BlindForward SaaS Blueprint & PoC

# BlindForward SaaS Blueprint & Proof of Concept (PoC)

I am building BlindForward, a consent-based email-forwarding SaaS for Chartered Accountancy (CA) firms. I am looking for an experienced full-stack developer to establish a secure technical foundation before production development begins.

## Project Objective

The initial engagement will deliver comprehensive technical documentation and a working Google-based Proof of Concept (PoC). The goal is to validate the proposed architecture, email forwarding workflow, security approach, and database integration before committing to full-scale development.

## Proposed Technology Stack

- Google Apps Script
- Gmail API and Google OAuth
- Supabase PostgreSQL
- HTML, CSS and JavaScript for dashboard planning and future development

## Required Deliverables

**1. System Architecture and Technical Documentation**

- Logical and physical architecture diagrams
- Component boundaries, data flows and user journeys
- Authentication, authorization, consent and security design
- Error handling, monitoring and recovery strategies

**2. Supabase Database Design**

- Database schema, tables, relationships and constraints
- CA firms, clients, email rules, activity logs and usage tracking
- Subscription, billing and notification data models
- Row-Level Security (RLS), access policies and migration documentation

**3. Gmail API and OAuth Integration Plan**

- Authentication and explicit user-consent workflow
- Minimum required OAuth permissions and scope justification
- Sender-based email forwarding rules and processing workflow
- API quotas, rate limits, duplicate prevention and failure handling
- Consent revocation and account disconnection

**4. Admin Dashboard Specification**

- CA firm and client management
- Email connection and forwarding-rule management
- Usage statistics, failure logs and audit trails
- Subscription and billing workflow
- Role-based access control

**5. Multi-Provider Feasibility Research**

Assess the feasibility of integrating Microsoft 365, Zoho, Yahoo and Rediffmail in future phases. Document available APIs, authentication methods, forwarding capabilities, provider restrictions, quotas, costs and migration considerations.

This deliverable is a feasibility assessment, not a commitment to implement every provider during the initial engagement.

**6. Security and Testing Plan**

- Test cases and measurable acceptance criteria
- Protection of OAuth tokens and sensitive data
- Tenant isolation and access-control testing
- Error monitoring, retries and recovery
- Consent withdrawal and secure disconnection

**7. Working Google-Based Proof of Concept**

Build a small, demonstrable PoC that:

- Connects a dedicated test Gmail account using the approved authentication method
- Obtains explicit consent and uses the minimum necessary permissions
- Processes a sample email according to an agreed sender-based rule
- Demonstrates the approved forwarding workflow
- Records relevant activity and status in Supabase without unnecessarily storing email content
- Handles duplicate messages and common failures
- Supports disconnecting the test account and revoking access

The PoC must use test accounts and test messages, not production customer emails.

## Documentation and Handover

- Maintain documentation in a shared Git repository using Markdown or AsciiDoc
- Provide architecture diagrams in draw.io or PlantUML
- Commit the PoC source code and setup instructions to the repository
- Include environment configuration instructions, database migrations and testing instructions
- Hand over all project source code, documentation and agreed project assets

No real credentials, passwords or OAuth secrets should be committed to the repository.

## Milestones and Acceptance

Please propose separate milestones for:

1. Requirements review and architecture approval
2. Database design and technical documentation
3. Working Google-based PoC
4. Testing, demonstration and final handover

Each milestone must have clear deliverables and acceptance criteria. Any additional scope, third-party costs or technical limitations must be disclosed before approval.

The next production-development phase will be considered separately after the documentation and PoC have been reviewed and accepted.

Please share relevant experience with Gmail API, Google OAuth, PostgreSQL, Supabase and SaaS integrations when submitting your proposal.

**Important:** This engagement is for technical documentation and a limited working PoC, not the complete production-ready SaaS platform.