A PCI-Compliant Payment Dashboard Launched 40% Under Budget

The Situation

the client had just closed a $4M pre-seed round and needed to demonstrate payment processing capability to enterprise prospects before their Series A pitch. Their existing prototype was a rough proof-of-concept — not something they could show to compliance-conscious buyers.

They had three weeks. Their internal team was tied up on core infrastructure. They needed a partner who could own the dashboard end-to-end: design, development, security, and deployment.

The Challenge

The project came with several constraints that made it genuinely difficult:

• PCI-DSS compliance was non-negotiable — the client's enterprise clients required it
• The dashboard needed to handle multiple payment rails: ACH, wire, and card
• Real-time transaction status updates were required (no polling-based UX)
• Multi-tenant architecture from day one — different orgs seeing only their own data
• A 21-day hard deadline tied to an investor demo

Most agencies quoted 8–12 weeks and $180K+. the client couldn't wait, and couldn't overspend.

Our Approach

We started with a half-day scoping session to lock down the MVP feature set and agree on what "done" meant. Rather than attempting to build every feature, we prioritized ruthlessly: the things investors and pilot customers actually needed to see in Week 3.

The sprint was structured into three phases:

• Days 1–4: Architecture, data model, Stripe integration, and auth scaffolding. We used Stripe's Treasury API for multi-rail payment support, which eliminated weeks of custom payment rail work.
• Days 5–14: Core dashboard views — transaction list, real-time status feeds, org-level reporting, and the approval workflow for outbound payments. Daily standups with the the client CTO kept alignment tight.
• Days 15–18: Security hardening, PCI scoping, penetration testing checklist, staging-to-production migration, and handoff documentation.

The Solution

We delivered a fully functional, multi-tenant payment dashboard with the following capabilities:

• Real-time transaction feed using Stripe webhooks and server-sent events — no page refresh required
• Role-based access control with org isolation at the database level (Postgres row-level security)
• ACH, wire, and card transaction support via Stripe Treasury
• A two-step approval workflow for payments over configurable thresholds
• Exportable transaction reports in CSV and PDF
• Audit trail for every state change — critical for compliance

The entire codebase was written in TypeScript with strict mode enabled. We documented every integration decision and left the the client team with a detailed runbook covering deployment, environment variables, webhook configuration, and Stripe account setup.

Results

The dashboard launched on Day 18 — three days ahead of the investor demo. the client used it live during their Series A pitch. The compliance story — PCI-DSS scoped, auditable, with row-level org isolation — was a direct selling point in enterprise conversations.

Total cost came in 40% under the original budget, largely because we avoided over-engineering features that weren't needed for the MVP. the client's CTO told us it was the cleanest codebase they'd received from an external partner.