Gvalo Automated SaaS Accounting Platform
An accounting co-pilot that automates a firm’s document and tax workflow, from receipt to tax return.
Key results
- 15,000+ lines of business logic code
- dedicated solely to the core document processing, featuring a modular architecture that allows adding new fiscal rules without regression.
- Zero Data Leakage
- achieved through PostgreSQL isolation (RLS) tested at scale.
- Drastic reduction of server requests
- via the implementation of aggregated counters using Stored Procedures (RPC) and intelligent client-side caching.
- Bypassing Serverless limitations
- during massive uploads thanks to a direct upload pattern (Browser-to-Bucket via Signed URLs), supporting high concurrency without overwhelming the application server.
The project
GVALO is a fullstack SaaS platform (Web + Android Mobile) that automates the entire document and fiscal lifecycle of an accounting firm. It covers the complete chain: document collection*(from the client's cloud or mobile app) → intelligent extraction (OCR + LLM) → accounting qualification** → structured archiving in the client's Drive → tax declaration generation**. The ambition is not to be a "scanning tool" but a true accounting co-pilot, capable of making autonomous decisions across the entire document pipeline. Architectural Synthesis GVALO distinguishes itself through Enterprise-grade software design. By combining the robustness of TypeScript/Next.js, the absolute isolation of PostgreSQL RLS, and defensive AI algorithms (fallbacks, retries, schema validation), the engineering team has built a system capable of absorbing massive scale while guaranteeing bit-perfect accounting integrity. This highly modular architecture empowers the platform to innovate rapidly while maintaining the uncompromising reliability required by financial institutions.
What it does
Multi-Modal Extraction Pipeline
Our proprietary OCR engine is optimized to process high volumes of heterogeneous formats (multi-page PDFs, compressed JPGs, WebPs) via a dynamic fallback strategy. The architecture incorporates a Singleton with Lazy Initialization pattern to minimize memory footprint during heavy batch processing workloads.
AI Resilience and Quota Management
To interact with high-volume deep learning models, the architecture integrates advanced Exponential Backoff mechanisms coupled with strict adherence to Rate-Limiting headers. The prompt engineering engine is rigidly constrained to generate deterministic outputs (typed JSON schemas), ensuring flawless integration into the relational data model
Multi-Layered Semantic Matching Engine
The challenge of automatically assigning documents to the correct corporate entity is solved via a cascading consensus algorithm:
- Deterministic Layer: Regular expression matching on unique fiscal identifiers.
- Heuristic Layer: Advanced syntactic normalization and string similarity algorithms.
- Semantic Layer: Contextualized LLM inference to resolve ambiguities (abbreviations, complex trade names).
Business Rules Engine
Post-extraction, an automated auditing pipeline takes over. This rules engine is capable of:
- Executing mathematical inferences (e.g., deducing pre-tax amounts from totals based on semantic expense typologies).
- Applying conditional classification overrides.
- Maintaining a Failsafe System: any critical AI failure still guarantees the secure persistence of the document flagged for human review (Zero Data Loss Architecture).
Multi-Tax Aggregation Engine
The fiscal core executes complex, optimized relational queries across multiple entities (documents, categories, enterprises, carryovers). These queries are encapsulated behind secure endpoints, calculating real-time net VAT, withholding tax breakdowns by rate, and specific sector-based contributions (TFP, FOPROLOS).
Dynamic Declaration Rendering
The platform goes beyond simple data exports: it features a dedicated Templating Engine capable of dynamically injecting formatted financial aggregates into strict HTML forms. This produces tax declarations that are immediately compliant with government tax administration standards.
RBAC & Data Isolation (Row Level Security)
Access control is implemented in depth. Beyond standard application-level checks (RBAC), security is enforced by Row Level Security (RLS) policies directly within PostgreSQL. It is architecturally impossible for an SQL query to expose Organization A's data to a user from Organization B.
Secure Anti-Malware Uploads
The file ingestion pipeline (both Web and Mobile) layers multiple defenses:
- Cryptographic validation of JWT sessions.
- Strict MIME type whitelisting.
- Cryptographic sanitization of storage paths (preventing Path Traversal attacks).
- Atomic transactional rollbacks in the event of persistence failures.
How it's built
Framework
Next.js 14 (App Router) Routing, SSR, Server Components, Server Actions
Language
TypeScript (strict) End-to-end typing, code resilience
Styling
Tailwind CSS + shadcn/ui
Animations
Framer Motion
Backend
PostgreSQL
DB Security
Row Level Security (RLS) Absolute data isolation per organization
AI Extraction
Multi-model LLM pipeline OCR → structured JSON extraction
OCR Engine
High-precision PDF/Image text extraction
Cloud Sync
Microsoft Graph API + Google Drive API v3 Bidirectional synchronizatio
Building a startup?
We build your MVP and stay at your side, from validating the idea to raising funds.
