Problem
Applications, review, billing, renewals and introductions between members ran across a prototype app, CRM forms and the website.
The nonprofit needed one app that denies every request unless the member is allowed to see the data.
What I built
- Sign-in and a data proxy that checks ownership on every request.
- Applications intake with staff approval and no duplicate processing.
- A billing lifecycle: approval creates real invoices, and payments create or extend memberships.
- A daily expiry sweep with lockout, including members who are signed in when their membership expires.
- A portal application form with private upload of tax-ID documents, kept in the portal instead of the CRM.
- Advisory and facilitation request forms that staff work from one screen and invoice from.
- A security audit before cutover from the prototype.
- On the live WordPress site, I found why images broke every day (the site address settings used http while visitors used https) and fixed it.
Stack
- Next.js
- NoCodeBackend
- Vercel
- HighLevel
- WordPress and Elementor
- Stripe invoicing
Outcomes
- Rebuilt in 11 phases, with an authorization test suite that proves each member company sees only its own data.
- Cut over from the prototype in September 2026.