Relayot.
Relayot answers inbound messages with rules or AI, collects structured data through WhatsApp Flows and hosted web forms, runs campaigns against dynamic segments, and streams everything back into your own systems through signed webhooks and a REST API. Multi-tenant, Turkish-first, honest by default.
Every WhatsApp automation demo shows the same happy path — a bot answering a canned FAQ.
Every WhatsApp automation demo shows the same happy path — a bot answering a canned FAQ. The messy parts nobody demos: what happens when the AI makes something up, when a campaign accidentally sends 40k identical messages, when a tenant's Meta connection silently drops at 3 a.m., when GDPR/KVKK asks you to export or delete every conversation for one contact.
Relayot's remit was to build a platform where those failure modes are surfaced, not hidden. AI replies with knowledge-base grounding and monthly budget guards. Campaigns with atomic single-send guarantees. Multi-tenant isolation strict enough that the audit log is real evidence, not marketing text.
The engine (Fastify + Prisma on Postgres) is the safety layer: every row is tenant-scoped, secrets are AES-256-GCM encrypted at rest, per-tenant API keys are hashed with SHA-256, and Redis coordinates rate limits and single-leader jobs across replicas. 1500+ tests + Playwright E2E on every merge.
AI replies use a purpose-built RAG stack: BM25 + embeddings (OpenAI & Gemini) over a per-tenant knowledge base, an AI Tools registry so the model can call your own HTTP endpoints in a controlled way, and monthly budget guards that hard-stop when a tenant hits their ceiling. Anthropic, OpenAI, and Google models are all first-class.
The dashboard (Next.js 16 + React 19 + Tailwind v4) is the operator UX: a Turkish-first inbox with real-time SSE updates, a visual WhatsApp Flow builder with phone preview and hosted web form fallback, dynamic segment counting live against the CRM, a campaign builder with an atomic-lock so a scheduling accident can't fire twice.
Honesty principle throughout: if a channel isn't connected, the UI says so. If a message hasn't been delivered, it never claims it has. GDPR/KVKK export and deletion are built-in — not a support ticket workflow.
Relayot shipped as a production platform: Meta WhatsApp Business embedded signup, email via Resend, SMS via Twilio & Netgsm, /v1 REST API with per-tenant keys, signed webhooks (7 event types), analytics computed from real data, and admin surfaces for users, roles, audit log and GDPR exports.
The scale story: horizontal scaling via Redis-backed rate limits + Postgres-lease scheduler, standalone Docker images for engine + dashboard, and 1500+ tests running on every CI build. The platform can host new tenants without touching the deployment.