A law practice platform that replaced inbox operations
AR&CO Law Associates ran their client operations out of email and phone calls, with no single system of record. I designed, built and deployed a three-portal platform: a public site, a client portal and a staff CRM, pulling intake, case tracking, documents and payments into one place. It was my first paid client, a roughly 7,000 USD build won on a referral.
What was the manual bottleneck?
Everything moved through an inbox. New clients had no way to track a case, submit a complaint or reach a document without calling the office directly, so the firm fielded status-update calls instead of doing legal work. Staff spent hours each week on intake admin, collecting payments by hand and chasing document uploads.
There was no single record of client interactions, cases or billing. The work was not hard, it was repetitive and scattered, and it sat between the attorneys and the hours they were actually paid for.
They needed a platform that let clients self-serve and let staff stop running operations out of their inboxes.
Three portals, one platform
A full-stack platform with three distinct portals, each built for a different audience, sharing one data model and one system of record.
The public site
Practice areas, the team and the firm’s subscription offerings, built to turn a visitor into a registered client and route them into the right intake flow.
The client portal
Authenticated clients track their active cases and full timelines, submit and monitor complaints, book and pay for consultations, and reach their documents without phoning the office.
The staff CRM
Attorneys and staff manage cases, assign work, log client interactions, process registrations and send invoices, with every action recorded in one auditable place.
How does the platform hold together?
A NestJS backend API sits behind a Next.js frontend served through a secure proxy. Supabase handles authentication, the PostgreSQL database, row-level security and file storage. LemonSqueezy processes payments as Merchant of Record. Four decisions carry most of the weight.
Layered authentication
Every request passes through a JWT guard and a role guard before it reaches a handler. Clients see only their own data, staff see the full system, and row-level security at the database sits underneath the application code as a second check.
Webhook-driven payments
When a client pays for a subscription, a consultation or a service, LemonSqueezy sends a signed webhook as Merchant of Record. The backend verifies the HMAC signature, drops duplicate events and updates the record. No polling, no manual reconciliation.
Automatic audit trail
A global interceptor logs every create, update, delete and status change across the system without any per-endpoint code. Staff can filter the activity log by user, action, entity or date, which matters for a firm working in a regulated setting.
Shared validation
The same Zod schemas run on the frontend form and the backend endpoint. One definition, one source of truth, so what the client submits is what the server accepts.
What changed for the firm?
In plain operational terms, three things moved. I am describing what the platform does in production, not putting a number on it.
Operations streamlined: intake, case tracking, documents and payments run through one platform instead of email threads and phone calls.
Bookkeeping easier: payments across subscriptions, consultations and per-service registrations reconcile through signed webhooks rather than manual entry.
Case management improved: staff work cases and log interactions in one place, and clients can see where their matter stands without calling the office.
What I learned building it
In the AR&CO build I hit the gap between a clean scope and a real business. I scoped it for six weeks. It ran about four months, and almost none of that was code. The delay came from the client side: decisions that needed sign-off sat waiting, requirements shifted as the firm looked at their own operations properly for the first time, and content and access I needed arrived in pieces.
I could have treated that as noise. Instead it taught me how a build survives contact with a working firm: keep the architecture ready for change, keep the scope visible so drift is a conversation rather than a surprise, and design so that the parts already agreed can ship while the rest is still being decided.
The platform is live and doing its job. The timeline is the part I will not dress up, because managing it is now part of how I work.
This was a platform build. The same instinct, removing the manual work that sits between a team and the hours they are paid for, is what I bring to the agency systems I design, build and deploy.
A 15-minute call is usually enough to know if there is a fit.
No slides, no pitch.