Soviic

09/20/2026

Soviic is live — build your first workflow today - https://mailchi.mp/b6e7c7067fe4/soviic-is-live-build-your-first-workflow-today

09/20/2026

Soviic, our workflow automation platform for small businesses, is live on Product Hunt today.

Soviic connects the tools small businesses already use — starting with Gmail and Slack — so repetitive manual work happens automatically. No code, no consultants, no enterprise setup required. Built for teams of 1–15 people who want their processes handled without adding technical overhead.

It's live and free to start at soviic.com. Check it out on Product Hunt and let us know what you think: https://www.producthunt.com/products/soviic-workflow-automation-for-smbs?launch=soviic-workflow-automation-for-smbs

Soviic connects the tools small businesses already use (starting with Gmail and Slack) so repetitive manual work — forwarding emails, sending notifications, copying data between apps — happens automatically. Built specifically for teams of 1–15 people who don't have a technical background: des...

09/13/2026

Three months ago I started building a SaaS product in the evenings and weekends alongside a full-time job. This week I finished it.

Sprint 5B is complete. The Soviic MVP is done.

The final sprint was billing — and it taught me something I'll carry into every build after this. Three separate billing bugs were sitting in code that had already passed review. Static analysis missed them. Code review missed them. Real test transactions found them. That's the fourth time in this project that live testing caught something review could not. Review tells you the code is correct. Live testing tells you the system works.

Full Stripe billing is live. Customers can subscribe to Starter at $19, Growth at $49, or Team at $99 per month and manage everything themselves. Upgrade, downgrade, cancel — no contacting support. Every change in Stripe reflects in the app automatically.

Two decisions I made deliberately. Downgrading pauses excess workflows instead of deleting them — upgrade again and they come back, no data loss. A single failed payment doesn't restrict the account — Stripe's retry process runs first. Temporary card issues happen to real customers. The platform handles them accordingly.

One thing worth naming — Stripe was originally being configured under the CyberSentinel account used for Fiverr and consulting. Caught early, corrected. Soviic has its own dedicated Stripe account. Clean separation matters.

Beta is open. Free plan. No credit card required. If you own a small business and handle repetitive tasks manually, I'm personally onboarding the first users. Join the waitlist at soviic.com or message me directly.

08/30/2026

Sprint 5A of the Soviic build is complete. Beta is open.

This is the first sprint where the work was entirely about what a real user experiences — not infrastructure, not security architecture, not database schemas. The first thing a new user sees when they sign up.

Here's what actually shipped.

Guided onboarding walks new signups through four steps: business type, template selection, connecting Gmail or Slack, and running a test workflow. Every step after the first can be skipped without breaking anything. The goal was a working automation before they close the tab on day one.

Three starter templates shipped — one for professional services businesses, one for contractors and trades, and a third for general use. One click to a working workflow. A blank canvas is where onboarding goes to die, so we removed it.

Plan limits are now enforced at the database level — not just in the interface. Proven live against a real over-limit test account. When someone hits a limit, they see an upgrade prompt and can register interest. No raw error message. No Stripe yet — but the interest list is capturing real intent.

The beta plan is server-assigned only. New signups get it automatically during the beta period. It's never exposed in the UI and can't be self-selected. I control who has beta access, not the signup form.

Day 0 confirmation email sends automatically after signup — exactly once per organization, duplicate-proof even under retries.

One bug was caught during review: connecting an integration partway through onboarding used to silently drop users out of the guided flow. Fixed before any real user could hit it.

Sprint 5B is next — Stripe billing and live checkout. That's the last sprint before a real, paying customer is possible.

Beta access is free right now. No credit card required. If you own a small business with 1 to 15 people and you're handling repetitive tasks manually — client follow-ups, notifications, internal handoffs — I'm personally onboarding the first users. Join the waitlist at soviic.com or message me directly and I'll send you an invite.

08/23/2026

Sprint 4 of the Soviic build is complete. One sprint left before launch.

This sprint was infrastructure and compliance — the work that doesn't show up in a feature list but determines whether a platform is actually ready to handle real business data.

The most significant thing that happened was a full security and audit-logging review. I checked the live codebase against 12 security requirements and 12 audit-logging requirements. The review found two real issues that were already in the codebase.

First: role-based permissions existed in the database but weren't being enforced at the application level. Any team member could edit or delete workflows regardless of their assigned role. The architecture was correct. The enforcement wasn't wired up. Fixed.

Second: audit logging was active for one of twelve required event categories. Workflow runs were logged. Role changes, integration connections, and disconnections were not. The two most security-relevant categories were closed this sprint.

Also shipped: webhook rate limiting using a Postgres atomic counter that fails closed — meaning if the limiter itself has a problem, it stops requests rather than silently passing them through. A public /security page with a responsible disclosure form. PostHog analytics integrated behind real cookie consent — verified that declining actually stops tracking rather than just dismissing the banner.

Sprint 5 is the last sprint before launch. Stripe billing, plan limits, in-app onboarding, and beta invites for the waitlist.

If you own a small business and you're handling repetitive tasks manually — client follow-ups, scheduling, notifications, internal communication — and you've wondered whether automation could help without requiring an IT team, I'd genuinely like to talk before we launch. 20 minutes, no sales pitch. Join the waitlist at soviic.com and I'll reach out directly.

08/16/2026

Sprint 3B of the Soviic build is complete. Four of five sprints done. One sprint left before launch.

Here's what actually happened this sprint — features and security both.

The biggest feature milestone: workflows now trigger automatically from Gmail and Slack events. A 5-minute polling cron picks up new events, a unique constraint at the database enforces idempotency, and I tested it end to end. One Slack message produced exactly one workflow run and one email delivered. No duplicates. The core automation loop works.

The role architecture was also rebuilt. The role column moved off the profiles table into a dedicated user_roles table — a cleaner, more secure design ahead of launch. Write access is two owner-gated database functions. A tampered client request is still rejected at the database level regardless.

Two security issues were caught and closed this sprint.

First: the HMAC signing key for inbound webhooks was readable by any org member, including viewers. An app-level fix wasn't sufficient — the browser can query the column directly. The fix was a column-level permission change at the database.

Second: a missing Slack OAuth scope that live end-to-end testing caught after the code had already passed static review. This is the third time in this project that live testing found something review could not. Static review tells you the code is correct. Live testing tells you the system works. Both matter.

Sprint 4 is the launch sprint — Stripe billing, plan limits, legal pages, and beta onboarding for the waitlist.

Soviic is workflow automation for small businesses. No IT team required. Waitlist open at soviic.com.

07/25/2026

Sprint 3A of the Soviic build is complete, and I want to share what actually happened — not just the feature list.

This sprint added Gmail and Slack integrations to the platform. Both are working and proven against real accounts. But before either of those shipped, there was a security requirement that had to be met first.

Soviic connects to a small business owner's Gmail and Slack. That means it's handling OAuth tokens — credentials that grant access to those accounts. If those tokens are ever exposed, the damage extends well beyond Soviic itself.

So before any integration shipped, token encryption had to be verified. Every token is now encrypted using envelope encryption — a master key in Supabase Vault wraps a unique per-record encryption key, AES-256-GCM, decrypted server-side only, with no plaintext credential ever reaching the client, the logs, or an error report.

Once that cleared, Gmail and Slack integrations went live. The integration management UI handles connect, connected, reconnect-needed, disconnect, and re-auth states cleanly.

Sprint 3A satisfies the MVP requirement of Gmail plus one other integration. Both are working.

Sprint 3B is next — workflows that trigger automatically from Gmail and Slack events. That's where the automation becomes practical for everyday small business use.

Soviic is workflow automation for small businesses. No IT team required. Waitlist is open at soviic.com.

07/12/2026

Sprint 2 of the Soviic build is complete, and I want to share what actually happened — not just the feature checklist.

The workflow builder is working end to end. Triggers fire on a schedule, form submission, or webhook. Actions send emails or call external services. The ex*****on engine runs everything and logs it to an activity feed. That's the product working.

But two other things stood out this sprint.

First — I caught a security issue while building. A database policy that would have allowed a user to pull data belonging to a different organization. No customers on the platform yet, so no real exposure. But it was a genuine vulnerability, and it got fixed before it could ship. This is the case for building security into the foundation of a product rather than treating it as a feature you add later.

Second — I found a bug that had been sitting quietly in the database layer for weeks without surfacing. Nothing had triggered that specific code path until Sprint 2 came along. It's a good reminder that bugs don't always announce themselves. You have to actually exercise your code to find them.

And on the email action — I tested it the right way. Triggered a real workflow, watched the ex*****on engine run, and confirmed an actual email landed in an inbox. That's the bar.

Sprint 3 is integrations — connecting Soviic to Google Workspace and Slack, the tools small businesses are already using.

Soviic is workflow automation for small businesses. No IT team required. Waitlist is open at soviic.com.

06/08/2026

Sprint 1 Complete

I planned Sprint 1 to take two weeks.

It took one day.

Auth stack, fully working:

✅ Login
✅ Register (with live password checklist)
✅ Email verification
✅ Password reset
✅ MFA enrollment — TOTP + QR code

06/08/2026

Tomorrow, I'm starting Sprint 1 of the Soviic build.

Not planning it. Not designing it on a whiteboard. Actually building it.

Here's what Sprint 1 covers over the next two weeks:

— Project scaffolding in Lovable.dev
— Supabase setup with Row-Level Security enabled from day one
— Authentication: login, register, email verification, password reset
— Multi-factor authentication enrollment
— Role-based access control (Owner and Member roles)
— Audit log schema

Most founders treat security as something you add before launch. I'm building it into the foundation before a single user-facing feature exists.

That's not because it's easier. It's because retrofitting security into an existing product is significantly harder and more expensive than building it in from the start.

Soviic is workflow automation for small businesses. The people it serves don't have IT departments. They're trusting the platform to handle their business data. That trust has to be earned at the architecture level, not just in the marketing copy.

Sprint 1 ships in two weeks.

I'll share what got built, what didn't, and what I learned.

If you're building a SaaS right now — what did you wish you had set up correctly in the foundation before you started adding features?