Software that degrades. Never collapses.
Marcos Matos — software engineer. Multi-tenant SaaS, real-time systems, and AI that fails safely.
The re-architecture I owned. Cost per client fell by three quarters without taking a tenant down.
Current rate, not a lifetime total. N+1 queries eliminated in reports and exports; expensive attributes cached; boot requests deduplicated.
Personal data. Isolated database per client, credentials AES-256-GCM, LGPD retention automated.
Bee Voice: WhatsApp Cloud API calling built from scratch — WebRTC, Coturn, SDP signalling. Shipped to 1,500+ of them.
Remediated from pentest and audit. Then the security gate: 16 mandatory rules and a PR checklist, adopted as the project standard.
01Work
Three places. What made each one hard, and what it cost.
001SIM
- Role
- Full-stack engineer · ~25% of repository history
- Constraint
- A multi-tenant platform for consultancies that each manage hundreds of client companies — where one tenant's brand, data and integrations must never reach another's.
- Built
- End-to-end work in a Turborepo monorepo (Next.js 16, NestJS 11, Prisma 7, PostgreSQL 16), from interface down to database schema, including SOC system integration over SOAP and REST with automatic retry and appointment resync.
- Result
- Table and white-label systems adopted across the product, and an abandoned e2e suite brought back into service.
- Projects
Table design system
One system on TanStack Table — URL-synced faceted filters, density and column visibility, declarative grouping, bulk actions, a mobile card mode, and dependency-free CSV export. Adopted across 13 screens; the duplicated implementations are gone.
White-label pipeline
Automatic palette derivation from a tenant's brand colour with WCAG AA contrast validation, SSR theming with no FOUC or FOUT, asset uploads to Cloudflare R2, and brand propagation across six surfaces.
LGPD front-end compliance
PII scrubbing (CPF, CNPJ, email) in Sentry before events leave the browser, and PostHog gated behind explicit consent — no event fires before opt-in.
E2E recovery
A Playwright suite that had been broken for months, restored with test-helper endpoints for deterministic seeding, covering dashboard widgets, CSV export and CRUD.
002Folheto Digital
- Role
- Co-founder · frontend architecture, now full stack
- Constraint
- Offers went out by hand, into dozens of groups. A banned community takes months of audience at once.
- Built
- The first product taken from nothing to production. Channel and subchannel hierarchy spreads audience across senders. A ban limits blast radius instead of ending it. Reporting shows which broadcast caused what.
- Result
- Grupo Koch — Brazil's 10th largest chain — as flagship client. ~US$60K saved per chain, 150K+ leads managed.
- Projects
Reports & BI
Engagement, campaign and lead-flow reporting. XLSX/CSV export moved into a BullMQ queue and delivered by email, so the reports large enough to time out no longer do.
Internationalisation
A live product taken to pt-BR, EN and ES-ES with next-intl — seven planned phases across 18 namespaces, with parity scripts and key sweeps guarding against translation regressions.
Real-time notifications
Socket.IO in-app notifications: unread badge, dropdown panel, actionable toasts, and deep links that switch company automatically.
WhatsApp channels & automations
Onboarding by dynamic QR code, live connection monitoring, subchannel hierarchy, and a visual automation editor built on React Flow.
003BeeLabs
- Role
- Contract, part-time · 444 components, 94 services, 126 migrations
- Constraint
- 12M messages a week, an isolated database per client. The personal data of 2.8M contacts, already in production. Every change had to land without taking a tenant down.
- Built
- 444 Vue components, 94 domain services and 126 migrations across the platform — voice, security, administration, pipeline, reporting and AI.
- Result
- Infrastructure cost per client down 77%. The security gate became the project standard.
- Projects
Bee Voice
Voice calling over Meta's WhatsApp Cloud API, built from scratch on WebRTC and Coturn — SDP signalling, cascading routing (owner → department → channel), concurrent-call control, in-browser recording with signed S3 uploads, and a call-centre console. A capability the product never had, in the hands of 1,500+ agents.
Security gate
28 pentest and audit findings remediated (IDOR, mass assignment, user enumeration, CSV/formula injection, PII in logs), HMAC with anti-replay on public webhooks, then the gate itself: 16 mandatory rules and a pull-request checklist, adopted as the project's development standard.
AI assistant
Layered architecture — contracts, DTOs, providers, services — with OpenAI and Anthropic selectable per channel, so switching model or provider is configuration rather than a refactor. SSE streaming, rate limiting, per-tenant cost tracking, automated LGPD retention. Provider downtime degrades the feature; it has never taken down the screen.
Tenant admin console
A single console over every tenant, with an incremental sync engine and AES-256-GCM encryption of stored connection credentials. One operation instead of a hundred.
Kanban, pipeline & reports
Custom fields, trigger-driven automations, real-time movement history over WebSocket, and 8+ reports with cascading filters, aggregate KPIs and Excel/CSV export.
Re-architecture
The change that cut infrastructure cost per client by 77%, on a platform carrying 12M messages a week. No tenant went down for it.
Performance
N+1 queries eliminated in reports and exports, expensive attributes cached, and boot requests deduplicated — against 927K tickets in an active database.
02Case
How to reach 150,000 people without losing all of them at once.
Offers went out by hand, into dozens of groups. Communities fixed reach and added the real threat: a banned community takes months of audience at once.
Spreading the audience became architecture. Channels and subchannels, each with its own number, and reporting that shows which broadcast caused what.
It does not prevent the ban. It limits the blast radius.
The cost: dependence on a channel with no contract and no SLA.
03Contact
The record ends here. The work does not.