The Problem
Across Pakistan, the Gulf, and most emerging markets, small and mid-sized businesses don't sell over email or a web form. They sell over WhatsApp. A clinic confirms an appointment on WhatsApp. A car-rental desk quotes a daily rate on WhatsApp. A travel agent sends an Umrah package as a PDF on WhatsApp. The entire pipeline lives in one person's chat list.
Then the business grows, and that chat list breaks. Leads get missed because two agents reply to the same thread. Nobody knows which deals are open. The owner can't see a pipeline, can't run a broadcast, can't tell whether last month's ad spend actually converted.
The CRMs that exist to fix this treat WhatsApp as a bolt-on afterthought, and they speak in generic "Contacts / Deals / Leads" that mean nothing to a salon or a property agency. RaabtaHQ is built the other way around: WhatsApp is the first-class channel, and the whole product reshapes itself to each industry's vocabulary and workflow.
What I Built
RaabtaHQ is a self-hostable, multi-tenant CRM on Next.js 16 and Supabase, talking directly to the Meta WhatsApp Cloud API — plus Messenger, Instagram DM, and an embeddable website chat widget. Every account is account_id-scoped with Postgres Row-Level Security, so one deployment safely serves many businesses.
The shared CRM core is what every account gets:
- Unified inbox — a real-time, three-pane team messaging workspace over Supabase Realtime. All four channels land in one place, each conversation carrying a 24-hour session-window countdown, emoji reactions, quote-replies, inline media, voice notes recorded in-browser, WhatsApp template sending, and an AI/human ownership pill so an agent can take over any thread.
- Contacts, Pipelines, Broadcasts — a deduped contact database with custom fields and CSV import; a drag-and-drop Kanban deal board with weighted pipeline value; and a 4-step broadcast wizard for bulk template sends with live delivery/read-rate tracking.
- Reviews (ORM) — a reputation suite that requests reviews, runs a gated rating funnel, and routes happy customers to Google/Facebook/Trustpilot while capturing unhappy feedback privately.
- AI Assistant — an autonomous, per-channel LLM agent (covered below).
On top of that shared core sits the niche system: during onboarding an account picks a vertical, which relabels shared entities (Contacts become Patients / Renters / Guests / Travelers), injects vertical-specific pages into the nav, seeds bespoke Postgres tables and starter data, and exposes an industry-specific AI tool group. Five verticals ship today — Aesthetics Clinic, Car Rental, Beauty Salon, Real Estate, and Travel & Tourism — each with its own booking entity, calendar, and automation set.
The autonomous AI engine
The part I'm most proud of is the assistant layer. Every inbound message — from any of the four channels — dispatches through a strict precedence order into a durable, tick-based engine built on the Vercel AI SDK. It executes exactly one bounded step per tick and persists everything, so a run survives restarts, self-heals via a cron sweeper if a dispatch is lost, and is bounded by a step cap, per-run timeout, and cost ceiling.
- 01TriggerInbound message arrives
WhatsApp, Messenger, Instagram, or website chat. The WhatsApp webhook is HMAC-verified on raw bytes, acked immediately, then processed in a background callback.
- 02DecisionOwnership gate
If a human owns the conversation, the AI stands down entirely. Humans always win.
- 03DecisionResume or absorb?
If a run is already waiting on this conversation it resumes (bypassing the schedule gate so an in-flight chat finishes off-hours); if a run is active, the new message is absorbed into it.
- 04StepResolve + start
Otherwise, find the assistant bound to the channel and check its working hours — then either start a run or flip the conversation to the Needs-attention queue.
- 05OutputOne durable step per tick
Claim run → budget gate → re-check ownership → guardrail gate → one model step with the assistant's tools → persist → decide next state → self-dispatch. The first tick runs inline in the webhook for a fast first reply.
cron sweeper heals lost dispatches
The assistant's power comes from built-in tools that expose the CRM's own capabilities to the model — Messaging, Contacts, Deals, Broadcasts, Reviews, plus one tool group per niche. But every tool is gated three ways: each declares a sensitivity (read / write / critical), a minimum role, and an autonomousAllowed flag. The toolset actually handed to the model is the intersection of enabled-for-this-assistant AND permitted-for-the-role AND autonomous-allowed AND on-niche — and every tool re-filters by account_id.
Where it's at
RaabtaHQ is my current focus. The shared CRM core and all five verticals are built and running: the unified realtime inbox, pipelines, broadcasts, the reputation suite, and the autonomous AI engine with per-account encrypted provider keys (Anthropic, Google, OpenAI), a monthly USD AI budget with hard 402 cut-offs, SSRF-guarded custom HTTP connectors, an account-level agent memory store, a public REST API, and a SuperAdmin portal for platform operators with impersonation and per-account limits.
It's deliberately self-hostable and multi-tenant from day one — a single deployment can run a whole book of businesses, each isolated by RLS, each speaking its own industry's language. The bet is simple: the next generation of CRMs won't be forms and dashboards you log into. They'll be an AI that lives in the channel your customers already use, and a human team that steps in exactly when it should.