Tech stack, real-time data, security, and multi-tenancy model.
Loading the guide...
Did this answer your question?
Help us make the guides more useful.
0 helpful · 0 not helpful
This page is for technical evaluators who want to understand what the platform is built on and how it handles data, security, and scale.
Seedly is a Next.js frontend on a Convex backend - run Convex Cloud by default, or self-host it; you own the full source.
Tech Stack
Layer
Technology
Backend and Database
Convex - serverless backend with built-in database, real-time subscriptions, file storage, search indexes, and scheduled functions
Frontend
Next.js (App Router) with React and TypeScript
UI Framework
shadcn/ui + Radix Primitives + Tailwind CSS v4
Authentication
Built-in (OAuth2, JWT, session management)
Permissions
Custom RBAC engine with frontend and backend enforcement
Workflow Builder
React Flow (@xyflow/react)
Email Templates
React Email
Monorepo
Turborepo + pnpm
Frontend Hosting
Vercel
Backend Hosting
Convex Cloud
CI/CD
GitHub Actions
Testing
Vitest (unit) + Playwright (E2E)
Error Monitoring
Sentry
Product Analytics
PostHog
Real-Time Architecture
Seedly CRM is real-time by default. Every data query in the application is a live subscription - when data changes on the backend, every connected client viewing that data receives the update automatically.
This is not achieved through WebSockets, polling, or manual cache invalidation. Convex provides automatic reactivity at the database layer. When a mutation writes to the database, any query that reads the affected data re-executes and pushes the new result to all subscribed clients.
In practical terms:
When a contact replies to an SMS, the conversation updates instantly for every team member viewing it
When someone moves an opportunity to a new pipeline stage, the kanban board updates live for all viewers
When a workflow execution completes, the execution log reflects the result immediately
When a team member edits a contact, the changes appear everywhere that contact is displayed
None of this needs a page reload. Some figures are fetched or stored rather than pushed live, such as numbers from outside services like Stripe, the saved totals on Admin Analytics and segment contact counts, so a few screens have a Refresh button.
The top-level entity. One agency owns the entire installation. The agency sets master credentials, defines plans, manages brands, and has visibility across all data.
Brand
An organizational grouping within the agency. Brands can have their own branding, billing schedules, integration credential overrides, and design tokens. A brand admin manages the sub-accounts within their brand.
Sub-Account
The working unit. Each sub-account represents one client and contains its own contacts, conversations, pipelines, workflows, invoices, and all other data. Sub-accounts are strictly isolated - data from one sub-account is never accessible from another.
Data Isolation
Sub-accounts are strictly isolated at the data layer, and that isolation is enforced on every operation. There is no way for a query to return data from a sub-account the user does not belong to.
Credential Cascade
Integration credentials (API keys, OAuth tokens, provider settings) resolve in order: sub-account first, then brand, then agency, then platform defaults. This means you can set credentials once at the agency level and override them selectively where needed.
Security
Authentication
Built-in authentication with OAuth2 sign-in and signed session tokens
Session management with token refresh and revocation
2FA enforcement can be enabled as a site-wide policy
User accounts live in your own backend, with no third-party identity provider required
Authorization
Custom role-based access control (RBAC) with four system roles and support for custom roles
Permission matrix: 35 modules, 4 actions each (view, create, update, delete), with scope control (own, team, all)
Backend enforcement on every mutation - all write operations are permission-checked before execution
Frontend enforcement for UI element visibility - users only see what they can act on
Privilege escalation prevention - users cannot create or assign roles at or above their own rank
Feature gating by plan - modules can be enabled or disabled per subscription tier
Usage limit enforcement - resources are metered per plan
Data Security
OAuth tokens and sensitive credentials are encrypted at rest in the database
Runtime schema validation on every backend operation
HTML sanitization on all user-generated content to prevent XSS
Webhook Security
Cryptographic signature verification on all inbound webhooks from third-party providers
Signed payloads for outbound custom webhooks
Audit Logging
Every mutation is logged in the audit trail
Audit entries include: action type, entity type, entity ID, user who performed the action, timestamp, and a diff of changes
Filterable audit log UI: search by action, entity type, user, and date range
Export capability for compliance
Rate Limiting
Per-token rate limiting on all public mutations (invoice view, estimate accept, document sign, and other customer-facing actions)
Configurable daily send caps per sub-account for email and SMS
Configurable refund caps (per-day count and per-refund ceiling)
Webhook deduplication prevents double-processing on provider retries
Workflow execution limits to prevent runaway automations
CSP Headers
Per-route Content Security Policy with frame-ancestors, script-src, and CAPTCHA scoping
Hardened across all public-facing routes to prevent clickjacking and script injection
File Upload Validation
MIME type allowlist with magic-byte sniffing to reject disguised file types
PNG pixel-bomb detection to prevent decompression-based denial of service
Per-purpose size caps tailored to each upload context (profile photos, documents, attachments)
Security Test Coverage
A dedicated suite of 1,500+ automated security tests covers IDOR (insecure direct object reference) and RBAC scenarios across every module
They run in CI on every change, verifying that no user can read or write data outside their permissions or their sub-account
Authorization is enforced on the backend for every write - the UI never decides what is allowed
Type checking runs over the backend as well as the front end before a change can land, so a change that would not compile is caught in CI rather than at runtime
Dependency Currency
Known published advisories in the platform's dependencies were cleared release by release rather than left to accumulate, and the final release ships with that slate clean
The sign-in system and the image-processing library are both kept current, since both sit on paths that handle untrusted input
Scalability
Seedly CRM is built on Convex, a serverless platform that handles scaling automatically. There are no servers to provision, no database connections to pool, and no infrastructure to tune.
Compute scales automatically based on load - backend functions execute on demand
Database scales with usage - no connection limits, no manual sharding
File storage is built into the platform with no separate object storage to manage
Scheduled functions (cron jobs) run reliably without a separate job queue
Real-time subscriptions scale with the number of connected clients without additional WebSocket infrastructure
The frontend is hosted on Vercel with automatic edge distribution and scaling.
Hosting and Deployment
Component
Host
Details
Frontend
Vercel
Automatic deployments from GitHub, edge CDN, preview deployments for branches
Automated testing, type checking, and deployment pipelines
Both Vercel and Convex handle SSL certificates, CDN distribution, and uptime monitoring automatically.
Convex Cloud is the default and the fastest way to go live, but it is not a lock-in. Because you receive the source, advanced users can run Convex locally during development and self-host it on their own servers in production. The Next.js frontend can likewise be hosted on Vercel or any platform that runs Next.js. You own and control the source for both halves of the stack.
Background Processing
The platform runs scheduled background jobs for ongoing maintenance and automation, including:
Workflow trigger evaluation and appointment reminders
Campaign step processing and task reminders
Conversation snooze reopening and SLA monitoring
Review sync and review request reminders
Notification digest batching
Gmail and calendar watch renewal
Email domain warmup and DNS verification
Recurring invoice generation
Overdue checks for tasks, invoices, and deals
Data cleanup and engagement score maintenance
All scheduled jobs run on Convex's built-in cron system with no external job queue required.
Data Retention
The platform enforces automatic data retention policies to keep storage clean and support compliance:
Deleted contacts (trash) are held for a recovery window, then permanently removed along with their linked conversations and messages
Audit logs are retained for a fixed compliance window
Webhook delivery and event-processing records are cleaned up automatically on a rolling schedule
Rate-limit tracking data is short-lived and cleared automatically
Active data (contacts, conversations, opportunities, invoices, documents) is kept indefinitely. Per-contact data erasure is available on demand for compliance with data protection requests.