Sysmedac One
The control plane every Sysmedac product runs on.
What it is
Sysmedac sells six different SaaS products: hostel management, reinsurance, KYC verification, telemedicine, plantation operations and GroundIT. Sysmedac One is the layer that runs all of them: tenant registry, plans and entitlements, subscription billing, SSO, support, and one revenue view for the founders. I built it alone.
It is two apps on one backend. Super admins get an operator console for tenants, plans, invoices, impersonation and support. Customers get a portal to sign up, buy products, manage workspaces and members, and pay. Each product keeps its own database and talks to the portal over a signed contract.
The billing engine is complete for the Indian market: Razorpay subscriptions with nine webhook event types, GST computation, fiscal-year invoice numbering, PDF invoices rendered by Puppeteer, credit notes, and a dunning ladder that reminds at day 7 and 21 and suspends at 30.
Architecture
Decisions that mattered
Products declare capabilities, the portal stays generic
Each product tells the portal what it supports: which lifecycle operations, which feature keys, which manage surfaces. The portal renders product-agnostic UI from those declarations. That is why onboarding GroundIT, the sixth product, took six migrations and one commit.
A signed contract between platform and products
Product-to-portal calls are HMAC-signed with a 300-second replay window and uniform rejection messages. Two service-token hashes are valid at once, so tokens rotate with zero downtime. Outbound calls carry idempotency keys, correlation IDs and per-operation timeouts across roughly 60 typed operations.
SSO tokens a product cannot forge
Cross-app SSO uses Ed25519 JWTs I implemented directly on node:crypto. Tokens live 60 seconds and are single use. The portal holds the private key, products hold only the public key, so a leak on the product side cannot mint tokens.
Billing that charges on real consumption
The runtime layer gives every product notifications, file storage and usage metering, so billing charges on what tenants actually consume. Invoices carry GST, fiscal-year numbering from a dedicated counter table, and HMAC-signed expiring download URLs.