Full-StackStable

BuildFlow, Project & Sprint Management Platform

A project management SaaS for software teams: organizations, workspaces, projects, sprints, and tasks, with Kanban and list views, time tracking, AI-generated performance reviews, and real Stripe billing. Deployed as three separate services: a marketing site, an authenticated dashboard, and an API backend.

Live Production Client Repo Engine Repo

Capabilities: 12
Stack Depth: 20
Domain: Full-Stack

Screenshot of the BuildFlow, Project & Sprint Management Platform interface

Capabilities

01
Full workspace hierarchy: organizations, workspaces, projects, sprints, and tasks, with subtasks and labels
02
Kanban board (drag-and-drop status changes) and a server-side-paginated table view of the same data
03
Sprint planning with named phases and durations (e.g. Planning 2w, Building 6w, QA 1w), shown on every task in that sprint
04
Time tracking per task, rolled up into "Working hours" on the task list and a personal "My Tasks" view across every project in an org
05
AI-generated employee performance reviews (OpenRouter), built from a member's real task completion rate and logged time, manager-only, on demand
06
Real payments: Stripe Checkout for upgrades, Stripe Customer Portal for self-service billing management, webhook-driven subscription sync
07
Encrypted project credentials vault (AES-256-GCM, masked list view, audit-logged reveal)
08
Real-time notifications via Server-Sent Events (task assignment, comments, sprint changes, invitations)
09
Google OAuth and email/password auth, with refresh-token rotation and reuse detection
10
Org-level audit log, webhooks, and API keys for external integrations
11
Admin-configurable plan catalogue (pricing/limits) that both the dashboard and the public marketing site read live, so changing a price once keeps it correct everywhere
12
Public marketing site with a real pricing page synced to live backend data instead of hand-maintained copy

System Architecture

BuildFlow is a multi-tenant project management platform built end-to-end, from schema design to production deployment. Teams organize work through a full hierarchy: organizations own workspaces, workspaces own projects, projects run sprints, and sprints track tasks, with role-based permissions enforced at both the organization and workspace level (owner/admin/member/guest, plus granular self-assign vs. assign-others rules). The product ships three independently deployed services that talk to each other in production: a public marketing site with a live pricing page pulled from the same database the app uses, an authenticated Next.js dashboard, and an Express/PostgreSQL API. The dashboard and API run on separate domains (Vercel and Render) and stay session-reliable across that split via a same-origin rewrite proxy, so the browser never talks cross-site for anything that needs a cookie. This avoids the third-party-cookie blocking that increasingly breaks naive multi-domain auth setups. Beyond core task management, it includes an AI feature (a manager picks a team member and gets an OpenRouter-generated performance summary built from their real task and time-log history), real Stripe subscription billing (hosted Checkout plus a self-service billing portal, driven by an admin-configurable plan catalogue rather than hardcoded tiers), and a security-conscious credentials vault for storing project secrets (AES-256-GCM encrypted at rest, masked by default, with audit-logged reveal actions).

Technology Stack

Node.js
Express 5
TypeScript
PostgreSQL (Neon
serverless)
Prisma 7
Zod
JWT (httpOnly cookies)
BullMQ with Redis (optional)
Docker
Next.js 16
Stripe (Checkout
Customer Portal
Webhooks)
React 19
TanStack Query
Zustand
Tailwind CSS
ky
OpenRouter (model-agnostic LLM gateway)

Build Status

Stable

BuildFlow, Project & Sprint Management Platform

Capabilities

Stack Depth

Domain

Full-Stack

System Architecture

Capabilities

Full workspace hierarchy: organizations, workspaces, projects, sprints, and tasks, with subtasks and labels

Kanban board (drag-and-drop status changes) and a server-side-paginated table view of the same data

Sprint planning with named phases and durations (e.g. Planning 2w, Building 6w, QA 1w), shown on every task in that sprint

Time tracking per task, rolled up into "Working hours" on the task list and a personal "My Tasks" view across every project in an org

AI-generated employee performance reviews (OpenRouter), built from a member's real task completion rate and logged time, manager-only, on demand

Real payments: Stripe Checkout for upgrades, Stripe Customer Portal for self-service billing management, webhook-driven subscription sync

Encrypted project credentials vault (AES-256-GCM, masked list view, audit-logged reveal)

Real-time notifications via Server-Sent Events (task assignment, comments, sprint changes, invitations)

Google OAuth and email/password auth, with refresh-token rotation and reuse detection

Org-level audit log, webhooks, and API keys for external integrations

Admin-configurable plan catalogue (pricing/limits) that both the dashboard and the public marketing site read live, so changing a price once keeps it correct everywhere

Public marketing site with a real pricing page synced to live backend data instead of hand-maintained copy

Capabilities

Full workspace hierarchy: organizations, workspaces, projects, sprints, and tasks, with subtasks and labels

Kanban board (drag-and-drop status changes) and a server-side-paginated table view of the same data

Sprint planning with named phases and durations (e.g. Planning 2w, Building 6w, QA 1w), shown on every task in that sprint

Time tracking per task, rolled up into "Working hours" on the task list and a personal "My Tasks" view across every project in an org

AI-generated employee performance reviews (OpenRouter), built from a member's real task completion rate and logged time, manager-only, on demand

Real payments: Stripe Checkout for upgrades, Stripe Customer Portal for self-service billing management, webhook-driven subscription sync

Encrypted project credentials vault (AES-256-GCM, masked list view, audit-logged reveal)

Real-time notifications via Server-Sent Events (task assignment, comments, sprint changes, invitations)

Google OAuth and email/password auth, with refresh-token rotation and reuse detection

Org-level audit log, webhooks, and API keys for external integrations

Admin-configurable plan catalogue (pricing/limits) that both the dashboard and the public marketing site read live, so changing a price once keeps it correct everywhere

Public marketing site with a real pricing page synced to live backend data instead of hand-maintained copy