Experience
LuliSign
A legally defensible e-signature engine, built end-to-end and solo.
LuliSign is a legally defensible e-signature platform. I built the entire backend solo, the document pipeline, the cryptography, and a forensic audit trail detailed enough to hold up as evidence, plus an AI agent and a computer-vision layer that place and detect signatures automatically.
Stack
The systems I built
02 distinct products under one engagement, built end to end.
LuliSign e-signature backend
A NestJS + Prisma document e-signature platform, upload a PDF, place signers, sign, burn signatures and verify, with templates, organizations and an embedded AI assistant. I was effectively the sole backend engineer.
Built LuliVision signature-field auto-detection, a deterministic, text-only engine over parsed PDF output that proposes signature candidates and assigns a likely signer, kept deliberately honest about being a heuristic.
Built an in-product AI agent on the Anthropic SDK, a tool registry/executor (search, create, add/remove signers, share, remind, restore) with approval-gated tools and streaming, persisted across conversation, message and tool-call models.
Added a WhatsApp bot channel, pair-code account linking and webhook routing of messages, including attached PDFs, into the same AI agent.
Implemented document-at-rest encryption, per-document keys, encrypted page images served via HMAC-signed URLs, log sanitization, and a production hard-gate that fails fast when the encryption key is unset.
Owned the Docker/VM deployment path, moved prisma migrate deploy into a container entrypoint, health-gated the prod rollout, and stripped hardcoded secrets from compose.
GoX HR backend
A multi-company HR platform (employees, attendance, leave, appraisals) on Django REST Framework with Celery. I was a feature contributor focused on NFC attendance, auth hardening and dashboards.
Built NFC tap-to-clock-in, NTAG 424 DNA tags with SUN (Secure Unique NFC) message verification, plus geofencing.
Hardened auth, sign-out via a JWT refresh-token blacklist and a 2FA status endpoint.
Made clock-out idempotent, an already-clocked-out request returns 200 rather than erroring.
Built a single-shot dashboard aggregate endpoint, returning attendance and status in one call, and improved the Swagger docs with real example values.
Next
Tagalong