Loopie — Hackathon Submission

Inspiration

Most small business owners aren't finance people — they're bakers, contractors, salon owners, and freelancers who got into business to do the work they love, not to reconcile bank feeds at midnight. Yet a huge share of small business failures come down to cash flow problems, not lack of profit. A real CFO costs well over $100K a year — completely out of reach for the businesses that need one most. We kept coming back to the same question: what if every small business could have a CFO in their pocket — one that actually understands their numbers, explains them in plain English, and can take action, not just generate reports? That question became Loopie.

What it does

Loopie is an AI CFO agent for small businesses. It connects to a business's financial data and continuously watches cash flow, expenses, invoices, payroll, and revenue. Instead of dumping raw numbers on the owner, it explains what's actually happening — "your payroll costs are rising faster than revenue" — and recommends specific next steps.

But Loopie doesn't stop at advice. When it finds an opportunity, like a cheaper payroll provider, it shows the owner exactly what it would cost, what data would be shared, and what risk is involved — and only acts after the owner explicitly approves. In our demo, Loopie helped a small business owner discover she could save $210 a month ($2,520 a year) just by asking one simple question about her cash flow.

How we built it

We built Loopie as a React web app backed by an AI agent and layered it with three pieces of serious infrastructure instead of hackathon shortcuts:

• AWS Cognito handles account creation, login, and browser session management.
• Pomerium sits in front of everything sensitive as a Zero Trust checkpoint — every request to our backend and AI agent is independently verified and tied to a specific user, company, and role (Owner, Accountant, Employee, or Viewer), so Cognito authenticating you in the browser is never treated as enough on its own.
• Zero.xyz gives Loopie the ability to reach outside its own walls — searching for and executing real capabilities like payroll comparisons, invoice reminders, and supplier research — but always behind an approval gate, with spending budgets and audit logging built in.
• Cursor was our development environment throughout, which let us move quickly while keeping TypeScript diagnostics, linting, and tests close at hand.

We designed the whole system around one rule: identity is checked independently at every layer, and nothing sensitive or irreversible ever executes without a human saying yes.

Challenges we ran into

The hardest part wasn't any single integration — it was making three separate trust systems (Cognito, Pomerium, and Zero.xyz) work together without any of them silently trusting the others. It's tempting to let a browser-provided identity header stand in for real authorization, but we deliberately built Pomerium to verify its own signed assertion server-side rather than trust anything the client claims. Getting the approval workflow right for Zero.xyz was similarly tricky — we needed the agent to be genuinely useful (finding real savings) without ever being able to spend money or share data without explicit, scoped permission. Balancing "smart enough to be helpful" against "safe enough to trust with real financial access" shaped almost every design decision.

Accomplishments that we're proud of

We're proud that Loopie isn't just a chatbot wrapper around a spreadsheet — it's a working agent with a real security model. Every action is authenticated, authorized, budgeted, approved, and logged, end to end. We're especially proud of the approval workflow: showing cost, risk, and data-sharing details before anything happens is a small UI decision that does a lot of trust-building work. And getting a full, believable demo scenario running — from login, to detection, to a concrete dollar-figure result — in the time we had felt like a real win.

What we learned

We learned that building something trustworthy is a very different problem from building something that works. It's easy to make an AI agent that takes actions; it's much harder to make one where a small business owner would actually feel safe handing over financial access. We also learned a lot about layering security properly — treating authentication (who are you) and authorization (what are you allowed to do) as genuinely separate concerns, verified independently, rather than assuming one implies the other.

What's next for Loopie

Next, we want to expand Loopie's library of capabilities beyond payroll and invoicing — supplier negotiation, tax-readiness checks, and lender-ready reporting are high on the list. We'd also like to build a lightweight mobile experience so owners can approve actions on the go, and add richer historical trend analysis so Loopie gets smarter about this specific business the longer it's used. Longer-term, we want Loopie to support multi-user businesses more deeply — giving accountants and employees their own scoped views — while keeping the same core promise: Loopie can find the opportunity, but the owner always makes the call.

Built With

• cursor
• javascript
• pomenerium
• react
• zero