Finance Service Hub
A fintech lead-generation and partner-referral platform — a digital bridge between end-users and authorised financial partners (banks, NBFCs, insurers, brokers and mutual fund houses). FSH captures intent, qualifies it, hands it to the right regulated partner, and tracks the sale through to margin and cashback — without ever storing a PAN, an Aadhaar or a bank account number. This document specifies the public site, the Investor portal, the Partner portal and the Super Admin panel.
1Overview & Business Model
1.1 What FSH is
Finance Service Hub is an aggregator. It does not underwrite, lend, advise for a fee, or execute trades. It publishes financial products from authorised partners, captures a qualified lead, and redirects the user to that partner's own regulated journey to complete KYC, payment and issuance. FSH earns on referral margin, and shares part of it back with the customer as cashback.
1.2 Why the model matters technically
Because FSH never completes the financial transaction itself, the platform's regulatory surface stays small. No PAN, Aadhaar, card, CVV, bank account or demat credential is ever collected, transmitted or stored by FSH. The database holds four user fields only — name, mobile, email and tracking IDs — plus the post-sale record a partner or the admin enters. Everything sensitive happens on the partner's domain, under the partner's licence.
1.3 Revenue flow
| Step | What happens | Where |
|---|---|---|
| 1 · Intent | User browses a product window and clicks "Apply Now". | FSH |
| 2 · Identify | Login/registration gate — mobile + email + OTP. A tracking ID and partner code are stamped on the lead. | FSH |
| 3 · Handover | User is redirected to the partner's page with the tracking ID appended. All KYC and payment happen there. | Partner |
| 4 · Confirmation | Partner confirmation email lands in the FSH inbox; a parser extracts policy number, amount and partner and writes a sale row. | FSH |
| 5 · Cooling | 20-day cancellation window runs. Cancelled inside it → margin and cashback both become ₹0. | FSH |
| 6 · Settle | Margin % applied → partner payout queued. Cashback % applied → coupon email fired to the voucher vendor. | FSH |
1.4 In scope / out of scope
In scope: public marketing site with live market ticker; dynamic product windows; OTP registration and login with conditional CAPTCHA; Investor portal with calculators, the paid AI goal planner, and a claims/rewards window; Partner portal scoped by partner code with margin and payout visibility; Super Admin with no-code product and partner management, lead and traffic analytics, margin and cashback controls, and audit logs; email-to-sheet automation; WhatsApp AI bot; a paid training module; and the security programme in Section 19.
Out of scope: executing any financial transaction; storing KYC documents; holding customer funds; portfolio management or SEBI-registered advice; direct policy issuance; and the partners' own onboarding journeys.
2Roles & Personas
The brief evolved during scoping: an early draft described three logins (Investor, Partner, Admin) and a later addendum streamlined to two (Admin, Investor). This document specifies all three, because the partner-code attribution, margin and payout logic described in the brief cannot function without a partner identity. The Partner role can be switched off from Admin on day one if Mukesh prefers to run partner reporting manually — the data model does not change.
| Role | Who they are | What they can do | What they can never do |
|---|---|---|---|
| Visitor | Anonymous traffic. | Browse the site, read products, use the free calculators, watch the ticker. | Apply for anything, see any report. |
| Investor | Registered end-user. Auto-issued ID in the format ID-YYYY-XXXX, linked to their email. | Apply for products, run the AI goal planner (after ₹300), submit claims, track cashback, buy training. | See any other user's data, see margins, see partner payouts. |
| Partner | Bank / NBFC / insurer / broker with a unique Partner Code. | See only leads and sales carrying their own partner code, edit permitted fields on their own rows, see their pending payout. | See other partners' data, change the margin %, change status after admin lock. |
| Sub-Admin | Day-to-day operations staff. | Manage leads, verify claims, respond to support, run reports. | Change margin or cashback %, add/remove admins, view audit-log deletions. |
| Super Admin | Mukesh / platform owner. | Everything: products, partners, margins, cashback %, payouts, targeted reporting, MFA and IP rules, audit log. | — |
3Public Site & Live Market Ticker
3.1 Layout
A single responsive marketing site: utility bar, header with logo and primary navigation, hero with the value proposition and trust badges, the live ticker, the product-window grid, the partner logo wall, and the compliance footer. It must render correctly at 320px, 768px, 1024px and 1440px+.
3.2 The ticker
A horizontally scrolling strip directly under the hero showing live values with the day's change and direction:
Values are pulled by a server-side scheduled job, cached in Redis with a 30–60 second TTL, and served to the browser from FSH's own endpoint. The browser never calls the market data provider directly — that keeps the API key server-side and stops one popular page from burning the quota. If the feed fails, the ticker shows the last good values with a muted "delayed" marker rather than breaking or showing zeros.
3.3 Video & content blocks
A featured "Latest Financial Insights" card links to the YouTube channel, and a content block carries educational articles. Both are admin-editable so Mukesh can swap the featured video without a developer.
4Product Windows & the Login Gate
4.1 Dynamic product windows
Every product on the homepage is a record, not a hard-coded card. Each carries: title, one-line description, long description, icon/image, category, display order, destination partner, redirect URL template, active/hidden flag, and an optional badge ("New", "Offer"). Admin can add, edit, reorder, hide or delete any window and the site updates immediately — no deployment.
The launch catalogue mirrors the approved design: Financial Advisor AI · Recharge & Bill Payments · Insurance Products · Demat, Trading, MF & SIP · Loan Products · Tax Planning & FDs · Tax Filing & Advisory · Bank Assessment & Digital Assets · Vyapar App (Accounting) · Global Investment & Digital Assets · Professional Training · Offers & Rewards. Credit Cards and NPS are added as two further windows.
4.2 The gate
When an un-authenticated visitor clicks "Apply Now" on any window, a modal intercepts the click before navigation. It offers Login or Register, and it remembers the product the user was trying to reach so that after authentication the user is sent straight there — the intent is never lost. Authenticated users skip the modal entirely and go directly to the consent step.
4.3 Consent before handover
Immediately before the redirect, the user sees the partner's name, what will be shared (name, mobile, email only), and an un-ticked communication-consent checkbox. The "Continue to partner" button stays disabled until it is ticked. The consent event — text version, timestamp, IP and user ID — is written to an immutable consent log. This is the record that protects FSH in a DND or mis-selling complaint.
5Registration, OTP & Conditional CAPTCHA
5.1 First-time registration
Fields: full name, mobile number, email ID and a CAPTCHA. On submit, a 6-digit OTP is sent to the mobile (and optionally mirrored to email). On successful verification the account is created, a user ID in the format ID-2026-0001 is generated and permanently bound to the email address, and the session begins.
5.2 Returning login
Mobile or email → OTP. No CAPTCHA on a normal login — it is friction the honest user should not see.
5.3 The 3rd-attempt rule
The system counts consecutive failures per identifier and per IP. On the third consecutive failed login or OTP attempt, a CAPTCHA is injected into the form and must be solved on every subsequent attempt until a success resets the counter. Beyond that, exponential backoff applies and a fixed cap (e.g. 10 OTPs per number per hour) prevents SMS-pumping fraud, which is a real and expensive attack on Indian OTP forms.
5.4 Session & auto-logout
A logged-in session terminates after 15 minutes of true inactivity — no click, scroll, keystroke or navigation. A countdown warning appears at 14 minutes with a "Stay signed in" button. Expiry clears the token client-side and invalidates it server-side, so a copied token is useless. Tokens are short-lived JWTs with refresh; refresh is disabled once the inactivity clock fires.
| Event | Trigger | Result |
|---|---|---|
| Failed attempt 1–2 | Wrong OTP or unknown identifier | Error message, no CAPTCHA |
| Failed attempt 3 | Third consecutive failure | CAPTCHA appears and is required |
| Failed attempt 5+ | Continued failures | Backoff delay, then temporary lock; alert to admin |
| Inactivity 14:00 | No user event | Warning modal with countdown |
| Inactivity 15:00 | No user event | Session destroyed both sides, redirect to login |
6Investor Portal
After login the investor lands on a personal dashboard showing their user ID, their applications and their status, cashback and reward balances with the stage of each, saved calculator runs, purchased training, and support entry points. Navigation follows the order Mukesh specified — Investor Login, Calculators, YouTube, Contact & Support, WhatsApp Support, Partner Login, Admin Login — as a top header on desktop and the identical order in a slide-in drawer on mobile.
7Calculators
Three free calculators, available to visitors and investors, presented as one component with a switcher so the layout and the maths engine are shared:
| Calculator | Inputs | Output |
|---|---|---|
| Loan / EMI | Principal, annual rate, tenure in months | Monthly EMI, total interest, total payable, amortisation summary |
| Mutual Fund / SIP | Monthly SIP or lump sum, expected return %, years | Invested, estimated returns, maturity corpus, year-by-year growth chart |
| RD / FD | Deposit amount, rate, tenure, compounding frequency | Maturity value and interest earned |
Every calculator ends with a contextual call to action into a matching product window — that is what turns a calculator from a utility into a lead source. Results can be saved to the investor's dashboard when logged in.
8AI Financial Goal & Career Planning Calculator
The platform's paid, differentiated feature. A parent enters their own age, their child's name and age, and selects a target career; the engine projects the cost of that career at the time the child will actually reach it, then works backwards to what must be invested today.
8.1 Inputs
Career goals ship with a maintained cost benchmark table — Commercial Pilot, Doctor (MBBS + PG), Engineer (IIT/NIT/private), IAS & Civil Services, Global MBA, Law, Chartered Accountancy, Design, Sports — each with a present-day all-in cost range (tuition, living, coaching, exams) and a typical start age. Admin can edit every benchmark without a developer, which matters because these numbers move every year.
8.2 The maths
Future cost is compounded at a configurable education inflation rate — 8–9% default — over the years until the child reaches the course start age. The required monthly SIP is then solved from the future-value-of-annuity formula at a configurable expected return. The report shows the assumptions on the face of it, because a projection that hides its assumptions is not advice, it is a guess.
8.3 The ₹300 payment gate
The user completes the form and sees a teaser — the goal, the years remaining and a blurred corpus figure. Unlocking the full report costs ₹300.
The report itself is generated server-side and delivered as rendered output. There is no client-side flag that can be flipped in DevTools to reveal a paid report, because the paid content is never sent to an unpaid browser.
8.4 Output
Total corpus required at the target date; the shortfall against current savings; the monthly SIP needed at three return scenarios; a suggested split across mutual funds/SIP, a child plan or endowment, and NPS or long-term pension where the parent's own retirement overlaps; a year-by-year accumulation table; and a clean printable/downloadable PDF summary. Each recommended vehicle links to a matching FSH product window — which is how a ₹300 report becomes a ₹30,000 commission.
9Claims, Rewards & Cashback Window
Not every sale is captured automatically — a customer may buy through a partner link that does not send a parseable confirmation. The claims window lets the investor self-report a purchase and lets the admin verify it before any money is committed.
| Field | Type | Notes |
|---|---|---|
| Product category | Dropdown | Loans · Insurance · Investments · Credit Cards · Demat · NPS · Training |
| Sub-category | Dependent dropdown | Loan → Home / Personal / Car / Business / Education / Gold. Insurance → Health / Life / Motor / Travel / Home. Populated from the category. |
| Policy / account number | Text | Reference only. Not a bank account number — validation rejects anything that looks like one. |
| Total amount | Number | Loan sanctioned amount or policy value. |
| Policy status | Dropdown | Active or Cancelled. |
| Purchase date | Date | Starts the 20-day clock. |
| Proof | File (optional) | Policy PDF or screenshot. Stored encrypted, purged after verification. |
| Submit Claim | Action | Writes to the admin review queue and notifies the investor by email. |
Claim lifecycle: Submitted → Under review → Verified → In cooling period → Eligible → Coupon sent, or Rejected with a reason the investor can see and respond to.
1020-Day Cooling Period & Auto-Close Logic
The single most important rule in the platform, because it protects FSH from paying out on business that later reverses. It runs identically for partner margin and for customer cashback.
11Cashback & Automated Vendor Coupon System
11.1 Admin-controlled rules
Cashback is never hard-coded. The admin sets, per product or per category: the cashback percentage (2%, 3%, 5% or any custom value), a minimum purchase threshold (e.g. only products worth ₹2,000+), an optional cap per transaction, and an effective-from date so a rule change never silently rewrites past transactions.
Cashback amount = eligible purchase value × cashback %, capped at the configured maximum, computed only after the 20-day lock-in clears.
11.2 The vendor coupon trigger
The moment a row turns Eligible, an automated workflow generates a verified reward summary — customer name and masked contact, product, purchase date, transaction value, calculated cashback and a unique coupon reference — and emails it to the third-party voucher vendor. The email is queued, retried on failure, and logged with its message ID so dispatch can be proven.
11.3 Visibility
The same state machine is shown to all three audiences, in their own language:
| Stage | Investor sees | Admin sees |
|---|---|---|
| Pending | "Cooling period — 12 days to go" | Row with countdown and cancel-risk flag |
| Verified | "Eligible — ₹640 cashback confirmed" | Amount locked, dispatch queued |
| Email sent | "Coupon issued — check your email" | Vendor, message ID, timestamp |
| Cancelled | "Policy cancelled — not eligible" | ₹0, excluded from payables, reason logged |
12Partner Portal, Margins & Payouts
12.1 Partner login
Each partner receives a unique Partner Code and credentials. Every query the partner portal makes is filtered server-side by that code — a partner cannot see, guess or enumerate another partner's rows even by editing an ID in a URL.
12.2 Partner dashboard fields
Partners have limited edit rights: they may correct a policy number or update a status on their own rows until the row is locked by the admin at payout time. Every edit is versioned and attributed — the previous value is never destroyed.
12.3 Margin calculation
The admin sets a margin percentage per product, per partner, or per product-partner pair. The system computes margin amount = total amount × margin % automatically the moment a row is created or its value is edited, and recomputes on any change. Cancelled-inside-20-days rows compute to ₹0 and drop out of the payable total.
The payout summary shows, per partner: total eligible sales, gross margin, deductions from cancelled rows, amount already paid, and net payable now — with an export for the accountant.
13Super Admin Panel
Reached at a custom, non-obvious URL path, protected by MFA and IP allow-listing, and never linked from the public site.
14Email Automation & Sheets Synchronisation
When a partner confirms a sale, the confirmation email arrives in a dedicated FSH inbox. A parser — Make.com, a Google Apps Script, or a native Java IMAP worker — extracts customer name, product, company, policy number, amount and date, and appends a row to the master store.
Unparseable emails go to an admin exception queue rather than being dropped, so no sale is ever lost silently. Each parsed row is deduplicated on policy number so a forwarded or resent confirmation cannot create a double payout.
15AI WhatsApp Bot
Built on the WhatsApp Business Platform (Cloud API) with a verified business number and Meta-approved message templates.
16Training Products & Paid Courses
A dedicated training section listing professional finance, investment, trading and business-skills courses. Each course carries its own price — ₹300 or course-specific — its own Razorpay order, and the identical webhook-verified access model as the AI planner: no verified server-side payment, no content. Content is served through expiring signed URLs so a link copied out of the browser dies quickly, and access is bound to the purchasing account.
Admin sees enrolments, revenue per course, and completion where the content format supports it.
17Navigation & Responsive Behaviour
Navigation order is fixed and identical on both breakpoints, exactly as specified:
Desktop (≥1024px): a top header carrying the full order left to right. Tablet and mobile (<1024px): a hamburger opening a slide-in drawer with the same order top to bottom, focus-trapped, dismissible by backdrop tap, swipe or Escape. Touch targets are at least 44×44px and the ticker becomes a swipeable strip.
18Compliance, Footer & Consent
The footer is a compliance surface, not decoration. It carries, on every page:
The un-ticked communication-consent checkbox appears before every form submission that results in data leaving FSH, and the consent version, timestamp and IP are logged permanently.
19Security Architecture
19.1 Transport, edge and infrastructure
19.2 Application & data
19.3 Admin hardening
Custom hidden admin path; mandatory MFA (TOTP) for every admin and sub-admin; IP allow-listing; separate session policy with a shorter idle timeout; append-only audit logs recording actor, action, before/after values, timestamp and IP; and alerting on privilege changes, margin or cashback edits and bulk exports.
19.4 Backup & recovery
Automated encrypted off-site backups — daily incremental, weekly full — with a defined retention window and a documented, tested restore. An untested backup is not a backup; we will run a restore drill before handover and record the RPO and RTO actually achieved.
19.5 VAPT
An independent agency performs a Vulnerability Assessment and Penetration Test before public launch. We remediate findings and support the re-test. The audit is commissioned from and billed by the third-party agency; our scope is remediation and re-test support, and launch is gated on a clean report.
20Non-Functional Requirements & Status Models
20.1 Status models
Lead: Captured → Consented → Redirected → Converted / Dropped / Rejected.
Sale: Recorded → In cooling (0–20 days) → Verified / Cancelled → Margin locked → Payout queued → Paid.
Cashback: Pending → Eligible → Coupon generated → Email sent to vendor → Redeemed / Not eligible.
Claim: Submitted → Under review → Verified / Rejected → Merged into the sale record.
Training: Listed → Order created → Payment verified → Access granted → Revoked (refund).