Case study
Botaura
Bot nahi. Aura.
Founder & Solo Systems Architect — Complete Product: Architecture, Backend, Frontend, and Cloud Infrastructure.
A production multi-tenant RAG SaaS built for Pakistani SMBs. Businesses ingest domain content (websites, catalogs, PDFs) to deploy intelligent AI chatbots on web widgets and WhatsApp Business with zero code, automated COD checkout, and team inbox routing.
Overview
Botaura is a multi-tenant AI platform enabling small and medium enterprises to train custom generative AI agents over their proprietary catalogs, PDFs, and web pages. It orchestrates zero-code web widgets and complete WhatsApp Business automations — including lead qualification, product recommendations, cash-on-delivery (COD) order placement, and live human-agent handoffs.
The problem
Pakistani SMBs conduct the vast majority of sales conversations on WhatsApp but lack automated 24/7 engagement. Generic chatbots fail because they lack domain catalog knowledge and cannot complete checkout flows, while international enterprise SaaS platforms are prohibitively expensive and lack local currency/payment support. Botaura solves this with instant, self-serve, localized AI commerce.
The solution
A highly scalable multi-tenant architecture where every merchant configures an AI assistant trained on custom business data, integrated directly into WhatsApp Cloud API with automatic catalog sync, COD checkout flows, broadcast messaging, and agent inbox handoffs.
- End-to-End RAG Knowledge Ingestion: Multi-format document parser, chunking engine, and vector indexing with pgvector.
- WhatsApp Commerce Engine: Conversational catalog search, automated COD order confirmation, and abandoned cart recovery.
- Meta Tech Provider Token Router: High-throughput webhook engine handling template approvals, message events, and delivery reconciliation.
- Universal Store API: Plug-and-play event ingestion layer with adapters for WooCommerce and Shopify.
- Enterprise Observability: Real-time bot health monitoring, telemetry dashboards, and automated fail-safe recovery.
Technical architecture
Cryptographic & Row-Level Tenant Isolation
Every database entity strictly cascades from tenant business records. Request context resolves business IDs server-side from cryptographically signed JWTs, hashed API keys, or verified WhatsApp phone IDs — guaranteeing zero cross-tenant data leakage.
Meta Tech Provider Centralized Routing Architecture
Rather than managing fragile per-client API secrets, Botaura operates a single high-security Tech Provider token and dispatches outbound/inbound traffic dynamically by phone_number_id. Clients are billed directly by Meta while the platform securely orchestrates all messaging.
Hybrid Retrieval with Multilingual Roman-Urdu Grounding
Combines dense pgvector cosine embeddings with sparse BM25 keyword matching to accurately understand mixed English and Roman-Urdu queries common in Pakistani commerce. Features automated confidence scoring for seamless human agent handoffs.
Production Infrastructure & Relay Topology
Built a distributed relay layer between Next.js Edge routes on Vercel and high-performance Python FastAPI workers on Hugging Face Spaces / Neon DB to guarantee sub-second LLM streaming and flawless TLS handshakes with Meta Graph APIs.
Problems I ran into
…and how I worked through them.
The problem
Production Token Regeneration Bug: A live system-level Meta credential rotation silently disrupted WhatsApp Business Account (WABA) asset delegation for a pilot merchant.
How I solved it
Rapidly diagnosed root cause via Meta Graph API logs, restored webhook routing without downtime, and implemented automated token renewal validation tests.
The problem
Silent Order Flow Discrepancies: COD checkout notifications failing due to unconfigured WABA multi-currency settings without visible error feedback.
How I solved it
Engineered dedicated logging tables, structured admin telemetry cards, and real-time merchant alert notifications to surface execution anomalies instantly.
The problem
Webhook Security & Fail-Open Vulnerability in Event Ingestion.
How I solved it
Hardened signature validation middleware with SHA-256 HMAC verification to enforce strict fail-safe rejection of untrusted payloads.
Results
- Architected and shipped 162+ production routes solo across full-stack Next.js and FastAPI services.
- Successfully onboarded and automated operations for a live commercial pilot client (organic consumer goods brand).
- Shipped comprehensive revenue tools: Click-to-WhatsApp ad attribution, broadcast marketing campaigns, and cart recovery.
- Constructed zero-friction Store API for WooCommerce and Shopify inventory synchronization.