Engineering

Our stack.

Modern infrastructure. Open conventions. Tested under fire.

81 tRPC routers·190 Prisma models·43 crons·66 AWAIS rules·0 customer data breaches

Frontend API layer Database Auth AI Queue + jobs Communications Payments Defense Hosting + infra

The stack

Ten categories. Every version, on the page.

Reynolds runs on 1980s VAX. CDK runs on early-2000s Java. VinSolutions won’t tell you what they run on. We list ours publicly because the modern dealership deserves to know what its core business system is built on.

frontend

Frontend

Server-rendered by default. Client-side JavaScript only where interaction demands it.

Next.js15.5.14
App Router + Turbopack. RSC-first.
React19.1.0
Server Components, server actions, transitions.
TypeScript^5
Strict mode. No `any`, no unguarded `unknown`.
Tailwind CSS^4
Operator Navy design tokens. Zero runtime CSS-in-JS.
Fonts
Syne (display) + Instrument Serif italic (accent) + Inter (body).
Framer Motion^12.38.0
Reserved for high-value motion only.

Why this choice

We didn't pick Next 16 the week it shipped. We waited for the patch cadence to settle and ship-blocking RSC bugs to close. Boring beats new.

api

API layer

End-to-end type safety from database row to React prop. Schema drift is impossible — the compiler enforces it.

tRPC^11.16.0
81 routers, full type inference, no codegen.
@tanstack/react-query^5.96.2
Server-state cache, optimistic updates, suspense.
Zod^4.3.6
Every API input validated before it touches the database.
Public REST
4 endpoints: ADF webhook, status aggregate, AWAIS incidents, SVG badges. (/api-docs)
superjson^2.2.6
Dates, BigInts, Maps roundtrip cleanly over the wire.

Why this choice

We don't ship OpenAPI. tRPC gives our team type safety we will not give up. A thin REST shim is on the roadmap for integration partners — until then, the 4 public endpoints cover every external use case we've actually been asked for.

database

Database

Managed Postgres with point-in-time recovery. Multi-tenant enforced at the API layer, not just at the row.

Supabase Postgres
Managed PG 15. PITR. Pooled + direct connections.
Prisma^6.19.3
190 models. Strict schema. Migrations checked into git.
Tenancy
Every table carries `dealerId`. Enforced in tRPC middleware before the query runs.
Soft deletes
`deletedAt` on every customer-bearing table. We never hard-delete leads.
Encryption at rest
AES-GCM column encryption for PII (FTC Safeguards Rule compliant).
Cuid2 keys^3.3.0
Collision-resistant, sortable, URL-safe.

Why this choice

We pay for managed Postgres because we'd rather pay Supabase than wake up at 3am to a vacuum-bloat incident on RDS. The boring tradeoff.

auth

Auth

We own auth end-to-end. No Clerk, no Auth0, no third-party identity provider in the critical path.

Sessions
Stateless HMAC-signed JWT-style tokens in httpOnly `gladius_session` cookie.
TOTP MFA
Homegrown RFC 6238 — AES-GCM wrapped secrets, bcrypt backup codes, 5-min pending-mfa cookie.
bcryptjs^3.0.3
Password + backup code hashing.
Per-dealer MFA enforcement
`mfaRequiredByDealer` flag forces enrollment org-wide.
Founders session
Separate `gcrm_founders_session` cookie + edge-verified for the internal portal.

Why this choice

Clerk got removed on 2026-05-27. The reason: every auth incident in a SaaS company traces back to the auth provider's roadmap, not your own. We'd rather own the bug.

AI

One vendor (Anthropic), three tiers (Sonnet / Haiku / Opus), one tier router. No model-of-the-week churn.

@anthropic-ai/sdk^0.86.0
Direct Anthropic SDK. No LangChain, no abstraction layer.
Claude Sonnet 4.6
Default — reasoning, drafting, scoring.
Claude Haiku 4.5
Latency-critical — Maria voice, classification, short outputs.
Claude Opus 4.7
Highest-reasoning — Shapley attribution, Live Pencil deal sheet.
Tier router
`src/server/ai/claude.ts` — one place to switch every prompt's model.
Prompt library
10 versioned prompts, 5 queue processors.

Why this choice

We don't multi-vendor LLMs. Every time you put a router between yourself and a foundation model, you cap your ceiling at the worst model in the pool. Pick the best lab, bet hard, swap when the next lab actually pulls ahead.

queue

Queue + jobs

Long-running work runs on a real queue, not a Vercel function with a timeout.

BullMQ^5.73.1
Job queue, retries, backoff, scheduled jobs.
Upstash Redis^1.38.0
Managed Redis. REST + TCP. Serverless-friendly.
ioredis^5.10.1
TCP client for the BullMQ worker (rediss://).
Workers
Long-lived Node processes on Railway, separate from Vercel.
Crons
43 scheduled jobs, every run instrumented in `cron_runs` (visible on /status).

Why this choice

Vercel can't run a 20-minute DMS sync inside a serverless function. Railway can. The compute lives where the workload makes sense — not where a vendor tells you it has to.

comms

Communications

SMS, voice, email, push, in-app — all flowing through real provider primitives, never abstracted to lowest common denominator.

Twilio^5.13.1
SMS, voice, DNI call tracking, recording, transcription, conference.
Resend^6.10.0
Transactional email + inbound parse.
React Email^1.0.11
Templates ship as React components, type-checked at build.
Knock^1.29.1
In-app + email + push notification orchestration.
ADF/XML
Standard OEM lead-provider intake. HMAC-SHA256 signed per dealer.

Why this choice

Most CRMs build a 'unified messaging abstraction' that downgrades every channel to text-with-a-link. We let SMS be SMS and voice be voice — including DNI, recording, and real-time AI scoring.

payments

Payments

Stripe-hosted. We never touch card data. PCI scope minimized by design.

Stripe^22.0.1
Subscriptions for the SaaS itself.
Stripe Connect
Dealers collect customer deposits straight to their account.
Hosted Checkout + Elements
Card data never traverses our servers.
Webhook verification
Stripe-Signature header verified before any state mutation.

Why this choice

PCI Level-4 is the only PCI level we'll ever need, and the reason is structural: we chose a payment surface where cards never touch our compute. The cheapest security review is the one you architected away.

defense

Defense

AWAIS — Autonomous Web Application Intelligence System. A category that didn't exist before we built it.

AWAIS rules engine
66 active rules, 261 signature patterns. IQ score 145.
Sentinel Mesh
Cross-vertical CRDT federation — attack on Turf hardens CRM in under 30s.
CSP + HSTS preload
Strict Content Security Policy, HSTS preload, COOP, CORP on every path.
Locked-surface guard
8 frozen file paths require an `UNLOCK-*` token in the commit body before they accept change.
Schema-drift scanner
CI gate blocks any Prisma drift from migrations on every push.
Tenant-isolation auditor
Cron + CI both verify every query is dealer-scoped before merge.

Why this choice

Most SaaS companies bolt on a WAF and call security 'done.' AWAIS is in the codebase, in CI, in the cron table, and on a public live feed at /awais/incidents. If we get hit, you can watch.

hosting

Hosting + infra

Two clouds, four services, zero Kubernetes. Boring infrastructure beats clever infrastructure every time.

Vercel
Next.js + Edge functions. Production traffic terminates here.
Railway
BullMQ workers + long-running Node processes.
Supabase
Managed Postgres + storage + realtime.
GitHub Actions
CI: lint, types, smoke tests, Sentinel locked-surface scan.
@sentry/nextjs^10.47.0
Error monitoring + release tracking + source maps.
PostHog^1.366.1
Product analytics + session replay + feature flags.

Why this choice

There is no platform team. There is no service mesh. There is no Kafka. We have three full-stack engineers and we ship every week.

Why this stack

Boring infrastructure, everywhere it doesn’t matter.

A dealership CRM has exactly one job: never lose a customer record. Every architectural decision below rolls up to that. Managed Postgres because we trust Supabase’s on-call rotation more than we trust ours. Stripe because card data should not live in our database. Anthropic because we want to bet on one frontier lab and inherit their roadmap, not abstract over five.

The places we built it ourselves are the places where owning the bug matters more than saving a quarter of engineering. Auth. MFA. The AWAIS defense mesh. The 10 prompt templates that turn Claude into something a dealership floor can actually use. Type safety from the database row to the React prop. Those are the load-bearing walls — those, we own.

The contrarian bet is the un-bet. We don’t use microservices. We don’t use Kubernetes. We don’t run a service mesh. We don’t have a platform team. We have three full-stack engineers and we ship every week, because the org chart is the system architecture and ours is small on purpose.

What we don’t use

The anti-stack. On purpose.

Most of the work of being a good engineering team is choosing what not to do. Here’s the list.

No microservices architecture

One Next.js app, one BullMQ worker, one database. If we have a problem, we know which process to read.

No internal REST API

tRPC end-to-end. Refactoring across the stack is one PR, not a coordination dance between two repos.

No Kubernetes

Vercel + Railway run our compute. We have not written a YAML pod spec, and we don't plan to.

No Redux / Zustand / global client store

Server state lives on the server. React Query caches it on the client. There is no third source of truth.

No GraphQL

tRPC already gives us the schema-typed client without the gateway, the resolvers, or the N+1 footgun.

No microservice mesh / Istio / Envoy

There is no service-to-service traffic. The blast radius of every change is one app.

No 'cloud-native platform team'

There is no platform team. There is no internal developer platform. There is the codebase, and there are three engineers.

No third-party auth provider

Sessions, MFA, password reset — all homegrown. We removed Clerk on 2026-05-27.

For engineers

Want to look closer? Here’s how.

Developer docs

/api-docs

Public endpoints, real curl examples, webhook payloads, authenticated tRPC router map.

Read the docs →

Watch it run

/status

5-vertical live health, 30-day uptime grid, AWAIS counters, federation event throughput. Polls every 15s.

Open status →

The defense mesh

/awais/incidents

Anonymized 24h attack feed. 66 rules, 261 patterns, IQ 145. Watch the AWAIS engine work in real time.

Watch AWAIS →

Direct lines

Founder

Ricardo Gamon

20-year operator. Sales → F&I → GSM. Now writing the code.

LinkedIn →

Developers

developers@gladiuscrm.com

Integrations, partner builds, API questions. Replied within 24 hours, including weekends.

Security disclosure

security@gladiuscrm.com

For coordinated vulnerability reports. Acknowledged within 24 hours; reasonable scope, no legal action.

Gladius Technologies LLC · Tampa, FL · 2026

Gladius