Hi! I’m a Software Engineering student from Brazil, and I’m developing SST Hub, a modular workplace health and safety management SaaS.

The project currently uses Next.js App Router, TypeScript, Prisma and PostgreSQL. It includes employee management, daily questions, responses, pending issues, reports and a planned WhatsApp integration.

The project is currently a local MVP and has not yet been deployed to production.

I would especially appreciate feedback on these points:

Is the current separation between UI, services and database access appropriate for a SaaS that may grow over time?
What is the recommended approach for authentication and secure multi-company data isolation?
Where should I implement the future WhatsApp webhook and message-processing flow in a Next.js project?
Are there any important architectural mistakes I should correct before deployment?

GitHub repository:
https://github.com/andreythiagofreis-hub/sst-hub

Thank you for your time and guidance!