Hessa Events system
The HR, payroll, and WhatsApp campaign platform an events company runs on, in English and Arabic.
The Hessa Events system at system.hessaevents.com is the internal platform for Hessa Events and Sosa Fiori in Riyadh, Saudi Arabia: remote attendance, hours, payroll from logged hours, end-of-service settlements, employee records and documents, tasks, an encrypted vault, and a WhatsApp Business module that sends event invitations to guest lists, tracks delivery and RSVPs live, and runs a two-way inbox. I built and continue to evolve it as the sole engineer.
The context
A Riyadh events company with remote staff across two legal entities needed to see who is working, pay people correctly from real hours, keep contracts and documents in one place, and stop running guest invitations from spreadsheets and personal phones.
Everything had to work in English and Arabic, per user, and the WhatsApp side had to use the official Meta API so the business number was never at risk.
What I built
An HR platform first, then a WhatsApp campaign and inbox module on top, with a small always-on worker as the only piece that talks to Meta.
- Attendance sessions, a clock widget with on-break detection, and daily work briefs
- Employee records: identity, contract, compensation, bank, documents on Cloudflare R2
- Salary calculation from logged hours plus rewards, deductions, and Mudad adjustments
- End-of-service settlements with attachments, Employee of the Month, ratings, reports
- Tasks with comments and attachments; audit log of every sensitive action
- Encrypted Vault for company secrets, with reminder emails
- Per-user module grants so an employee-role user can be given one module only
- WhatsApp campaigns: import CSV or Excel guest lists, send any approved template, watch delivery and per-button replies live, export to Excel
- Template authoring and submission to Meta review from inside the CRM
- Two-way inbox with the 24-hour window enforced, media in and out via R2, Supabase Realtime
- Messaging-tier pacing with an automatic drain loop and a quality-rating circuit breaker
How it works
The CRM is a Next.js 16 app on Vercel with Supabase for data, auth, and Row-Level Security, Cloudflare R2 for files, Resend for email, and next-intl for English and Arabic persisted per employee. Every server action authorises first, validates with zod, and writes an audit event.
WhatsApp is split in two on purpose. The CRM owns the UI and the data; a small Node.js worker on Railway is the only service holding Meta credentials. It sends templates with an atomic pending-to-queued claim, bounded concurrency, and backoff, ingests signed webhooks for button taps and delivery statuses with a never-downgrade rank guard, and sweeps stuck rows on restart. The CRM triggers it with one authenticated call.
Sending respects Meta's 24-hour messaging tier: a campaign larger than the window claims what it can and a drain loop finishes the rest over the following days, pausing automatically if the number's quality rating drops to red.
The outcome
Two companies run attendance, payroll, and HR on the system daily, and event invitations now go out from the CRM with live delivery and RSVP dashboards instead of spreadsheets.
It is the proof behind both the CRM and ERP page and the WhatsApp Business API page: one system, extended module by module as the business grew.
More work
Have a project like this?
I build platforms, apps, and systems like these end to end, from Cairo and remote worldwide. Tell me what you are building.