UMKM Unggul Indonesia · Founder project · SaaS
UMKM Unggul Indonesia: enterprise-grade financial controls for Indonesian SMEs
Most Indonesian small businesses still record sales in notebooks. I founded UMKM Unggul Indonesia to put every digital tool a small business needs on one platform. Its first product, Kasir Unggul, is a multi-branch point-of-sale system that runs on any phone, tablet or laptop. I built it alone, from research to production, through AI-native development.
- Role
- Founder and sole full-stack developer
- Status
- Live in production
- Market
- Indonesian micro and small businesses
- Method
- AI-native development (vibe coding) with AI coding agents
- Compliance
- UU PDP No. 27/2022 (Indonesian data protection law)
At a glance
Outcomes
Live and free to start
Owners sign up, get a working store instantly and can sell the same day on devices they already own.
Corporate controls for small shops
Stock ledgers, blind cash counts, approvals and audit trails protect owners from fraud and honest staff from blame.
Security in the database
Every business's data is isolated at database level, and critical rules cannot be bypassed from the browser.
Delivered by one developer
Vibe coding with strict guardrails let one person ship a production SaaS that would normally need a team.
Context
The problem
Stock never matches, cash drawers come up short without a trace, and owners cannot see which products make money. Point-of-sale systems that solve this are usually expensive, complex and need special hardware.
The product
Kasir Unggul brings corporate POS controls (a stock ledger, blind cash counts, approval flows and a tamper-evident audit trail) to small shops, with no installation and no credit card.
Built with vibe coding, held to engineering standards
I build with an AI coding agent as a development partner. I describe the outcome, the constraints and the acceptance criteria; the agent drafts the code, tests and database migrations; I review, test and ship. Through the Model Context Protocol, the agent works with current library documentation and the live database schema.
Speed comes from the AI and quality comes from the guardrails. Written rules for the agent (Definition of Done, security rules, conventions) live in the repository, security-sensitive code is reviewed by hand, a pre-commit hook blocks any change that fails type checks, linting or tests, and every database change passes staging before production.
What the product does
Cashier screen
Barcode-ready checkout with discounts, VAT and payment by cash, QRIS, transfer or delivery platforms; receipts by WhatsApp or Bluetooth printer.
Works on any device, no special hardware.
Cash reconciliation
Blind closing count: the cashier enters the physical cash without seeing the expected figure, and any difference alerts the owner.
Every rupiah is accounted for per shift.
Inventory and warehouse
Append-only stock ledger, stock counts, goods receipts, wastage and three-step transfers between branches.
Stock always matches reality.
Approvals and audit
Approval flows with segregation of duties, daily closing reports and a hash-chained audit log with a verifier.
Owners can trust the numbers remotely.
Dashboards and reports
Revenue, gross profit, payment mix, best sellers and cashier performance, per branch or consolidated.
Business health on one screen.
Multi-branch and roles
Owner, manager and cashier roles with granular permissions; cost prices are never sent to cashier sessions.
Grows from one branch to many.
Security, privacy and compliance
- Tenant isolation. Row-level security on all 65 tables, verified with forged-JWT attack tests; six cross-tenant vulnerabilities were found and closed before they could be exploited.
- Access control. Role-based access control with 19 granular permissions and segregation of duties: nobody can approve their own void, refund or price change.
- Data integrity. Atomic PostgreSQL transactions with row and advisory locks, append-only ledgers and a SHA-256 hash-chained audit log with a verifier.
- UU PDP No. 27/2022 compliance. A Record of Processing Activities generated from the schema, data subject rights, versioned consent, automatic anonymisation and a signed DPA for cross-border transfers.
- Privacy by design. Security logs store HMAC pseudonyms instead of emails or IP addresses, account lookups resist enumeration, and CSV exports are protected against formula injection.
- Hardened operations. Rate limiting, server-only secrets, private storage with short-lived signed URLs, gated staging-to-production migrations and rehearsed backup restores.
Business model
Freemium SaaS with fair plan changes and payment by bank transfer or QRIS, without a credit card.
Free
Rp0
1 branch · 2 users
Basic
Rp33,000/mo
1 branch · 4 users
Pro
Rp99,000/mo
3 branches · 12 users
Business
Rp299,000/mo
10 branches · 40 users
Enterprise
Custom
Unlimited