team@techak.in
www.techak.in
PRD v1.0 • Confidential
TechAk Client Proposal & Agreement

Facilitation Management
System

A comprehensive, role-segregated web-based loan facilitation system built on Laravel 12 + MySQL, prepared and proposed by TechAk.

Client: RuLoans Portal
Stack: Laravel 12 + PHP 8.3 + MySQL
Timeline: 2 - 3 Months
Total: Rs. 24,000
Agency Market Value: This scope is equivalent to an enterprise workflow system worth approximately ₹80,000–₹200,000 in many markets. TechAk is offering this engagement as a focused proposal with premium support and delivery discipline.
01

Project Overview

⚠ Payment Gateway Excluded: Razorpay / Cashfree / PayU is explicitly excluded from this PRD as per client instruction. All payout tracking and approval workflows are internal record-keeping only — no online payment processing is implemented.

What is RuLoans FMS?

RuLoans FMS is a comprehensive, web-based Loan Facilitation Management System built on Laravel 12. It provides secure, role-segregated access for Admin, Worker, and Vendor roles. The system handles end-to-end claim lifecycle — from data entry and Excel imports through automated payout calculations to OTP-verified admin approvals — ensuring financial accuracy, full audit trails, and strict data access control across all operational roles.

ProblemSolution
Manual Excel-based claim tracking prone to errorsStructured DB with automated payout calculations
No access control — everyone sees sensitive dataRole-based column-level visibility enforced at API level
Payment approvals done informally, no audit trail6-step OTP-verified approval workflow with full history
Vendors have no self-service visibilityIsolated Vendor Portal with C/F balance and SMS alerts
No structured reporting by roleRole-aware Excel exports — profit columns hidden from Workers

Out of Scope (Explicitly Excluded)

  • Payment Gateway (Razorpay / Cashfree / PayU) — removed as per client instruction
  • Mobile App (Android / iOS)
  • Multilingual support
  • External bank / accounting system integrations
  • Any screen or flow not shown in Wireframe Document v3
02

Technology Stack

CategoryTechnologyVersionCost
Backend FrameworkLaravel (PHP)v12.xFREE
LanguagePHP8.3+FREE
DatabaseMySQL8.0+FREE
Frontend StylingCSS3 / Tailwind / BootstrapAs per wireframeFREE
ChartsChart.js / ApexChartsLatest CDNFREE
Excel Import/ExportLaravel Excel (Maatwebsite)^3.1FREE
OTP / SMSMSG91 APIREST API~Rs.0.25/SMS
Identity VerificationDigiLocker API (MeitY)OAuth2FREE (govt API)
HostingHostinger / DigitalOcean / AWSShared/VPSRs.1,500–3,000/mo
03

User Roles & Permissions

⚠ Security Enforcement: OTP on login (all roles, first-time / new device) | OTP on payment approval (Admin only) | OTP to add new user (Admin only) | OTP for Vendor to view payout reports | Role-based exports: Worker export strips sensitive columns at server level.
👑 ADMIN
  • Full system access
  • Manage users, roles, MSG91 settings
  • Approve/reject payouts with OTP
  • See ALL columns: profit, bank rate, differential
  • Add new users (OTP required)
  • View complete audit trail
  • DigiLocker identity verification access
  • Export with all sensitive columns
👷 WORKER
  • Add/edit claims, upload Book3.xlsx
  • Calculate payouts; enter TDS% and paid amounts
  • Submit payment requests (CANNOT approve)
  • Sensitive financial columns HIDDEN at API level
  • View own submitted requests + status
  • Export claims (profit columns stripped server-side)
  • Receive rejection notifications with reason
🏢 VENDOR
  • Access dedicated Vendor Portal ONLY
  • View own approved claims + payouts
  • See current Carry-Forward (C/F) balances
  • Receive real-time SMS on payment approval
  • OTP required to view payout reports
  • NO access to other vendors' data
  • Read-only — cannot edit any data
04

Module Specifications

4.1 Authentication & OTP (MSG91)

TriggerRecipientOTP ValidityMax Attempts
Login (new device)All Roles5 minutes3 (then 30 min block)
Payment ApprovalAdmin Only5 minutes3 (then 30 min block)
Add New UserAdmin Only5 minutes3 (then 30 min block)
View Payout ReportsVendor Only5 minutes3
Password ResetAll Roles10 minutes3

4.2 Payout Formula

FieldFormula
Gross PayoutLoan Amount × Vendor Rate %
TDS AmountGross Payout × TDS %
Net PayoutGross Payout − TDS Amount
B/F BalancePrevious month's C/F balance
C/F BalanceNet Payout − Paid Amount + B/F Balance

4.3 Approval Workflow — 6 Steps

StepActorAction
1 — CalculateWorkerSelects vendor and month, enters TDS%, reviews Gross/Net payout, enters paid amount
2 — SubmitWorkerClicks 'Request Payment Approval'. PaymentRequest created with status = PENDING and full payout snapshot
3 — NotifySystemAdmin receives notification badge on dashboard. Optional MSG91 SMS alert sent to Admin mobile
4 — ReviewAdminOpens request, reviews all amounts (Gross, TDS, B/F, Net Payout) and full claim breakdown
5 — Approve + OTPAdminClicks Approve. MSG91 OTP triggered to Admin phone. Admin enters 6-digit OTP (3 attempts, 5 min expiry)
6 — ApprovedSystemStatus updated to APPROVED. C/F balance saved. Vendor notified instantly via MSG91 SMS with approved amount details

4.4 DigiLocker Integration (FREE — MeitY)

  • OAuth2 authorization flow: Admin triggers DigiLocker verification for a vendor
  • Vendor receives verification link; authenticates with Aadhaar on DigiLocker
  • Laravel callback handler receives authorization code and exchanges for access token
  • Aadhaar eKYC XML parsing: extracts Name, DOB, Gender, Address automatically
  • Vendor profile marked as 'DigiLocker Verified' with date and verified badge
  • Full MeitY-approved OAuth2 flow — no UIDAI direct API (fully compliant)
Note: Client must register on partners.digilocker.gov.in to obtain Client ID and Client Secret. Approval typically takes 3–7 working days.
05

Security & Best Practices

AreaImplementation
SQL InjectionAlways use Laravel Eloquent ORM or query builder with parameter binding — never raw user input in SQL strings
XSSAll output in Blade templates uses {{ }} (auto-escaped). Use {!! !!} only for trusted admin-generated content
CSRFAll forms use @csrf directive — Laravel CSRF middleware enabled globally
Column-Level SecuritySensitive payout columns stripped at Laravel API Resource level — never included in Worker/Vendor responses regardless of frontend state
OTP Security3-attempt limit, 5-minute expiry, 30-minute lockout, purpose-specific (cannot reuse approval OTP for login)
HTTPSForce HTTPS in production via AppServiceProvider boot() and web server config. SSL certificate mandatory
Rate LimitingLogin: 5 attempts per 15 minutes. OTP: 3 attempts per 30 minutes. All API routes: 60 requests per minute
Audit TrailEvery create/update/delete/status-change logged via Spatie ActivityLog with user ID, IP, before/after values
Vendor IsolationLaravel Gate and Policy classes ensure Vendors can only query their own vendor_id. All queries scoped with where vendor_id = auth()->user()->vendor->id
Session SecuritySESSION_SECURE_COOKIE=true in production. SameSite=strict. 30-min inactivity auto-logout
07

Implementation Roadmap

Phase 01
Days 1–4

Setup & UI Implementation

Server setup, Laravel 12 install, MySQL schema migration, Blade/Stitch theme, 12+ screens as static views

Rs. 4,000
Phase 02
Days 15-25

Authentication & Role System

Login, OTP via MSG91, role middleware, route guards, session management, user CRUD with OTP

Rs. 3,000
Phase 03
1 Month

Core Financial Logic

Claims CRUD, Book3.xlsx import, payout formula engine, TDS/B/F/C/F balance logic, column visibility enforcement

Rs. 6,000
Phase 04
Days 12–14

Approval & OTP Flow

6-step payment request workflow, MSG91 OTP integration, admin approve/reject cycle, SMS notifications, audit trail

Rs. 4,000
Phase 05
Days 15–16

Reporting & Launch

Role-based Excel/PDF exports, vendor portal isolation, QA testing, production deployment

Rs. 3,000
Phase 06
Days 17–18

DigiLocker Integration

DigiLocker OAuth2 eKYC (Aadhaar/PAN), MeitY-approved flow, partner portal registration

Rs. 4,000
08

Payment Breakdown

#PhaseDeliverablesAmount% Share
01Setup & UI ImplementationServer setup, Laravel install, DB architecture, 12+ screens UIRs. 4,00016.7%
02Authentication & RolesSecure login, RBAC (Admin/Worker/Vendor), visibility logicRs. 3,00012.5%
03Core Financial LogicClaims, Book3.xlsx parser, payout calculation, TDS/B/F/C/F logicRs. 6,00025%
04Approval & OTP Flow6-step workflow, admin review/approve cycle, MSG91 OTP, notificationsRs. 4,00016.7%
05Reporting & LaunchRole-based reports/exports, vendor portal polish, QA, deploymentRs. 3,00012.5%
06DigiLocker IntegrationDigiLocker OAuth2 eKYC (Aadhaar/PAN), MeitY-approved flowRs. 4,00016.7%
Total Development Cost
Rs. 24,000
One-Time Development Fee • All 6 Phases Included
2-3
Months to Make
09

Maintenance & Support Policy

📋 Free Maintenance (Year 1)
  • TechAk provides free maintenance and support of all existing features for 12 months from project launch
  • Bug fixes, patches, and critical security updates included at no additional cost
  • Ongoing system stability and performance optimization
  • Technical support for system operations and troubleshooting
  • Regular backup and data integrity management
⏰ After 1 Year - Charges Applicable
  • After the first 12 months, maintenance charges will be applicable
  • Support will be provided on a retainer basis or hourly consultation model
  • Maintenance package details to be discussed and agreed upon before expiry of free period
  • Critical security updates and emergency patches available on priority basis
✨ Feature Enhancements & Additions
  • Any new features or enhancements beyond the scope of this PRD will incur separate charges
  • Feature scope and pricing to be discussed and approved separately for each request
  • Add-on development follows the same quality standards and documentation practices
  • Custom integrations, API connections, and third-party tool extensions are billed as additional services
  • Charges for new features will be estimated and quoted based on complexity and effort

Key Points:

  • Free Support Period: 12 months from project go-live date
  • What's Covered: Bug fixes, patches, security updates, routine maintenance
  • What's NOT Covered: New features, custom modifications beyond original scope, third-party integrations
  • Post-Warranty Support: Available on demand with mutual agreement and pricing discussion
  • New Feature Scope: Always quoted separately with detailed scope and timeline

✍ Client Agreement & Digital Signature

Please read the proposal above carefully, then sign below to confirm your acceptance and authorize project commencement.

Agreement:

I, the undersigned, hereby confirm that I have read and understood the RuLoans Facilitation Management System Product Requirements Document (PRD v1.0). I agree to the scope of work, technology stack, implementation timeline of 2-3 months, and the total development cost of Rs. 24,000 as outlined above.

I acknowledge that this proposal page stores agreement metadata locally for demonstration purposes. A production implementation will store signatures and audit logs on a secure server with signed PDF generation.

I acknowledge that:
  • Payment gateway (Razorpay/Cashfree/PayU) is explicitly excluded from this project scope.
  • Mobile app (Android/iOS) development is out of scope.
  • DigiLocker partner registration (partners.digilocker.gov.in) must be completed by the client (3–7 working days approval).
  • MSG91 DLT registration for transactional SMS is the client's responsibility.
  • Hosting / VPS charges, domain purchase, SSL certificate renewal, and server administration costs are the client's responsibility.
  • DigiLocker partner registration approval, SMS balance recharge, and external API approvals are the client's responsibility.
  • TechAk will provide free maintenance and support of all existing features for 12 months from project launch. After one year, maintenance charges will be applicable based on mutual agreement.
  • Any new features, enhancements, or modifications beyond the scope of this PRD will incur separate charges as per the feature scope and complexity estimate.
✏ Draw your signature here
Use mouse or finger to draw
⚠ Signature is mandatory — at least one method must be used before submitting.
✅

Proposal Signed Successfully!

Thank you! Your signed agreement has been recorded. Please save your reference code below and share this document with the developer to initiate the project.

RLOAN-XXXXXX