Case study · Enterprise HR & payroll SaaS · KPI
Infithra
Enterprise HR and Payroll Platform for the UAE and KSA
A cloud HR and payroll platform for businesses in the UAE and Saudi Arabia, covering the full employee lifecycle from onboarding to end-of-service: labour-law and WPS-compliant payroll, time and attendance, leave, expenses, people analytics and employee self-service on web and mobile. I joined at the inception of the project, and over more than three years built it into a production platform used by enterprise companies every day.
Visit infithra.comPayslip · sample
Employee #1042
Operations · Dubai
- Role
- End-to-end ownership
- Company
- KPI
- Duration
- Jan 2023 – Jul 2026
- Scope
- HR platform · admin platform · mobile backend
Years, from concept to production
Production APIs
Daily users
Enterprise companies
Automated schedulers
Overview
Project overview
HR and payroll in the Gulf are governed by labour law: contracts, contributions, overtime, leave entitlements and end-of-service gratuity, with rules that change by employee classification and location. Companies usually manage this across spreadsheets, stand-alone tools and ERP payroll modules that are slow to run and hard to adapt.
I architected Infithra to consolidate this into a single multi-tenant platform. Each tenant's data is isolated, business rules are held in configuration rather than code, and intensive processing such as payroll completes in seconds rather than hours.
Configurable by design
Fields, validations, pay components and permissions are configuration, so the platform adapts to each company without a release.
Isolated per tenant
Tenant data separation was part of the architecture from the first release.
Built for scale
Processing, scheduling and deployment were designed for many tenants running at the same time.
One standard for every module
Shared structure, APIs and components, so the codebase stays predictable as the team and the product grow.
What I owned
My role and contribution
At KPI, I owned the platform end to end: the architecture, the product modules, the UI and UX, the integrations and delivery. I was part of every design and vendor discussion, and defined how the system would operate, from the initial architecture through launch and scale.
Set the technical foundation of the whole platform.
- Designed the cloud infrastructure and the service-based backend: a frontend service and multiple backend services, split by domain.
- Designed the database schema, and set the repository structure and coding standards every other developer followed.
- Defined the tenant isolation strategy and how new tenants are onboarded.
- Took part in every design and vendor discussion, and decided how the system would operate as it grew.
Platform
Platform scope
I built the HR platform used daily by HR teams, managers and employees, together with the two supporting systems around it. Hover over an area to see what it covers.
The product
HR platform
HR teams · managers · employees
Payroll engine
Admin platform
Supporting platform
Onboards new companies, runs system upgrades and keeps scheduler logs across every tenant.
Mobile app
Employee self-service
Built by mobile team on the backend services, APIs and business logic I designed.
Engineering
Foundations and engineering standards
From the outset, I established the foundation that every other part of the platform, and every other developer, built on: the architecture, the data model, the codebase conventions and the shared building blocks.
Architecture and infrastructure
I chose the cloud services, split the backend into domain services, and designed the database schema and table structure, with a separate database for every tenant.
Web tier
Domain services
Databases · one per tenant
Codebase standards
I defined a consistent layout, module structure and naming convention across every service repository, so any developer can locate a feature and extend the platform the same way.
modules/
Shared building blocks
I packaged the common backend logic into a shared toolkit that every backend service installs as a dependency, rather than duplicating code across repositories. Every controller draws on the same reusable functions, alongside a standard API structure, shared frontend components, and a global theme and styling system.
toolkit package
Core HR
Leave & attendance
Self-service
Multi-language data
I extended multi-language support to stored data, not only the interface. Fields such as employee, location and subsidiary names take values in more than one language, and a layer in the data access code swaps in the stored translation before the API responds. Emails follow the same preference. Arabic runs in production, and adding another language needs no custom code. Try it.
Stored · employee record
API response
{
"name": "Omar Haddad",
"location": "Dubai",
"subsidiary": "Company A"
}
Payroll
Payroll engine and compliance
Payroll carries the platform's heaviest workload. I made every pay component configurable, applied labour-law rules based on each employee's contract and classification, and reduced a full payroll run to seconds. Every build and enhancement was rigorously tested with the QA and functional teams, making the engine progressively more precise and efficient as it grew to support more rules and configuration.
Configurable pay components
Earnings, allowances, contributions and deductions are configurable per company and per employee classification. A run for 100 employees completes in seconds rather than hours.
Pay components by classification
Full-time · UAE national
Payroll run · 100 employees
Labour-law rules
Contract, contribution and classification rules are applied automatically to every employee record.
Employee #1042 · rules applied
Payslips and reports
Each run generates PDF payslips and payroll reports, delivered to employees through self-service.
The full employee lifecycle
I integrated attendance, leave, overtime, expenses, reimbursements, advances and end-of-service into payroll through a single employee record.
Onboarding
Security
Identity, access and tenancy
HR data is sensitive, and large organisations need precise control over who signs in where and who sees whom. I built multi-tenant authentication and designed a hybrid role- and attribute-based permission model, after researching how leading HR and cloud platforms handle access.
Multi-tenant sign-in
A single user can belong to multiple companies and switch between them without signing out, and each switch moves the session into that company's own data. Users move between the HR platform and self-service on the web, and self-service also runs on mobile. Access is granted in stages: web access when the employee record is created, mobile access once onboarding is complete. Sign-in is protected with multi-factor authentication. Try it.
One login
Switch company
Switch platform
Session
Two-layer permissions
I designed a two-layer permission model. The first layer grants create, read, update and delete rights per module. The second narrows those rights to a slice of the organisation, by subsidiary, location, department or a set of employees, in any combination. Both layers are configuration. Try it.
Layer 1 · rights per module
Tap a cell to grant or revoke.
Layer 2 · scope by organisation
Subsidiary
Location
Department
No selection in a group means no limit on it.
Visible employees · 4
#1040
Dubai · Finance
#1043
Dubai · Operations
#1046
Dubai · Finance
#1049
Dubai · Operations
Tenant isolation
Every tenant's data is isolated, and a request can only reach its own data. This was built into the architecture from the first release.
Company A
Company B
Company C
Configuration
Configuration and administration
Every company runs HR differently. I made the product configurable, so most business needs are met through settings rather than a new release. Alongside it I built the admin platform, the supporting platform used to run every tenant.
Metadata-driven forms
Forms are generated from configuration, so new fields and validations go live without a code change or deployment.
form.config
Live form
Admin platform
I built the admin platform to onboard new companies, apply system upgrades, and maintain scheduler logs and monitoring for every tenant.
Faster tenant setup
I improved tenant setup in the admin panel, so a new tenant is configured from one form in under a minute instead of about 20.
Leave & Attendance · Background jobs
Scheduling and background processing
Scroll through one day across six company subsidiaries in four time zones. Schedule shown is illustrative.
Jobs running
3
Instances
Skipped
0
01 / 05
Per tenant, subsidiary and time zone
More than ten schedulers and background workers run for every tenant and each of its subsidiaries, at the right moment in that entity's own local day.
The schedulers
I built a range of scheduled jobs that run behind the platform for every tenant and subsidiary, each in its own time zone. Routine work is handled automatically in the background, without manual intervention.
Email delivery
Birthday and work anniversary emails, and reminders before employee documents expire.
Happy birthday
scheduled · 08:00 local
Acknowledgement follow-ups
Follow-up emails for announcements, policy handbooks, polls and surveys until employees acknowledge them.
Leave accruals
Leave balances accrue on schedule, following each company's policy.
Planned leave applications
Employees plan leave ahead and get the plan approved. When the planned date arrives, a scheduler creates the leave application for it automatically.
Leave plan · 12–16 May
Pending approval
Leave application
Waiting for date
Auto attendance and clock-out
Attendance is marked from the schedule, and open shifts are closed automatically at the end of the day.
Auto attendance
attendance marked from the schedule
Notification cleanup
Old notifications are cleared on a schedule, so feeds and tables stay fast.
Self-upgrading databases
On every new deployment, the platform checks the admin database and every tenant database, and applies any pending migrations.
server start · version check
Integrations
ERP and system integrations
I owned the NetSuite integration end to end: the API and system design, the mapping UI and the background sync workers. Organisational data flows into Infithra, and payroll, contributions and expenses post back to the ledger as journal entries. It supports both single-entity and multi-subsidiary NetSuite accounts, and open APIs connect other business systems.
Into Infithra
To NetSuite · journal entries
Field mapping is set per company. Switch the account type to see how the mapping and the posted entry change.
Field mapping
Journal entry · monthly payroll · sample
Subsidiary: Company A
Engineering
Delivery and engineering operations
A platform serving many tenants needs to ship often and safely. I rebuilt the delivery pipeline, automated database changes across every tenant, and brought AI agents into the development workflow.
Faster deployments
I restructured the build pipeline with layer caching, cached dependencies and a separate web-server image. Frontend deploys dropped from about 30 minutes to 5, and each backend service from about 20 minutes to 10–12.
Before
Multi-tenant migrations
I automated database migrations across all tenants. On every deployment, the platform checks the version of the admin database and each tenant database, then applies pending migrations in order. Every tenant stays on the same schema, with no manual database steps in a release.
migrate · all tenants
Observability
I integrated New Relic across the backend services for application performance and tracing, and used Grafana dashboards and CloudWatch logs and alarms to monitor the platform and gain insight into its behaviour, so a slow endpoint or failing job can be traced to its source quickly.
All services · healthy
New Relic
APM · traces
Grafana
dashboards
CloudWatch
logs · alarms
AI-assisted development and debugging
I developed in-house AI agents, Claude skills, MCP servers and workflows, connected to the codebase and the team's tools. They review changes against the project's standards and trace bugs to a likely root cause, cutting development and review effort by about 40%.
Build
How the platform was built
Build record
Infithra · built from the ground up
Architecture, infrastructure and standards
FoundationThe cloud services, the split into domain services, the database schema, and the repository structure and coding standards every developer followed.
The shared core
Platform servicesAuthentication with multi-factor sign-in, multi-tenancy, access control, multi-language data, a standard API structure, reusable components and a global theme.
Core HR and the employee lifecycle
HR modulesCore HR, employee management, onboarding and offboarding, leave, attendance, custom dashboards, analytics and reports.
Rebuilt until it was configurable
Payroll engineThe engine went through several rebuilds as system rules grew more complex, until every pay component and labour-law rule could be configured.
Schedulers and background workers
AutomationMore than ten, running for every tenant and subsidiary in its own time zone.
Running every tenant
Admin platformCompany onboarding, system upgrades and scheduler logs across all tenants.
Connected systems and mobile
IntegrationsNetSuite ledger sync, open APIs, and the backend services and APIs the mobile app is built on.
In daily use
ProductionLaunched in production and grown to more than ten enterprise companies and over 2,000 daily users.
Reflection
Lessons learned
Building a platform from the ground up taught me as much from what I would change as from what worked. These are the decisions I would make differently today.
I split the backend into services by business module early on. Most of them did the same create, read, update and delete work, so the split added network calls and deployment overhead with little benefit, and the services stayed tightly coupled: one often could not finish its work without another. Next time I would start with a modular monolith and separate only what truly needs independence, such as PDF generation, schedulers, reporting and analytics, each designed to keep working when a dependency is unavailable.
These lessons shape how I design systems today: start simple, split only when there is a real reason, and choose tools that fit how the product works.
Technology stack
Backend
Frontend
Cloud
Delivery & monitoring
Infithra is closed source and covered by a non-disclosure agreement. Visuals on this page are illustrative.