Case study
Botaura
Bot nahi. Aura.
Founder & solo developer — full product: architecture, backend, frontend, and infra.
A multi-tenant RAG chatbot SaaS built for small and medium businesses in Pakistan. Each business gets an AI chatbot trained on its own content — website, catalog, FAQs — deployable as a web widget and as full WhatsApp Business automation, including order-taking and cash-on-delivery checkout, with no code. I built the whole product solo.
Overview
Botaura is a multi-tenant platform where each business gets its own AI chatbot trained on its own content — website, product catalog, FAQs, documents — deployable as a web widget and as full WhatsApp Business automation, including order-taking and COD checkout, without writing any code. It's my biggest project, and I built and run all of it myself.
The problem
Pakistani SMBs — retailers, service businesses, D2C brands — get most of their sales inquiries on WhatsApp but have no scalable way to answer them. Customers ask the same things (pricing, availability, delivery) over and over, businesses lose leads overnight and during rush hours, and existing chatbot tools are either too generic (not trained on the business's actual catalog and FAQs) or too expensive and complex for a small team to set up. Botaura had to give a small shop owner in Karachi enterprise-grade AI customer engagement — but self-serve, affordable in PKR, and live within a day.
The solution
A multi-tenant platform where each business gets an AI chatbot trained on its own content, deployable as a web widget and as full WhatsApp Business automation — inbound Q&A, a complete order flow with cash-on-delivery, a team inbox for human handoff, and marketing tools — all self-serve, no code required.
- RAG-powered chatbot answering from a business's own knowledge base (crawled web content, uploaded docs, product catalogs).
- WhatsApp Business automation — inbound Q&A, a full COD order flow, a team inbox for human handoff, and customer segmentation.
- Marketing tools — broadcast campaigns via Meta's Marketing Messages API, Click-to-WhatsApp ad attribution, and automated abandoned-cart recovery.
- Store API — a universal event-ingestion layer with thin adapters for WooCommerce and Shopify, so store data flows in without per-client integration work.
- Observability & support — an admin health dashboard, a client-facing 'Bot Health' view, and a built-in support ticketing system.
Technical architecture
Strict tenant isolation by design, not convention
Every tenant-scoped table cascades from a businesses table, and the business_id for each request is never trusted from the request body — it's resolved server-side from context that can't be spoofed: the authenticated user ID for the dashboard, a signed JWT subject for the widget, a hashed API key for the Store API, and the WhatsApp phone_number_id for messaging traffic. That closes off a whole class of cross-tenant data-leak bugs before they can happen.
A Tech Provider model for WhatsApp at scale
Instead of storing a separate Meta access token per client (which doesn't scale and multiplies the security surface), Botaura uses a single system-level token and routes traffic by phone_number_id. One codebase serves every tenant's WhatsApp number without per-client credential management — while Meta still bills each client directly, keeping the platform out of the payments loop.
Hybrid retrieval tuned for real conversations
The RAG pipeline combines pgvector cosine similarity with BM25 keyword search, using multilingual embeddings so it handles the English / Roman-Urdu code-switching that's normal in real customer messages — with a confidence threshold that decides when the bot should hand off to a human instead of guessing.
A topology shaped by real infra constraints
Hugging Face Spaces can't complete Meta's TLS handshake directly, so all outbound WhatsApp / Graph API calls route through a relay layer on Vercel — a constraint found in production and solved architecturally rather than patched per-call.
Problems I ran into
…and how I worked through them.
The problem
A live production incident: regenerating the platform's system-level Meta token silently broke WhatsApp Business Account (WABA) asset assignment for the pilot client.
How I solved it
Diagnosed and resolved it without extended downtime, then hardened the setup so a token change can't silently break asset assignment again.
The problem
Silent failures in the order flow — e.g. COD confirmations failing because a WABA currency wasn't configured — with no visibility until a client noticed.
How I solved it
This directly motivated the observability stack: dedicated logging tables, admin runbook cards, and a client-facing health view, so failures surface immediately instead of silently.
The problem
A fail-open risk in the webhook / event-ingestion path that could let unverified events through.
How I solved it
Closed it before the first paying-adjacent client went live, so the ingestion path fails safe.
Results
- 162 routes shipped across a full-stack, multi-tenant SaaS product, built solo.
- Onboarded and supported a live pilot client (an organic-products business) through the full Tech Provider WhatsApp setup, catalog ingestion, and order automation.
- Shipped a complete revenue engine: broadcast campaigns, ad-attribution tracking, and automated cart recovery.
- Built a Store API layer that lets WooCommerce and Shopify stores connect without bespoke work — WooCommerce first, given its share of the Pakistani market.