Halal Audit Platform: From Audit Request to Issued Certificate in One System
A nine-stage audit workflow, SharePoint document control and automatic certificate generation, built for Halal Certification Services
Published · Updated
Client
Halal Certification Services
Timeline
19 weeks
Technology
WORKFLOW AUTOMATION
9
audit stages tracked from request to issued certificate
2
certificate PDFs generated automatically for every completed audit
18
email templates sent automatically at workflow steps
19 weeks
from first commit to automated deployment on AWS EC2
The challenge
Each audit passes through company onboarding, auditor scheduling, reports, non-compliance findings and certificate issue, handled by six staff roles and the company itself, and every certificate has to list the right products by name and material code
The solution
A Next.js and PostgreSQL platform that tracks each audit through nine stages, stores every document in HCS's SharePoint library, scopes access by role, emails the right people at each step and generates product and production site certificates from the master table
The results
- 9 audit stages tracked from request to issued certificate
- 2 certificate PDFs generated automatically for every completed audit
- 18 email templates sent automatically at workflow steps
- 19 weeks from first commit to automated deployment on AWS EC2
- 7 user roles, each with its own scoped access
A Halal Certificate Is Only as Good as the Audit Trail Behind It
Halal Certification Services (HCS) certifies manufacturers' products and production sites. Every certificate it issues is a statement that a specific site, and a specific list of products, passed a halal audit. That statement rests on a long chain of work: company onboarding and verification documents, an audit request, auditor availability and selection, the audit itself, an audit report, any non-compliance report, technical and certification review, and only then the certificate.
Each step in that chain belongs to a different person, across two organisations. HCS runs six staff roles (super admin, admin, finance manager, certification manager, technical manager and auditor), and the certified company has its own users. They each need a different view: an auditor should only see the documents released to them, and a company should only see its own audits. A certification body also has to be able to show who approved what, and when. Any step that lives in someone's inbox is a step nobody else can see or prove.
The certificate is the step where a mistake costs the most. A Halal Product Certificate lists every certified material by name and unique material code, taken from the Excel master table the company submits. Copying those rows into a certificate by hand is slow, and one mistyped code puts a product on a certificate it was never audited for.
Certification also does not end when the certificate is issued. Companies add products and change suppliers, and each change has to be reviewed against the audit that is already on file.
5 capabilities carried the build
Build one platform that carries a halal audit from company onboarding to an issued certificate, used by HCS staff, auditors and certified companies, with every document stored in HCS's existing SharePoint library and every certificate generated from the data the company submitted, not retyped.
01
Company onboarding and verification
Companies register and upload verification documents such as a business licence, proof of address, share certificates and insurance certificates. HCS staff approve or reject the onboarding, and the decision, with a comment on rejection, is emailed back to the company.
02
Audit workflow
A nine-stage audit lifecycle covering request, approval or rejection with a mandatory reason, hand-off to auditors, auditor availability and selection, document submission, audit report, non-compliance report and completion. Each transition is checked against the user's role and emails the company users and auditors involved.
03
Document control on SharePoint
Every file is uploaded to HCS's SharePoint library through Microsoft Graph, filed by company and audit. Staff decide per document whether auditors can see it, and admins manage the document types and the file extensions each one accepts.
04
Certificate generation
When an audit is completed, the platform reads the Product table sheet from the company's Excel master table, renders a Halal Product Certificate and a Halal Production Site Certificate as PDFs with Puppeteer, stores both in SharePoint and attaches them to the audit. Batch certificates follow their own approve or reject flow with an editable product table.
05
Roles, permissions and change requests
Six staff roles plus company users, route-level and module-level permissions managed from an admin screen, invitation-based user onboarding, and a review queue for supplier changes and product additions after certification.
The stack behind it
Next.js, TypeScript, Prisma, PostgreSQL, Microsoft Graph (SharePoint), Puppeteer, AWS EC2
AWS
PostgreSQLApplication
Next.js 14 App Router with React 18 and TypeScript, serving both the dashboard screens and 32 API route handlers from one codebase
Data
PostgreSQL with Prisma ORM; 14 models covering companies, audits, documents, certificates, change requests, auditor availability and permissions, evolved through 56 migrations
Documents and Certificates
Microsoft Graph API with MSAL client-credential auth for SharePoint storage; SheetJS (xlsx) to read master tables; Puppeteer to render certificate PDFs; Handsontable for the batch certificate product table
Access Control
JWT sessions with bcrypt-hashed passwords, password reset and email verification, plus middleware that checks each route against the user's roles and module permissions
Interface
Tailwind CSS with Radix UI components, TanStack Table for data grids, React Hook Form with Zod validation, Redux Toolkit for client state and Recharts for the admin dashboard
Operations
Nodemailer for transactional email, Better Stack (Logtail) for logging, Swagger API documentation, and a GitHub Actions pipeline that deploys every push to main onto AWS EC2
Our development process
Weeks 1 to 5
Foundations and Access Control
We set up the Next.js and Prisma codebase, replaced the initial Clerk sign-in with JWT and bcrypt password auth, added Swagger API documentation, email verification, invitations, the roles and permissions model, and Better Stack logging.
Weeks 6 to 9
Documents and the Audit Flow
Document types became configurable, uploads went to SharePoint through Microsoft Graph, and the core audit flow shipped with auditor availability, auditor selection, the company signup form, the master table viewer and summary complaints.
Weeks 10 to 14
Reports, Changes and Certificates
We added audit summaries, non-compliance reports, change requests for supplier changes and product additions, and generation of product and production site certificate PDFs from the Excel master table.
Weeks 15 to 21
Batch Certificates and Deployment
Audit requests and batch certificates with their own approval flow, and a GitHub Actions pipeline deploying to AWS EC2.
Transparency
Every figure on this page is measured by EdgeFirm from the project's git history, database schema and source code. HCS has not shared operational figures such as audit turnaround time, so none are quoted here.
After launch
After the deployment pipeline went in, work moved to hardening: rules on when an auditor can be removed from an audit in April 2025, a naming cleanup and tablet and mobile layouts for every dashboard screen in May 2025, an email notification when a company submits a document, a round of bug fixes, and a reworked master table upload in July 2025.
What changed after launch
9 Audit Stages in One System
Every audit moves through the same tracked stages, from pending to completed, and each change of stage is tied to a role that is allowed to make it. Rejections cannot be saved without a reason. Measured by EdgeFirm from the platform's audit status handling.
2 Certificates Generated on Completion
Marking an audit complete produces the Halal Product Certificate and the Halal Production Site Certificate as PDFs, built from the company's own master table and filed in SharePoint against the audit. Product names and material codes are read from the spreadsheet, not retyped.
18 Automated Notifications
Companies, auditors and staff are emailed when an audit is created, approved, rejected, handed to auditors, assigned, reported on, flagged for non-compliance or completed, and when onboarding, documents and summary complaints are decided. Measured by EdgeFirm from the platform's email templates.
7 Roles With Scoped Access
Six HCS staff roles and company users each see only their part of the work. Auditors only see documents staff have released to them, and companies only see their own audits.
19 Weeks to an Automated Deployment Pipeline
From the first commit on 18 November 2024 to a GitHub Actions pipeline deploying to AWS EC2 on 2 April 2025, across 71 merged pull requests. Measured by EdgeFirm from the git history.
HCS now runs its audits in one place. A company onboards and uploads its documents, staff approve the request and hand it to auditors, the chosen auditor reports, any non-compliance is recorded, and completing the audit produces both certificates from the company's own master table, filed in SharePoint and announced by email. Every step is tied to a role and every document to an audit, which is the record a certification body needs when it is asked to show how a certificate was earned.
More case studies
Get AI live in months, not years.
Book a 30-minute strategy call with the founders who will write your code.
