RenewalRadar

B2B contract renewal tracking for finance and ops teams—reminders, workflows, RBAC, and enterprise security on Vercel.

Comment

Inspiration

Finance and ops teams lose money every year not because they lack data—but because renewals are scattered across spreadsheets, inboxes, and calendars. A missed SaaS auto-renewal, an overlooked insurance policy, or a vendor contract that slips through can cost thousands overnight.

I built RenewalRadar after seeing how small and mid-size teams manage contracts reactively: chasing dates in Excel, relying on one person’s memory, and discovering problems only after a charge hits. I wanted a system that treats renewals as a first-class workflow—not an afterthought—and I wanted to prove that a serious B2B product can be shipped on Vercel’s zero stack without sacrificing security or scalability.

What it does

RenewalRadar is a multi-tenant B2B platform for tracking contract renewals end to end.

Teams can:

  • Manage contracts & vendors — rich CRUD, templates, versioning, custom fields, and vendor directories
  • Stay ahead of deadlines — renewal reminders, tasks, Kanban boards, and approval workflows
  • Collaborate securely — org-based workspaces, team invites, role-based access, and custom roles
  • Operate at enterprise depth — org-wide MFA, SSO (Google & GitHub OIDC), SCIM provisioning, IP allowlists, session policies, device fingerprinting, and audit logs
  • Integrate & extend — REST API, webhooks, Google integrations, exports, reports, and e-signature flows
  • Run the business — Stripe billing, usage tracking, branding, email templates, and a platform admin console

The bigger the contract and the closer the renewal date, the more urgent it is to act. A $50,000 SaaS renewal due in 7 days deserves more attention than a $500 renewal due in 90 days. RenewalRadar surfaces that priority on the dashboard so finance and ops teams act early—not after the invoice hits.

How I built it

RenewalRadar is a production-oriented app on the Vercel ecosystem:

Layer Technology
Frontend Next.js 16 (App Router), React 19, TypeScript, Tailwind CSS
Backend Server Actions, Route Handlers, modular service layer
Database Amazon Aurora PostgreSQL (multi-tenant by org_id)
ORM Drizzle ORM + SQL migrations
Auth Database-backed sessions, bcrypt, TOTP/SMS MFA, OIDC SSO
Storage Vercel Blob for documents and attachments
Deploy Vercel (serverless, edge OG images, cron jobs)
Payments Stripe Checkout & billing portal
Email / SMS SMTP (Nodemailer) + Twilio for MFA and notifications

Architecture highlights:

  • Organization-first tenancy — every business table is scoped by org_id; RBAC is enforced in the service layer, not only in the UI
  • Audit-first design — sensitive mutations write immutable audit events with metadata
  • Security by default — password policies, lockouts, session expiry, concurrent session controls, and encrypted MFA secrets
  • Extensible foundation — contracts, workflows, compliance, and integrations are modular so future features can grow without rewrites

I used vercel dev locally against Aurora IAM auth, deployed to Vercel production, and wired environment-driven config for SSO callbacks, Stripe webhooks, and cron-based reminder processing.

Challenges I ran into

  1. Enterprise auth is harder than it looks
    Org-wide MFA, SSO (Google/GitHub), and SCIM each have different edge cases—pending login cookies, encryption key mismatches for TOTP secrets, and making sure MFA cannot be bypassed via trusted-device shortcuts.

  2. Session security vs. usability
    Device fingerprinting, single-session policies, and inactivity timeouts had to work together without confusing users. I separated storage (fingerprint on sign-in) from enforcement (revoke on browser mismatch) and aligned session listing with inactivity rules.

  3. Aurora + Vercel locally and in production
    IAM database auth, SSL, and matching FIELD_ENCRYPTION_KEY / APP_URL across local and deployed environments caused subtle bugs until I standardized env pulls and documented the full auth flow.

  4. RBAC + custom roles across the whole app
    Custom roles overlay base roles (admin, manager, editor, viewer). Wiring permissions consistently across server actions, pages, and team management took careful refactoring—not a one-checkbox fix.

  5. Real B2B scope vs. hackathon time
    I chose depth over a thin demo: billing, compliance retention, platform admin, observability, and SEO—all while keeping the codebase maintainable with Drizzle migrations and typed server actions.

Accomplishments that I'm proud of

  • Shipped a deployable B2B SaaS on Vercel—not a static mockup
  • Built enterprise-grade security (MFA, SSO, SCIM, IP allowlist, session binding) in a hackathon-scale codebase
  • Designed a normalized multi-tenant schema with audit trails, soft deletes, and org-scoped uniqueness
  • Delivered end-to-end workflows: contracts → reminders → tasks → approvals → reports
  • Implemented modern SEO (sitemap, robots, Open Graph, JSON-LD) for the public marketing funnel
  • Kept the stack cohesive on Vercel: Next.js, Blob, cron, edge images, and serverless API routes

What I learned

  • Security features need UX clarity — “device fingerprinting” sounds like biometric login; session binding needed clear product language and visible session management
  • Server Actions + Drizzle is a strong combo for typed, org-scoped mutations without a separate API boilerplate layer
  • Policy toggles must be enforced server-side — IP allowlists, MFA requirements, and session limits only matter when checked on every login and request
  • Vercel’s zero stack can carry real products when you pair it with Aurora for transactional data and strict tenancy boundaries
  • Documentation and migrations early save pain when the schema grows across auth, billing, compliance, and integrations

What's next for RenewalRadar

  • AI-assisted renewal insights — summarize contract terms, flag auto-renew clauses, and recommend renegotiation windows
  • Calendar & ERP integrations — deeper Google/Microsoft sync and accounting exports
  • Renewal playbooks — templated checklists per contract type (SaaS, insurance, vendor MSAs)
  • Mobile-friendly workflows — approvals and reminders on the go
  • Analytics dashboard — spend forecasting and renewal risk scoring across the portfolio
  • Public API & marketplace — partner integrations for CLM, e-sign, and procurement tools

M goal is simple: help every team answer “What’s renewing, when, for how much, and who owns it?”—before the renewal date, not after the invoice.

Built With

Share this project:

Updates