounts into plain language and a mobile app to capture documents in the field. It worked — but it reached the point where, in his words, his own knowledge was holding him back from making the platform stable.

The problem

The app was multi-company, but the database access rules did not properly separate each customer's data. In practice, it couldn't be shown to two customers at the same time. There were also errors showing up as empty screens, sessions expiring without the app noticing, and queries without indexes that would weigh heavily with real data.

What we did

• →Audit first: we mapped the access rules table by table and listed the findings by severity.
• →Phased fixes: we closed the cross-company leaks, fixed session handling and the silent errors, and added the missing indexes — without stopping the product or rewriting the app.
• →So it doesn't come back: automated tests for the access rules in the CI pipeline, which fail if a leak reappears.

The result

In three weeks, the platform went from "it works but we can't show it to two customers at the same time" to "ready for the first real customer". The work continues as a partnership, in phases.