Arivu Technologies
INTERNAL WORKSPACE PLATFORM - ARIVU BUILT82 Features

NeoFlow Hub
Self-Hosted Workspace Platform

A complete self-hosted team workspace platform unifying team chat (Slack replacement), Kanban project boards (Trello/Jira replacement), and an isolated white-labeled client portal (ManyRequests replacement) - into one fully owned, zero-vendor-dependency system. 82 features. 18-week delivery. ~$15/month to run vs. $50–200/month on SaaS.

NEOFLOW HUB LIVE SPECDESIGN LOCKED
Total Features82 (vs. Slack + Trello + SuiteDash)
Delivery Timeline18 weeks (9 × 2-week sprints)
ModulesChat, Kanban, Gantt, Client Portal, CRM
Real-Time EngineCustom WebSocket server (ws)
MonorepoTurborepo + pnpm workspaces
DatabasePostgreSQL + Prisma ORM
File StorageMinIO (S3-compatible, self-hosted)
HostingContabo VPS M + Cloudflare + Docker
01 / BUILD VS. BUY

SaaS charges per seat. Self-hosted charges once.

Slack + Trello/Jira + ManyRequests (or SuiteDash) combined cost $50–200/month for a small agency team. They're also three separate logins, three separate data sources, and three vendor contracts that can change their terms. NeoFlow Hub replaces all three with one self-hosted platform on a single VPS at ~$15/month running cost.

Full Ownership

No vendor lock-in, no recurring per-seat fees.

Brand Control

Client portal on your own domain - not a third-party tool.

Data Sovereignty

Messages, files, and project data on your own VPS.

Cost Efficiency

~$15/month VPS vs. $50–200/month SaaS stack.

82 Features
Benchmarked vs. Slack, Jira, Linear, ClickUp, SuiteDash
18 Weeks
Target delivery (9 × 2-week sprints)
3 Modules
Chat + Kanban/Gantt + Client Portal
~$15/mo
Self-hosted VPS running cost vs. $50–200 SaaS
02 / WHAT NEOFLOW HUB REPLACES

Three SaaS tools. One platform.

Team Chat

Replaces:Slack
Real-time channels (public, private, per-project)
Direct messages and group DMs
Threaded replies
File sharing via MinIO S3-compatible storage
@mentions, emoji reactions
Message search with full-text indexing

Project Management

Replaces:Trello / Jira / Linear
Kanban board with drag-and-drop columns
Gantt timeline view (dependencies)
Subtasks and task hierarchies
Labels, assignees, due dates, priority flags
Board templates and draft workflows
Automations (on due-date, on status change)

Client Portal

Replaces:ManyRequests / SuiteDash
Isolated portal subdomain: portal.hub.[domain]
Task visibility toggle (internal vs. client-visible)
Client approval workflow (Approve / Request Changes)
Shared file deliverables with version history
Client notification preferences (email, in-portal)
03 / TECHNOLOGY STACK

Full-stack workspace engineering.

LayerTechnologyPurpose
MonorepoTurborepo + pnpm workspacesShared packages: auth, db, types, UI components
FrontendNext.js 15 + TypeScript + TailwindTeam workspace app + client portal (same codebase, isolated routing)
API LayertRPC + Zod validationType-safe end-to-end API for all non-realtime operations
Real-Timews (WebSocket server, Node.js)Chat messages, board sync, presence, typing indicators
AuthNextAuth.js + Google OAuth + 2FATeam auth + client portal isolated session management
DatabasePostgreSQL 16 + Prisma ORMMessages, tasks, boards, users, files, audit log
File StorageMinIO (S3-compatible, self-hosted)File attachments in chat and project boards
SearchPostgreSQL FTS (pg_trgm + tsvector)Full-text search across messages, tasks, and files
CI/CDGitHub Actions + Docker ComposeBuild, test, staging deploy, production rollout
HostingContabo VPS + CloudflareSelf-hosted VPS (~$15/mo) + Cloudflare for SSL and DDoS
04 / INSPECTABLE CODE

Real production code from NeoFlow Hub.

apps/ws-server/chat.ts

Custom WebSocket server handles channel subscriptions, DM routing, and presence tracking. Each team workspace maps to isolated namespaces - client portal traffic is fully separated from internal team channels.

1import { WebSocketServer, WebSocket } from "ws";
2import { verifyJwt } from "@hub/auth";
3
4const wss = new WebSocketServer({ port: 3100 });
5const rooms = new Map<string, Set<WebSocket>>(); // channelId → connected clients
6
7wss.on("connection", async (socket, req) => {
8 const token = new URL(req.url!, "ws://hub").searchParams.get("token");
9 const user = await verifyJwt(token ?? "");
10 if (!user) return socket.close(4001, "Unauthorized");
11
12 socket.on("message", async (raw) => {
13 const msg = JSON.parse(raw.toString());
14
15 if (msg.type === "JOIN_CHANNEL") {
16 const room = rooms.get(msg.channelId) ?? new Set();
17 room.add(socket);
18 rooms.set(msg.channelId, room);
19 broadcastPresence(msg.channelId, user.id, "ONLINE");
20 }
21
22 if (msg.type === "SEND_MESSAGE") {
23 const saved = await db.messages.create({ data: { ...msg, userId: user.id } });
24 rooms.get(msg.channelId)?.forEach(client =>
25 client.send(JSON.stringify({ type: "NEW_MESSAGE", data: saved }))
26 );
27 }
28 });
29
30 socket.on("close", () => {
31 rooms.forEach(room => room.delete(socket));
32 broadcastPresence("*", user.id, "OFFLINE");
33 });
34});
05 / SYSTEM ARCHITECTURE

Turborepo monorepo. Isolated portals.

TURBOREPO WORKSPACE STRUCTURE
apps/hub

Main workspace Next.js app (team login, chat, boards)

apps/portal

Client portal subdomain app (isolated session, filtered data)

apps/ws-server

Custom WebSocket server (Node.js, port 3100)

SHARED PACKAGES
packages/auth
packages/db (Prisma)
packages/types
packages/ui
DATA LAYER (Docker Compose)
PostgreSQL 16
Redis (sessions/cache)
MinIO (file storage)
Cloudflare (SSL/edge)
06 / DATABASE SCHEMA

9 core tables. One relational database.

TableKey ColumnsPurpose
usersid, email, name, role (ADMIN/MEMBER/CLIENT), avatarUrl, twoFactorEnabledUser accounts + client accounts
workspacesid, name, domain, ownerId, plan, settings (JSON)Multi-workspace root
channelsid, workspaceId, name, type (PUBLIC/PRIVATE/DM), memberIdsChat channels and DM rooms
messagesid, channelId, userId, body, attachments[], threadParentId, clientVisibleChat messages + thread replies
boardsid, workspaceId, name, clientId (nullable), type (KANBAN/GANTT)Project boards per workspace
cardsid, boardId, columnId, title, description, assignees[], dueDate, priority, clientVisibleKanban/Gantt task cards
clientsid, workspaceId, name, email, portalPassword, projectIds[]Client accounts for portal access
filesid, uploaderId, size, mimeType, url (MinIO), clientVisible, linkedToChat and board file attachments
audit_logid, userId, action, entityType, entityId, payload, createdAt (APPEND-ONLY)Security and compliance audit trail
07 / 18-WEEK SPRINT PLAN

6 phases. 9 sprints. Signed off at each gate.

Phase 0 · Week 0

Foundation & Validation

32 high-fidelity screens designed (Stitch design system)
Feature specification matrix finalized and reviewed
Architecture validated (Turborepo monorepo)
VPS infrastructure specified (Contabo VPS M)
Phase 1 · Sprints 1–2

Auth, RBAC & Workspace Core

Monorepo scaffolded (Turborepo + pnpm)
Docker development stack running
CI/CD pipeline (GitHub Actions)
Authentication live (NextAuth.js + Google OAuth)
Role-based access control
Workspace invite system
Phase 2 · Sprints 3–4

Chat + Kanban Core

Real-time chat (channels, DMs, threads)
File sharing via MinIO
Kanban board system live
Card management (labels, assignees, due dates)
Real-time board sync via WebSocket
Phase 3 · Sprints 5–6

Advanced Features + Client Portal

Gantt timeline view with task dependencies
Project templates and draft workflow
Client portal isolated and live
Client visibility toggles active
Client approval workflow deployed
Phase 4 · Sprint 7

Power Features & Admin

CRM contact management module
2FA enforcement for admin accounts
Security audit log (all actions)
Global full-text search across channels and boards
Phase 5 · Sprints 8–9

QA, Polish & Launch

Automated test suite (Vitest + Playwright)
Performance audit (Lighthouse ≥90)
Production deploy on Contabo VPS M
Custom domain + Cloudflare SSL
Final Product Owner sign-off
08 / CHAT MODULE - THE SLACK REPLACEMENT

Real-time. Self-hosted. Fully owned.

Channels (Public & Private)

Per-project channels, department channels, and general channels. Public channels visible to all workspace members. Private channels require explicit invite.

Threads

Reply in-thread to any message without interrupting the channel feed. Thread count and latest reply shown inline.

Direct Messages

1:1 DMs and group DMs with up to 8 participants. Notification badge on sidebar for unread DMs.

File Sharing (MinIO)

Drag-and-drop file upload to MinIO S3-compatible storage. Images, PDFs, and design files inline-rendered in chat.

Presence Indicators

Online / Away / Do Not Disturb status broadcast via WebSocket. Typing indicators shown in real-time.

Message Search

PostgreSQL full-text search (tsvector + pg_trgm) across all channels. Filter by channel, sender, and date range.

09 / CLIENT PORTAL MODULE

Your brand. Your domain. Your client's window.

Clients access a clean, professionally branded portal - completely separated from internal team workspace. They see only what the team has explicitly toggled as 'Client Visible'. Internal notes, private threads, and in-progress drafts are never surfaced.

Isolated Subdomain

Client portal runs on portal.[your-domain].com - not a shared third-party platform URL. Your brand, your domain.

Task Visibility Toggle

Every Kanban card and file has a 'Client Visible' toggle. Internal work-in-progress is hidden until the team explicitly shares it.

Approval Workflow

Clients review submitted deliverables and action with Approve or Request Changes. Status tracked on the team's board in real-time.

File Deliverables with Versioning

Design files, reports, and documents shared to the client portal with version history - client always sees the latest, with access to previous versions.

Client Notification Preferences

Clients configure which events they want notified on: new deliverable, approval requested, message. Email and in-portal notification channels.

Zero Internal Leak Guarantee

Next.js middleware + clientId context injection ensures every database query in portal mode is automatically scoped to client-visible records only.

10 / SECURITY & COMPLIANCE POSTURE

Enterprise security. Self-hosted simplicity.

WebAuthn / TOTP 2FA

Time-based OTP or hardware security key 2FA enforced for all admin accounts. Optional for all workspace members.

Immutable Audit Log

Append-only audit_log table captures every security-relevant action: login, permission change, file access, client portal data access.

Portal Isolation (Middleware)

Client portal middleware injects clientId context - impossible for a portal session to access another client's data without explicit DB query manipulation.

End-to-End TLS (Cloudflare)

All traffic terminated at Cloudflare edge with TLS 1.3. Internal VPS communication via Docker bridge network - no public exposure of database or Redis ports.

11 / QUALITY GATES & TESTING

Every sprint ships to staging first.

Unit Tests (Vitest)

  • tRPC procedure input validation
  • Risk/permission logic
  • Utility functions (date, string, auth helpers)

Integration Tests (Playwright)

  • Chat flow: send message, thread reply, file upload
  • Board flow: create card, move, assign, due date
  • Client portal: login, visibility filter, approval

Performance Gates (Lighthouse)

  • Performance ≥90 on staging
  • Accessibility ≥90 (WCAG AA)
  • LCP < 2.5s on 3G throttle (Next.js ISR pages)
12 / FAQs

Questions about NeoFlow Hub?

What external SaaS tools does NeoFlow Hub replace?

How is the client portal isolated from internal team communication?

What is the real-time synchronization architecture?

What is the infrastructure hosting setup?

ARIVU WORKSPACE ENGINEERING · BENGALURU

Ready to own your team's workspace infrastructure?

Arivu builds NeoFlow Hub-equivalent custom workspace platforms for agencies, studios, and tech teams. Contact the team to scope your deployment.