# Gravixar > The AI-ops platform that runs your operations, with a human on every approval. Gravixar is an AI-ops platform built by Qamar: productized modules (portals, intake wizards, content agents) that run operations with a human approving every write. Today it ships as high-touch custom builds, several of them carrying a client's daily operations in production, plus ongoing retainers that keep shipped systems running. A hosted version of the same modules, rented by the month, does not exist yet and carries no announced date; there is a waitlist. Every module has a working version live somewhere: on this site, at demo.gravixar.com, or in a client's production stack, open to use before pricing comes up. 5 live demo scenes at demo.gravixar.com, no sign-in. ## Core pages - [Home](https://gravixar.com/): The positioning, the approval loop every module runs on, the live demo scenes, the integration surface behind them, and the services menu - [About](https://gravixar.com/about): Who Qamar is, how engagements run, and the numbers behind the operations stack he works from - [Services](https://gravixar.com/services): 6 services on 3 tracks. Projects with an end: Operations Infrastructure, AI Tooling & Automations, Brand & Visuals. Ongoing engagements, kept honest after a build ships: Fractional AI Ops Lead, System Audit. Managed retainers, kept running month to month: Managed Services. - [Modules](https://gravixar.com/modules): The reusable production-tested patterns behind the builds, grouped by category, each naming where it runs today - [Work](https://gravixar.com/work): Case studies of shipped systems: the problem, the approach, the outcome, and the parts that broke - [Compare](https://gravixar.com/compare): Off-the-shelf vs custom honest reads, each naming who should pick the SaaS, who should go custom, and an FAQ block - [Demos](https://gravixar.com/demos): The live demo scenes, one per buyer, with what to try in each - [Graphics](https://gravixar.com/graphics): 2 visual pieces, each carrying a required origin label (client work, self-directed, or concept) so provenance is stated rather than implied - [Blog](https://gravixar.com/blog): Field notes on agency operations, delivery process, and keeping AI in the loop. Some posts are drafted by the SEO agent running on this site, flagged as such on the post, and published only when a human promotes the file - [Careers](https://gravixar.com/careers): Current openings, published from the same hiring system Qamar runs internally, each role page carrying JobPosting structured data and its own apply form - [Contact](https://gravixar.com/contact): Lead form plus in-house 30-minute call booking (email-verified code, reusable Google Meet room, calendar invite) - [Early access](https://gravixar.com/early-access): Waitlist for the module library. The modules are real and running in production inside builds; a hosted account where you rent one by the month does not exist yet, and the page prints no date ## Services - [Operations Infrastructure](https://gravixar.com/services/operations-infrastructure): Custom portals, internal tools, websites, and the people-ops layer that holds them together. The system that runs your business. Not a Notion template. - [AI Tooling & Automations](https://gravixar.com/services/ai-tooling): AI agents and automations threaded into the systems you already run. Human-in-the-loop where it matters, no auto-publish surprises, no vendor lock-in. - [Brand & Visuals](https://gravixar.com/services/brand-visuals): Identity, motion, video, Amazon A+, marketing collateral. Design quality is itself a sales tool. Most of my clients had a brand. They wanted theirs to look made on purpose. - [Fractional AI Ops Lead](https://gravixar.com/services/fractional-ai-ops-lead): The retainer that starts where a build ends. Your AI systems kept honest, audited every month, extended every quarter. The named successor to a project, not a product you bolt on. - [System Audit](https://gravixar.com/services/system-audit): A fleet of agents hunts findings in your codebase in parallel lanes, then a second pass tries to kill each one. Only the survivors reach you, ranked, with the reasoning attached. - [Managed Services](https://gravixar.com/services/managed-services): WordPress management, hosting, email, updates, backups, and the small change you asked for on Tuesday being live on Tuesday. Invisible when it is done right. ## Case studies (shipped systems, live or handed off) - [A driving school booking PWA, with the school's rules built into the model](https://gravixar.com/work/driving-school-booking-pwa): A mobile-first PWA for a women-only driving school in Pakistan, live the day it was built. Eligibility and guardian rules derive from date of birth, a slot is offered only when one instructor covers every lesson day, and payment verification is manual because that is how students pay. - [A live agency operating system, running a real agency's day-to-day](https://gravixar.com/work/agency-operations-platform): A multi-team operating system for a marketing and creative agency. Account managers run their books, clients review and approve deliverables in a scoped portal, finance runs invoicing and commissions, and the team's leave and WFH live in the same place. Live, used every day. - [A motion-design portfolio site, built then handed off](https://gravixar.com/work/motion-design-portfolio): A public portfolio site for a motion-design studio. Built to show their work at the quality their work deserves, then handed off so the client fully owns and runs the infrastructure. Delivered and live. - [Healthcare credentialing and finance platform, live with 2,042 payer panels](https://gravixar.com/work/beeline): Healthcare operations platform, live on the client's own domain since June 2026 with 250 clients and 2,042 credentialing panels. One identity and audit boundary across staff, ops admin, and external-payer surfaces. HIPAA-aware wrapper on every Claude call, and a reproducible multi-currency finance engine. - [LucidLink + Wasabi for a creative agency, replacing Dropbox with a streaming file system that survives event delivery](https://gravixar.com/work/lucidlink-wasabi): Replaced a Dropbox + local-disk workflow with LucidLink Filespaces (streaming active storage) backed by Wasabi (low-cost archive). Editors start work instantly from any machine. Adoption hit 80%+ of event delivery and survived the worst part of event production: live-handoff under deadline. - [monday.com rollout for a creative agency, from Slack chaos to a delivery system that scaled 5x](https://gravixar.com/work/monday-rollout-agency): I joined a creative agency to set up the Islamabad office from scratch. The team was running tasks through Slack and WhatsApp, which worked at 10 people and broke at 30. I evaluated tools, picked monday.com, and rolled it out in phases. The team grew past 50 users with clear ownership and predictable delivery. - [Digital agency portal, end-to-end delivery with AI in the loop](https://gravixar.com/work/bs-hub): Took a digital agency from email/Notion/Drive sprawl to a single AI-augmented portal: adaptive intake wizard, 12-state delivery funnel, role-aware project workspace with review state machine, compliance-grade audit log, daily security-watch cron. Code recount, July 2026: 84 Prisma models, 255 endpoints, 9 crons. ## Comparisons - [Function Point vs a custom agency portal: where the seams show up](https://gravixar.com/compare/function-point-vs-custom): Function Point is one of the more opinionated agency PM tools, a strong fit for agencies whose shape matches the opinion. Most agencies discover the mismatch about four months in. Here's where the seams show up and what custom actually solves. - [Karbon vs a custom workflow for boutique accounting firms](https://gravixar.com/compare/karbon-vs-custom): Karbon is the strongest accounting practice management tool I'd recommend. It's also priced and shaped for firms that have already standardized. Boutique firms (10 to 30 people, owner-operated) keep finding friction in the same three places. Here's where Karbon wins and where custom makes more sense. - [monday.com vs a custom portal: when the boards stop scaling](https://gravixar.com/compare/monday-com-vs-custom): monday.com is excellent at being a flexible board layer. It's also the tool I most often help clients extend, then eventually move off when their workflow grows past what boards can model cleanly. Here's the line where monday.com is the right answer and where a custom portal is the cheaper long-term call. - [Notion vs a custom portal: where agencies outgrow it](https://gravixar.com/compare/notion-vs-custom): Notion is fine until you bill clients. The moment your client experience matters (review handoffs, sign-off audit, branded surfaces), Notion's model starts costing you in ways that don't show up on the invoice. Here's the line where the off-the-shelf wiki turns into the wrong tool, and what to replace it with. - [Productive.io vs a custom client portal: a real cost breakdown for agencies](https://gravixar.com/compare/productive-io-vs-custom): Productive.io is fine if you can fit your delivery shape into theirs. The trap is the parts that look configurable but aren't, the parts you don't realize are missing until month four. Here's an honest read on when off-the-shelf wins and when a custom portal is the cheaper long-term call. ## Modules (reusable patterns) - [Identity & Auth](https://gravixar.com/modules/identity-auth): NextAuth v5 JWT credentials with the security defaults that should be standard but usually aren't: lockout, breach-list password check, anti-enumeration, invite-only signup. - [Role hierarchy + permission guards](https://gravixar.com/modules/role-permissions): STAFF < TEAM_LEAD < MANAGER < ADMIN role ladder plus an isSuperAdmin tier, with requireAuth, requireRole, requireSuperAdmin, and target-guard helpers that make permission errors loud and uniform. - [Audit log + safe-restore](https://gravixar.com/modules/audit-log-restore): Two-tier retention (CONTRACT 7y / OPERATIONAL 1y) audit log with allowlist-gated one-click restore on UPDATE rows. Compliance teams stop arguing once the policy lives in code. - [Review state machine](https://gravixar.com/modules/review-state-machine): DRAFT → SUBMITTED_FOR_INTERNAL → INTERNAL_APPROVED → SUBMITTED_FOR_CLIENT → CLIENT_APPROVED with a CLIENT_REVISION_REQUESTED branch back into the loop. Every transition is a function with explicit preconditions and side-effects. - [AI intake wizard](https://gravixar.com/modules/ai-intake-wizard): Adaptive client intake using Claude. Asks 4-7 questions tuned to the prospect's stated context, fetches their public site, generates a brand brief the PM walks into the discovery call already holding. - [HIPAA-aware AI guardrail](https://gravixar.com/modules/hipaa-ai-guardrail): Two independent defenses on every Claude call: a PHI sniffer regex that blocks free-text PHI pre-persistence, and a wrapper that prepends a stop-clause to every system prompt. Direct AI SDK imports outside the wrapper are bugs by convention. - [Multi-currency finance core](https://gravixar.com/modules/multi-currency-finance): Every monetary row stores native amount + native currency + an FxRateSnapshot foreign key. Reports compute against the snapshot, never live FX. A regenerated report from yesterday matches the original row-for-row. - [FBR + EOBI tax engine](https://gravixar.com/modules/fbr-tax-engine): Property-tested salary engine for Pakistan's FBR slabs and EOBI rates. Forward Gross→Net + bisection Net→Gross solver. 17 of 17 vitest property tests green, decimal.js precision throughout. - [Credentials tracker with AI reminders](https://gravixar.com/modules/credentials-tracker): NPI / state license / DEA / board cert / CAQH / UK GMC / other, with 90/60/30/7-day expiry windows + already-expired bucket. AI-generated reminder copy via the HIPAA-aware wrapper. Dedup log prevents double-fires. - [Leave management with atomic balance updates](https://gravixar.com/modules/leave-management): Annual / sick / unpaid / parental / bereavement leave with pro-rated entitlements for new joiners, manager approve/decline state machine, and balance updates that run inside a Prisma transaction so balances can't desync. - [Daily check-in (Office / WFH / Field)](https://gravixar.com/modules/daily-checkin): Auto-prompts on the first portal pageview each calendar day (timezone-locked, not UTC). Manager+ team view with a 4-pill summary. Unique constraint enforces one status per day per user, idempotent on resubmit. - [Daily security-watch cron](https://gravixar.com/modules/security-watch-cron): Sweeps the audit log nightly for anomalies (mass-signup spikes, DELETE bursts, lockout cascades, classifier blackouts, stuck inquiries) and emails admins when something trips. Quiet when nothing is wrong. - [Shared core package](https://gravixar.com/modules/shared-core-package): The reused parts are a private, versioned npm package, not a folder someone copies. One source for the shared modules, auth and 2FA the flagship among them, propagated by a dependency bump rather than a copy. ## Live demo - [demo.gravixar.com](https://demo.gravixar.com): 5 live scenes, one per buyer, showing the operations and AI patterns Qamar builds. No sign-in, no accounts, no persona login: every scene opens straight into working software with its own brand and sample data. These are purpose-built playground scenes in their own codebase, not the client production systems they echo. Scenes: - Agency OS (Lattice), for agencies: The operating system a real agency runs on. Deliverable review, invoicing, commissions, and leave, all gated. - Agent Console (Studio Mix), for ops & technical teams: A supervised AI-agent console on the Claude API. Drafting, screening, and triage, every write behind a human gate. - Founder Cockpit (Driftwood), for founders & small teams: A run-the-business cockpit for a solo founder. Inbox triage, today's priorities, and cash flow, in one view. - Brand Guardian (Northbeam), for brands & DTC: A brand agent for a DTC team. Brief, on-brand draft, you approve, it learns the rule. - Billing & Credentialing (Care Ledger), for healthcare & billing: A medical billing & credentialing portal. Credential a provider, enable billing, close the clinic deal.