Back to Portfolio
SaaS
● Live in productionRetro — Sprint Retrospectives
Real-time sprint retrospectives for every team
Visit Live Site2 apps + 2 shared packages
Multi-instance realtime
Caddy auto-HTTPS
Overview
Retro — Sprint Retrospectives is a SaaS platform for running real-time sprint retrospectives for every team. Built with Next.js 15, React 19, PostgreSQL, Drizzle, Redis, Docker, and Socket.IO, it supports live cards, votes, presence, and a timer through Socket.IO with a Redis adapter. The product includes no-signup anonymous join with server-side device tokens, along with drag-and-drop columns, voting, board lock, and CSV/PDF export. It also features a 15-language localized UI, dark mode, and a pnpm monorepo structure. Architected as 2 apps plus 2 shared packages, the solution is designed for multi-instance realtime usage and includes Caddy auto-HTTPS for deployment-ready operation.
Sprint retrospectives shouldn't need a login or a facilitator scrambling with sticky notes.
Remote retros lose the sticky-note flow.
Physical boards worked because everyone could see and move a card at once; a shared doc or spreadsheet never feels the same.
Signup friction kills participation.
Asking a team to create an account just to drop a few sticky notes is a good way to get an empty board.
Action items get forgotten.
Without carrying items forward, the same issues resurface sprint after sprint.
A retro tool should feel as fast as sticky notes on a whiteboard — not like onboarding into new software.
Why it matters
The outcomes that actually move the needle
No signup, ever.
Anonymous, signed device tokens mean a team can be on a board in seconds.
Truly real-time.
Cards, votes, presence and the timer sync instantly across every participant, powered by Socket.IO with a Redis adapter for multi-instance deployments.
Owner controls that actually hold.
Board mask, lock and vote-hiding are enforced on the server against the real owner token, not just hidden in the UI.
Action items that carry forward.
Nothing gets lost between sprints.
Self-hosted, your data.
Run it on your own infrastructure with real Postgres backups and a tested restore path.
Key Capabilities
What we designed, built and shipped
Live cards, votes, presence & timer via Socket.IO + Redis adapter
No-signup anonymous join with server-side device tokens
Drag-and-drop columns, voting, board lock, CSV/PDF export
15-language localized UI with dark mode; pnpm monorepo
Technology Stack
Every choice made for a reason — not just what's trendy
| Layer | Technology | Why |
|---|---|---|
| Web | Next.js 15 (App Router) + React 19 | Board UI, dashboard, and reports |
| Realtime | Socket.IO 4 + Redis adapter | Instant sync across every participant, multi-instance-ready |
| Database | PostgreSQL 17 + Drizzle ORM | Durable board history (the original tool only kept data in Redis with a TTL) |
| Identity | Signed httpOnly device cookie | No accounts, no passwords — anonymous by design |
| Rate limiting | Per-socket fixed-window limiter | Caps abuse without slowing normal use |
| i18n | next-intl, 15 locales | Genuinely translated UI, not English fallbacks |
| Deployment | Docker Compose + Caddy | Auto-provisioned HTTPS, one command to stand up |
| CI/CD | GitHub Actions, health-gated deploy | Migrations run, then the deploy is gated on a live health check |
Architecture
Real-time, without losing history
A dedicated realtime gateway keeps every board instantly in sync, while Postgres keeps it durable.
A dedicated Socket.IO gateway — not the web app itself — handles every live board event, with a Redis adapter so multiple gateway instances can broadcast to each other. Postgres is the durable system of record; the predecessor tool only kept data in Redis with a TTL.
How it works
From board creation to a shareable report
1
Create a board
Pick a team name and a retro template — no account needed.
2
Share the link
Anyone with the link joins anonymously via a signed device token.
3
Run the retro
Add cards, vote, group similar ideas, and run the shared timer.
4
Wrap up with actions
Capture action items that carry into the next sprint.
5
Share the report
A durable, read-only report link survives after the live board closes.
Deployment
How it runs
Self-hosted, one Docker Compose stack.
The web app, realtime gateway, Postgres and Redis each run in their own container behind Caddy, which provisions HTTPS automatically.
Operational details
- GitHub Actions CI — typecheck, lint, tests and a production build on every push
- Health-gated CD — migrations run, then the deploy is gated on a live Postgres + Redis health check
- Scheduled Postgres backups with a documented, tested restore path
- Automatic retention cleanup for boards past their auto-delete date
Run your next retro on it.
We'll walk through creating a board, running a live retro, and pulling the report — on a call.
Complete feature guide
Everything the platform does
Retro is a self-hosted, real-time sprint retrospective board — cards, votes, presence and a timer, synced instantly, with no signup required. Here is everything the platform does.
Core
A live board that feels like sticky notes
Cards, votes, presence and a timer, synced instantly across every participant — no account required.
Retro templates
- Six built-in formats. Classic, Start/Stop/Continue, Mad/Sad/Glad, 4Ls, Sailboat and Starfish — pick the format that fits the sprint.
Real-time board
- Live cards & columns. Cards, columns and drag-and-drop reordering sync instantly across every participant.
- Live voting. Votes update in real time, with an optional board-wide vote limit.
Presence & timer
- Who's in the room. See which participants are currently on the board.
- Shared countdown timer. Run a synced timer visible to everyone on the call.
Card grouping
- Cluster similar cards. Group related cards together during discussion, then rename or ungroup as the conversation moves.
No-signup join
- Anonymous by default. A signed, httpOnly device token identifies a participant — no account, no password, ever.
Governance & ops
Real ownership, real durability
Owner controls enforced on the server, action items that carry forward, and history you can actually report on.
Owner controls, enforced server-side
- Not just a UI toggle. Mask, lock, hide-votes and timer actions are checked against the real board-owner token on every request.
- Per-record permissions. Editing or deleting a card or comment is scoped to the device token that created it.
Action items
- Carried sprint-to-sprint. Action items don't disappear when the retro ends — they carry forward to the next one.
Cross-team dashboard
- Board history & analytics. See past boards, cards and votes across every team, with a boards-by-team breakdown.
Shareable report & export
- Durable report link. A read-only, shareable report survives after the live board is gone.
- CSV export. Export a board or your whole board history to CSV.
15-language UI
- Real translations. Fifteen languages, genuinely translated — not English fallbacks — plus dark mode.
Security & privacy
- Owner-only actions (mask, lock, hide votes, timer) are enforced server-side against the real board-owner token — not just hidden in the UI.
- Editing or deleting a card or comment is scoped to the device token that created it.
- A signed, httpOnly device-identity cookie can't be read or forged from client-side JavaScript.
- Real-time connections are rate-limited per socket to guard against abuse.
- All traffic runs over auto-provisioned HTTPS (Caddy).
Reliability
- CI runs a typecheck, lint, test suite and a production build on every push.
- Deploys run database migrations, then poll the live health endpoint — a failing health check fails the deploy.
- The health endpoint checks both Postgres and Redis, not just that the process is running.
- Scheduled Postgres backups with a documented, tested restore path, plus automatic retention cleanup for old boards.
See it in action
This product is live in production — explore it for yourself.
Visit Retro — Sprint RetrospectivesReady to Start Your Project?
Let's discuss how we can help you achieve similar results for your business
More Success Stories
Explore our other saas projects
SaaS
Sparks Business — Inventory, Sales & GST Invoicing Platform
Sparks Business is a multi-tenant platform built by eSparks IT Solutions to run inventory, purchases, sales and GST invoicing from one system. It pairs a NestJS 11 API with an installable Next.js 15 PWA, backed by PostgreSQL 17 through Prisma 6 across 49 data models. Every query is scoped to its tenant through an AsyncLocalStorage-driven Prisma client extension, and an append-only audit table is enforced at the database level — even a direct update or delete against it is rejected by a trigger. GST math (CGST/SGST/IGST splitting, GSTIN validation) runs on decimal.js for exact, rounding-free results, and a real Tally XML importer lets a business bring in existing ledgers, vouchers and stock items instead of starting over. Redis and BullMQ handle background email and document generation, S3-compatible object storage holds product images, invoice PDFs and backups, and Microsoft Graph sends transactional email. Deploys are health-gated, so a broken build never reaches production.
Read Full Case Study
SaaS
Esparks Edu — School Management ERP
Esparks Edu is a SaaS school management ERP built to unify academics, finance, HR, and daily operations in one platform. eSparks IT Solutions developed it with Next.js 16, React 19, PostgreSQL, Prisma, NextAuth.js v5, Redis, and a companion React Native app. The system supports subdomain-based multi-tenancy with row-level tenant isolation, along with RBAC across 9 roles and 4 subscription tiers (Free, Starter, Professional, Enterprise) billed through Razorpay. Its scope covers admissions, attendance, fees, exams, payroll, timetable, transport, library and report cards, helping schools manage core processes in a single system. The platform spans 60 data models across 6 logical database schemas, around 27 web modules, and 21+ mobile screens, with Firebase push notifications extending the experience to parents and students.
Read Full Case Study
DevOps & Infrastructure
ThinClient OS + Fleet Manager
A production-grade Linux appliance that boots straight into a full-screen Windows RDP session — no desktop, no shell, no login prompt — backed by a self-healing watchdog and an infinite reconnect loop. On machines with Secure Boot and a TPM 2.0 chip the whole disk is encrypted (LUKS2, AES-256) with the key sealed in the machine's own TPM, and the encrypted install has been attack-tested against disk theft and boot tampering. Lost or stolen machines are wiped remotely, crypto-erasing the disk on encrypted installs. Optional per-account policy adds lock-screen password rules with a three-strike lockout, Windows-server certificate pinning, USB-storage and clipboard blocking, and memory hardening. New machines can be required to wait for administrator approval (on by default for new accounts), operating-system security patches can roll out through canary machines, and signed kernel updates roll back on their own if they fail to start. It ships as a reproducible ISO with a graphical installer and pairs with a Next.js fleet manager that provisions, monitors, secures and remotely controls the machines and the AWS, Azure and VPS Windows servers they connect to.
Read Full Case Study