Every module. One system of record.

01

Platform architecture & multi-tenancy

One sealed tenant per Master, a native three-tier commercial hierarchy, and infrastructure that keeps every agency's data private by design.

Three-tier commercial hierarchy

Master → Reseller → Agent inside one sealed tenant. Permissions cascade and narrow downward, and Resellers grow their own Agent networks — turning one B2B deal into a scalable multi-level sales channel.

Hard tenant isolation

Every Master and its entire sub-tree is a completely sealed tenant, enforced at the database and application layer — never just the UI. No bookings, pilgrims, pricing or finances ever cross Master trees.

Sibling privacy on bookings & pricing

Sub-accounts share one pool of traveler identities but never see each other's bookings, prices or notes for the same pilgrim. Only the Master sees the full picture across its tree.

Cascading permission ceilings

Each company sets the maximum ceiling for the level below it — per-module, per-action, enforced server-side. Narrowing a parent instantly tightens every descendant.

White-label branding

Every Reseller and Agent applies its own logo and branding inside the shared platform. Branding resolves automatically at login — no separate deployment per tenant.

Multi-currency engine

Each Master curates its own active currency list driving every dropdown across bookings, pricing and finance. Historical bookings keep their original currency codes and re-total correctly forever.

Provider-independent object storage

Passports, visas and documents route through a storage abstraction targeting S3/R2-compatible storage with local fallback. Files are served only through authenticated proxy endpoints — bucket URLs are never exposed.

02

Security, access & user management

An enterprise security baseline delivered as standard, not a costly add-on — from lockout protection to an immutable audit trail.

Username-based identity routing

A globally unique username resolves a user's company and branding at login. One neutral login screen avoids leaking which agency a username belongs to; email stays optional contact metadata.

Brute-force lockout protection

Five failed attempts trigger a self-clearing 10-minute lockout. Admins can unlock early; counters reset on successful login.

Contested-login session handshake

One active session per username. A second-device login prompts the first device to accept or deny the handover in real time — every handshake and kick-out recorded.

Two-factor authentication

Email OTP and/or TOTP authenticator apps, with company-level enforcement that overrides individual opt-out. Backup codes issued at setup; enforced 2FA walks users through setup on next login.

Enterprise password policy engine

Minimum length and complexity, 90-day expiry with advance warning, reuse-prevention against the last five passwords, and Argon2id/bcrypt one-way hashing — passwords are never recoverable, only resettable.

Session security & idle timeout

Sessions expire after 60 minutes of inactivity, with hardened handling — regeneration, strict cookies, SameSite and HttpOnly on every request.

Suspension & cascading deactivation

Suspending a parent instantly freezes its entire sub-tree, kills active sessions and preserves all history. Reactivation restores everything exactly as it was — a fully reversible kill switch.

Append-only audit trail

Every state change and security event logged with who, what (old → new), when and where. Immutable — entries can never be edited or deleted by anyone, including Super Admin.

Super Admin change log

Every platform-level change recorded in plain English, filterable by date, module, developer and change type — linked to its Git commit reference where applicable.

03

CRM & traveler profiles

A lifetime record per pilgrim — from first enquiry through every renewal, relationship and journey.

Lead & enquiry capture

Capture a traveler from first enquiry with just name + phone. Lead source tracked via a reportable pick-list; each lead owned by a salesperson with manager-controlled reassignment.

Ownership history & reassignment

Reassigning a lead preserves historical credit for the original owner — commission attribution stays accurate while the new owner takes the relationship forward.

Stable pilgrim identity with passport history

A permanent internal ID that never changes across passport renewals. Old passports retained as history; renewal detection prompts a name + DOB confirmation instead of silently merging.

Shared identity, private commercial data

An existing passport surfaces the shared identity instantly — but never another sub-account's bookings, prices or notes for that person.

Mahram & family relationship engine

Directional, typed mahram links (husband / father / brother / son), configurable age-threshold warnings, and clearance via a valid link or NOC document. Warn, never block.

Stage-gated mandatory fields

Requirements tighten automatically from Lead → Quote → Booking → Pre-Travel. Non-negotiable fields hard-block; advisory fields warn — and every gap surfaces to a visible worklist.

Bulk import & passport OCR capture

Create profiles manually, via booking, in bulk from a spreadsheet, or by photographing a passport for OCR-assisted auto-fill — with bad-row handling so one mistake never blocks the batch.

04

Quotation & sales workflow

A complex multi-supplier Umrah package becomes a single guided sales flow.

Multi-step quotation wizard

An 11-step guided builder covering customer, package, party & rooms, hotels, meals, flights, transport, visa & passports, totals & instalments, and review — with save-as-draft at every step.

Quotation history & validity tracking

One lead holds multiple quotations, each with its own state and expiry. Original quoted price and final agreed price retained side by side — a defensible price history for every conversation.

05

Booking management

A single coherent data model for group travel — traceable from sale back to source inventory.

Three-layer booking lineage

Package → Departure → Booking. Clear separation of what was sold, when it travels, and who bought it — accurate reporting and reconciliation at every layer.

Snapshot-not-live pricing

Every component freezes its full price breakdown at the moment it's attached. Later catalogue changes never retroactively alter an existing booking — eliminating repricing disputes.

Per-pax booking model

A booking is a container for one to many pilgrims, priced at the individual level — supporting child discounts, single supplements and mixed pricing within one family or group.

Hotel-anchored, visa-closed workflow

Hotel availability anchors booking dates; visa issuance is the final step that closes the booking as travel-ready. Industry-correct logic encoded directly into the system.

Booking calendar with occupancy heatmap

Six color-coded layers across departures, returns, flights, hotel check-in/out, transfers, visa deadlines and instalments — plus a per-night occupancy heatmap by hotel with click-through drawers.

06

Package & group departure builder

Build a complete, priced Umrah package in minutes from existing supplier inventory.

Five-catalogue package assembly

Attach components from Visa, Flight, Hotel, Transport, and Meals & Board catalogues onto a departure. Each type prices itself correctly, with a live per-currency running total.

Add · modify · remove component controls

Adjust quantity or nights in place without losing a component's frozen unit price. Values clamped to sensible ranges to prevent data-entry errors.

Automated indicative sale pricing

Cost × (1 + markup%) + fixed fee computed automatically for every component — identical pricing logic across every module, guaranteeing error-free margin application at scale.

Access-gated package building

Build actions restricted to head-office manage permissions, CSRF-protected and fully audited. Resellers and Agents sell the finished package, never touch its structure.

07

Flight management

One verified source of truth for flight pricing across every reseller and agent.

Flight catalogue with fare lines

A master-scoped catalogue of flight fares attachable to packages at a per-fare price — snapshot pricing keeps booked fares stable regardless of later updates.

Trip-type entry with auto-mirror

Outbound, Return and Multi-city trip types, with the return leg's route automatically mirrored — cutting manual re-entry in half for standard round trips.

Price-block flights bookable in wizard

Flights selected and priced directly inside the booking / quotation wizard, using the same catalogue and pricing engine as the package builder.

08

Hotel allocation

Hotels anchor the itinerary — because in Umrah operations, availability in Makkah and Madinah is the binding constraint.

Hotel-anchored stays

Check-in/out dates drive the rest of the itinerary's scheduling logic, keeping transport and meals aligned to actual stay dates.

City directory

A curated directory of 22 major Saudi cities gives a consistent, structured reference for hotel and transport endpoints — no more "Madinah" vs "Medina" fragmentation.

Room & occupancy management

Room-level occupant tracking against capacity per property, surfacing over-allocation risk immediately during high season.

09

Transport & logistics

Structured routes, branded fleet cards and a real-time readiness ladder for ground transport.

Structured route builder

Routes built from typed endpoints — Airport (IATA autocomplete) and Hotel (City Directory) — feeding directly into the booking wizard for accurate transfer selection.

Vehicle capacity fleet cards

Branded capacity glyphs from sedan through coach (2 · 4 · 6 · 8 · 10 · 10+ seats) for instant visual fleet sizing during busy departure planning.

Per-transfer workflow status ladder

Every transfer moves through a defined status ladder, feeding the needs-attention worklist for anything stuck or overdue.

10

Visa management

The highest-risk, most time-sensitive part of Umrah operations — tracked with granular precision.

13-state visa processing ladder

Every application progresses through a detailed 13-state workflow from request to delivery — surfacing pipeline bottlenecks long before they become last-minute crises.

Visa copy enforcement

Transitions to Approved or Delivered are server-side blocked unless a visa copy document is on file — with passport/visa thumbnail pairs shown directly on the record.

Visa catalogue

A master-scoped catalogue of sellable visa packages with rich-text descriptions and a private, authenticated image gallery per product.

Mahram NOC & compliance linkage

Visa processing integrates directly with the mahram compliance engine — a valid link or on-file NOC clears the warning inside the visa team's own workflow.

11

Meal management

Catering as a first-class, accurately-priced part of the package.

Meal & board catalogue

Breakfast, lunch, dinner and snacks managed as a dedicated catalogue, attached per-head or per-event — with prices snapshotted at attach time like every other component.

Dietary & health tracking

Dedicated dietary, allergy, mobility and vaccination fields — including meningitis ACWY status required for Saudi entry — flowing directly into meal planning for group departures.

12

Document vault

One secure, compliant document layer across the entire platform.

Secure global upload & viewer

A single async pipeline and secure viewer for every document type — served only through authenticated proxy streaming, never a public bucket URL.

Bulk passport upload with OCR scan window

Photograph or upload passports in sequence with auto-extracted, enriched fields for confirmation — cutting group onboarding from days of typing to a guided scanning session.

Passport & visa thumbnail pairing

Document thumbnails displayed side by side on traveler and visa panels for instant visual verification — directly supporting the visa-copy compliance gate.

13

Finance & collections

Multi-party accounting built for the layered commission model of B2B travel distribution.

Three-ledger accounting model

Pilgrim receivable, inter-tier settlement and supplier payable — three distinct ledgers with gap-free sequential document numbering for formal accounting and audit.

Pure stacked markup pricing

Markup is the sole earning mechanism at every tier. Nobody sells below the inherited floor; each tier sees only the cost handed down to it — upstream margins stay confidential.

Frozen component-level cost breakdown

Full cost / markup / sale / FX breakdown snapshotted at attach time, with per-pilgrim add-on tracking — precise, auditable settlement months or years later.

Per-Master currency configuration

Each Master's active currency set governs every currency field for that tenant, while historical figures retain their original codes.

14

Dashboard, reporting & insights

A daily cockpit view of operational health — and an early-warning system for everything at risk.

Operations dashboard with KPI strip

A live KPI strip and action-oriented landing view of active departures, bookings and pending tasks — immediate visibility without digging through modules.

Booking calendar analytics

The occupancy heatmap surfaces per-night pilgrim counts and peak-occupancy-by-hotel insights — spotting capacity pressure before it becomes an overbooking incident.

Needs-attention worklist

Missing documents, mahram warnings, visa delays and payment gaps surface into one ranked, actionable worklist. Warn, don't block — nothing is ever silently hidden.

15

Communications & notifications

Critical account and security email that just works — with no heavy vendor dependency.

Transactional email engine

A swappable Mailer with log-based development mode and dependency-free SMTP-over-socket production mode — powering verification, password reset and OTP email.

Email verification & self-service password reset

Token-based verification and self-service reset with strict anti-enumeration protection — cutting help-desk overhead while hardening account recovery.

16

System administration

Platform-level operations, oversight and accessibility — engineered for zero-drama deployments.

Super Admin god-mode plane

A fully separate Super Admin login plane for support and oversight — with every tenant entry logged as a sensitive read event in the immutable audit trail.

Per-Master factory reset

A triple-confirmed reset wipes operational data while preserving companies, users, permissions, configuration and the audit log — a clean path for demo-to-live onboarding.

CDN / object storage console

Centralized storage configuration with a reachability test — confirming storage health proactively instead of during a live upload in peak season.

Comfort mode & accessibility controls

A per-device persisted toggle enlarges inputs, table cells, navigation and buttons platform-wide — complementing AAA-leaning contrast and full keyboard navigation.

Idempotent, self-healing schema migrations

Strictly additive, version-gated schema changes that self-heal on startup — no manual SQL, no DBA on deploy day, no broken historical data.

17

Design system & brand identity

An emerald-and-gold editorial design language tuned for long working sessions — and ready for white-label presentation.

Emerald & gold editorial design language

Fraunces display serif, DM Sans body and JetBrains Mono for data — with AAA-leaning contrast that avoids pure-white glare across one consistent component library.

Branded icon & illustration system

Custom SVG glyphs for Makkah / Madinah / Jeddah hotels, visa approval stamps, vehicle-capacity seals, pilgrim types and meal categories — fully CSP-compliant.

Fully responsive, mobile-ready interface

Every page, table, form and modal responsive across six breakpoints — the sidebar collapses off-canvas and the calendar becomes a day-by-day agenda on phones.

Focus-visible & keyboard accessibility

A prominent 3px gold focus ring and consistent keyboard navigation preserved across every interactive element — enforced as a build standard, never silently removed.