maybesurya.dev/devnexis
Founder & Full-Stack Engineer·Jan 2026 – Present·Dehradun, India

I wanted a home for projects that didn't fit web hosting.

My software studio where I design and build custom web applications, client portals, and independent product experiments.

devnexis.in
Visit
Devnexis application interface
Visual preview of Devnexis platform running on devnexis.in
The Human Story · Level 1

I wanted a dedicated space to build full-stack web software.

January 2026 · Moving from servers to software

Surya Host gives people server space, but I also wanted to build the applications running on those servers. Over time, people I worked with needed custom web apps—things like consultation booking systems, private client dashboards, and payment checkout flows. Surya Host is focused on hosting infrastructure, so in January 2026 I started Devnexis as an independent studio to design and engineer full-stack web products.

The studio focus

Devnexis is where I build custom web software. That includes client portals, internal tools, and product prototypes—handling everything from the user interface and database design to payment integrations.

Who I work with

Founders and small teams who have an idea for a web product and need a developer to design the screens, set up the database, connect payments, and deploy it.

Why building web apps gets messy

Building a new web product is often fragmented. Founders hire one person for visual design, another for frontend React, and someone else for the database. Things get lost in communication, and changes take weeks. I like handling the entire stack myself so the UI and the data model stay aligned.

What I learned about architecture

The biggest thing I learned was to set up database boundaries right at the beginning. If you enforce permission rules inside the database itself using Row-Level Security, a client can never see another client's records, even if someone introduces a bug in a frontend page.

A note on database boundaries

"Building client portals taught me to pay attention to edge cases that you never think about in hobby projects. For example, payment checkouts with Razorpay need server webhooks with cryptographic signatures to verify that payments actually went through before updating an account status. Making things look simple on screen takes careful work under the hood."

"A good web app should feel obvious to use. The visitor shouldn't have to wonder how it works or worry about security."

— Surya Prakash, Founder & Full-Stack Engineer
Unified Build
UI design, database models, and API endpoints built together.
Built-in Auth
Passkeys, two-factor auth, and bot protection set up from the start.
10+ Shipped Builds
Internal tools, client solutions, and web experiments shipped on the stack.
Show Me · Level 2

See how it works in practice.

An interactive walkthrough of the actual mechanics — no simulated marketing fluff.

Visual Explanation · Access Architecture

How different people experience the Devnexis software platform

Switch between roles to see what each person is allowed to see and do.

Access Permissions for: 2. Member / ClientVerified platform rules
Explore Public Studio Showcase & Open Utilities
Publicly visible across all browsers
Allowed
Submit a Project Inquiry / Consultation Request
Public form protected by bot detection
Allowed
Access Private Client Portal & Project Milestones
Requires verified account sign-in
Allowed
View Invoices & Pay Securely via Razorpay
Restricted to authorized workspace members
Allowed
Download Project Builds & Design Assets
Protected by Cloudflare R2 signed links
Allowed
Deploy Production Updates & Database Schema
Restricted to studio founder and engineers
Restricted
Verified Platform Feature: 6 Ways to Sign In6 Auth Methods
Go Deeper · Level 3

Engineering Blueprint & Stack Architecture

Verified implementation details, data flow, operational trade-offs, and grounded metrics.

Verified Technology FoundationProduction Stack
Next.js & ReactApplication Framework

React Server Components (RSC), App Router, and server actions for low-latency, bundle-efficient rendering.

TypeScriptLanguage

Strict-mode type safety across frontend components, database schemas, and API contracts.

Supabase (PostgreSQL)Database & Auth

Managed PostgreSQL with Row-Level Security (RLS), JWT authentication, and real-time event subscriptions.

RazorpayPayments

Payment gateway integration with webhook listeners verified via HMAC-SHA256 secret tokens.

CloudflareEdge & Storage

Cloudflare R2 for S3-compatible asset storage, Turnstile for bot defense, and edge CDN routing.

Tailwind CSSDesign System

Tokenized design system with custom accessible primitives and strict theme tokens.

Architecture Overview

Devnexis is built on a server-first Next.js application layer paired with Supabase PostgreSQL. Multi-tenant client workspaces are isolated using PostgreSQL Row-Level Security (RLS) policies, ensuring data cannot leak between organizations. The platform integrates Razorpay for checkout and recurring billing via cryptographically verified HMAC-SHA256 webhooks, and offloads user assets to Cloudflare R2 object storage via presigned URLs.

SLA & Grounded Commitments
Jan 2026Platform Inception

Founded as a software studio in Dehradun, India to develop bespoke web products.

10+Products Shipped

Portfolio of internal tools, client portals, and experimental micro-SaaS utilities.

6Auth Methods

Verified authentication options including biometric passkeys and TOTP two-factor verification.

Key Implementation Highlights
6 Multi-Factor & Biometric Auth Methods

Engineered support for WebAuthn biometric passkeys (Face ID / Touch ID), TOTP two-factor authentication, magic links, Google OAuth 2.0, standard credentials, and session tokens.

WebAuthn + TOTP + Supabase Auth + Turnstile challenge validation
PostgreSQL Row-Level Security (RLS)

Every tenant table enforces Postgres RLS policies where `auth.uid()` must match workspace ownership, guaranteeing that even compromised frontend queries cannot read neighboring client records.

CREATE POLICY client_isolation ON projects FOR SELECT USING (auth.uid() = owner_id);
Cryptographic Webhook Ingestion

Razorpay webhook events are ingested through dedicated edge handlers that compute HMAC-SHA256 signatures against raw request bodies before database status mutations occur.

crypto.createHmac('sha256', secret).update(body).digest('hex') === signature
Pre-Signed Cloudflare R2 Storage

Direct client-to-storage uploads using temporary pre-signed URLs, eliminating server memory overhead when clients upload large design deliverables or documents.

Engineering Trade-offs & Current Limitations

Real software involves intentional compromises. Here is what was chosen and why:

Supabase Managed Postgres over Custom Self-Hosted DB
Why: Provides battle-tested auth, built-in backups, connection pooling, and declarative RLS without requiring full-time DBA maintenance.
Constraint: Tied to Supabase's pricing tiers and configuration boundaries compared to raw self-hosted Postgres instances.
Server-First Architecture over Heavy Client-Side SPAs
Why: Ensures near-instant First Contentful Paint (FCP), smaller JavaScript bundles on mobile devices, and zero exposed database keys.
Constraint: Requires server runtime availability for dynamic paths compared to purely static HTML deployments.
Verified live on production domain
Visit Live Devnexis