HeyCaly’s Tech Stack: Why a WordPress Agency Chose a Modern SaaS Architecture

We have “WP” in our name. We started with WordPress, grew with WordPress, and we still love WordPress. But when we decided to build a product — a real SaaS with real-time AI conversations, WhatsApp integration, and calendar synchronization — we knew exactly where WordPress’s limits end.

In this article, we break down HeyCaly‘s technical infrastructure, why we chose each technology, and how we made these decisions as a WordPress agency. Our goal isn’t just to present a technology list; it’s to answer the “why” behind every decision.

What Does HeyCaly Do?

HeyCaly is a SaaS platform that helps appointment-based businesses (hair salons, clinics, gyms, spas, veterinary clinics, dental practices) re-engage past customers through AI-powered WhatsApp conversations. It detects empty appointment slots, sends personalized WhatsApp messages to the right customer at the right time, and automatically books the appointment into their calendar.

In short: an AI-powered customer re-engagement assistant.

“Service businesses leave 20-40% of their appointments empty every week. HeyCaly intelligently fills those gaps.”

Why Not WordPress?

Let’s be clear first: WordPress is not a bad technology. We still actively use it in our projects. WooCommerce stores, corporate websites, multilingual content platforms — WordPress is still excellent for these.

But HeyCaly is a different beast:

• Real-time WhatsApp messaging — webhooks must be processed within milliseconds
• AI conversation engine — context loading, prompt building, response generation for every message
• 27 background jobs — campaign scheduling, calendar syncs, reminders
• Multiple integrations — Google Calendar, Outlook, Stripe, WhatsApp Business API
• Multi-tenant architecture — hundreds of businesses on the same infrastructure, data isolation is critical
• Edge middleware — millisecond-level authentication on every request

WordPress’s PHP-based, request-response architecture either can’t handle most of these requirements or requires significant workarounds. Matt Mullenweg himself acknowledged in his 2023 State of the Word that WordPress isn’t ideal for every use case.

Guillermo Rauch, CEO of Vercel, puts it beautifully:

“The best frameworks let you start simple and scale to sophisticated. That’s what the App Router is designed for — from a blog to a billion-dollar SaaS, same mental model.”
— Guillermo Rauch, Vercel Keynote 2024

That’s exactly what we did.

Tech Stack: The Big Picture

Here’s HeyCaly’s technology map:

72 dependencies, 30+ environment variables, 12 database tables. But every single one has a reason.

Next.js: Why the App Router?

At HeyCaly’s core is Next.js‘s App Router architecture. This isn’t just a React framework — it’s a full-stack solution that houses frontend, backend, and API endpoints in a single project.

Performance with Server Components

Thanks to React Server Components, dashboard pages are rendered server-side. The amount of JavaScript sent to the client stays minimal:

When a dashboard page loads:
1. Server → Database query (Supabase)
2. Server → HTML render
3. Client → Minimal JS hydration

This makes a dramatic performance difference, especially on mobile devices — where over 70% of HeyCaly’s users are.

Architectural Organization with Route Groups

app/
├── (auth)/          → Sign-in/sign-up pages
├── (dashboard)/     → Protected area (sidebar, settings)
├── (onboarding)/    → 8-step setup wizard
└── api/             → ~30 API endpoints + webhooks

Thanks to Next.js route groups, each section has its own layout. The onboarding flow operates completely independently from the dashboard.

Edge Middleware

Every HTTP request goes through authentication at the Frankfurt edge node within milliseconds:

// middleware.ts
export default clerkMiddleware(async (auth, req) => {
  // Public routes: webhooks, sign-in pages
  // Everything else: Clerk auth required
});

Lee Robinson, VP of Product at Next.js, explains this approach:

“Middleware at the edge means authentication happens before your origin server even wakes up. It’s not just faster — it’s a fundamentally different security model.”

Supabase: The Power of Open-Source PostgreSQL

When choosing a database, we evaluated Firebase, PlanetScale, and Supabase. Here are the three core reasons we chose Supabase:

1. The Power of PostgreSQL

HeyCaly has 12 tables, dozens of relationships, and complex queries. NoSQL (Firebase/Firestore) doesn’t fit this relational data model. PostgreSQL’s TIMESTAMPTZ, JSONB, foreign keys, and indexes are critical.

2. Row-Level Security (RLS)

Data isolation is vital in a multi-tenant SaaS:

-- Each business can only see its own customers
CREATE POLICY "business_isolation" ON customers
  USING (business_id = current_setting('app.business_id')::uuid);

Paul Copplestone, CEO of Supabase, explains this philosophy:

“We chose Postgres because it’s the most trusted database in the world. When you’re building on Postgres, you’re building on 35 years of battle-tested reliability.”

3. Migration-Based Schema Management

The database schema is version-controlled through 5 migration files:

supabase/migrations/
├── 001_initial.sql              → 12 tables, indexes, RLS
├── 002_onboarding_progress.sql  → Onboarding fields
├── 003_demo_columns.sql         → Demo mode support
├── 004_conversation_metadata.sql → Conversation metadata
└── 005_partner_api.sql          → Per-business WhatsApp keys

Every migration is reversible, every change is traceable. When we think about the schema changes we used to make with WordPress’s dbDelta() function… The difference is clear.

Claude AI: Why Anthropic?

HeyCaly’s most critical component is its AI conversation engine. When we send a WhatsApp message to a customer, that message needs to be natural, personal, and persuasive.

Model Selection: Claude Sonnet

We ran comprehensive tests on OpenAI GPT-4, Google Gemini, and Anthropic Claude. Here’s why we chose Claude Sonnet:

1. Multilingual naturalness — Claude produces the most natural tone in WhatsApp conversations across multiple languages
2. Contextual reasoning — It can blend customer history, service details, and calendar status in a single response
3. Output quality — Consistently well-structured, concise responses ideal for WhatsApp’s short message format
4. Safety — Anthropic’s Constitutional AI approach inspires confidence with sensitive customer data

Dario Amodei, CEO of Anthropic:

“We believe the most important property of AI systems is that they are safe, beneficial, and understandable.”
— Anthropic Core Views on AI Safety

Signal-Based Architecture (Not Tool Calling)

Here we made an interesting engineering decision. Instead of using Anthropic’s tool calling feature, we designed a text-based signal system:

AI response: "Great, I've booked you in for Thursday at 2:00 PM! 💇‍♀️"
[[APPOINTMENT_CONFIRMED]]{"date":"2026-02-27","time":"14:00","service":"Haircut"}

Why? WhatsApp messages must be short. Tool calling adds JSON overhead. The signal system is lighter, more resilient, and can still catch the “confirmed” signal even when JSON parsing fails.

Inngest: 27 Background Jobs

The “invisible” but most critical layer of a SaaS is its background jobs. Inngest was a game-changer here.

Why Not Vercel Cron or BullMQ?

• Vercel Cron: Sufficient for simple scheduling, but inadequate for event-driven workflows
• BullMQ/Redis: We didn’t want to manage our own servers
• Inngest: Event-driven, scheduled tasks with sleepUntil(), built-in retry logic

Dan Farrelly, CTO of Inngest:

“Traditional job queues make you think in terms of ‘push job to queue, worker picks it up.’ Inngest lets you think in terms of ‘when this event happens, do this’ — which is how your business actually works.”
— Inngest Blog: Why Event-Driven

Job Map

HeyCaly runs 27 Inngest functions:

We use batches of 50 for campaign sending. This ensures compliance with Meta’s WhatsApp Business API rate limits while never exceeding the daily limit based on the warmup tier.

Clerk: Multi-Tenant Authentication

In HeyCaly, every business is an “organization.” Each organization has its own team members, customers, and conversations. Clerk offers this organization-based multi-tenancy out of the box.

Why Not Supabase Auth or NextAuth?

• Supabase Auth: No organization concept, requires custom setup
• NextAuth: Great, but no team management UI
• Clerk: Organization creation → webhook → automatic business record in database. Ready-made invitation system, role management, secure session handling

New registration flow:
1. User signs up on Clerk
2. Clerk webhook fires
3. Stripe customer is created
4. Business + team_member record in Supabase
5. 14-day trial begins

This flow is completely automatic — zero human intervention.

heycaly.com: Headless CMS with Sanity

HeyCaly’s marketing website (heycaly.com) is completely independent from the application code. Here we use Sanity as our headless CMS.

Why Not WordPress?

Yes, ironic. But the reasons are very concrete:

1. Same deployment pipeline: heycaly.com is also built with Next.js. It pulls content from Sanity and generates static pages on Vercel. A single git push updates both the app and the website.

2. Structured content: With Sanity’s GROQ query language, we manage multilingual content across 9 languages (English, Turkish, Spanish, German, Portuguese, Italian, Arabic, French, and Azerbaijani) from a single source.

3. Performance: Statically generated pages are served from Vercel’s CDN. Page load times are 60% lower compared to WordPress’s dynamic PHP rendering.

4. Developer experience: The content team edits through Sanity Studio, developers update templates within the same Next.js project. Two worlds merge seamlessly.

Sanity founder Simen Svale Skogsrud’s words that summarize this approach:

“Content is data, not pages. When you treat content as structured data, you can deliver it anywhere — a website, a mobile app, a WhatsApp message, or an AI prompt.”

This philosophy is tailor-made for HeyCaly. Content in Sanity can be used both on the website and potentially in in-app help text.

Learn more about our headless CMS approach →

Security: Encryption, Isolation, Compliance

Health data, appointment information, phone numbers — HeyCaly handles sensitive data. Our security architecture:

AES-256-CBC Encryption

WhatsApp API keys and OAuth tokens are stored encrypted in the database:

Save: plaintext → AES-256-CBC encrypt → DB
Use:  DB → decrypt → API call → clear from memory

Data Isolation

• Clerk: Each organization has its own auth boundary
• Supabase RLS: Row-level access control at the database level
• Service Role: Inngest background jobs run with a secure service role key

GDPR Compliance

• Vercel hosting: Frankfurt, Germany (EU region)
• Sentry: EU region configuration
• Supabase: EU region
• All personal data stays within European borders

Stripe: Subscriptions and Billing

Stripe integration manages four plan tiers:

Webhook-driven event flow:

Stripe webhook → subscription.updated
  → Inngest: update plan limits
  → Supabase: update businesses table
  → Postmark: send confirmation email

The 14-day trial starts with Business plan limits. Day 12 warning, day 14 auto-downgrade to Starter if unpaid — all handled by Inngest cron jobs.

Sentry: Error Tracking

Every error in production is caught instantly. Sentry‘s Next.js SDK operates across three layers:

// Client-side errors
sentry.client.config.ts

// Server-side errors (API routes, Server Components)
sentry.server.config.ts

// Edge runtime errors (middleware)
sentry.edge.config.ts

A timeout in WhatsApp webhooks, a missing field in a Stripe webhook, an unexpected format in a Claude API response — each one reaches the team as an instant notification.

Performance Metrics

Measurements on Vercel’s Edge Network in Frankfurt:

Timezone Management: Small But Critical

In an appointment-based system, timezone management either saves you or sinks you. HeyCaly’s approach:

1. Database: Everything in UTC (TIMESTAMPTZ)
2. Business setting: Timezone in IANA format (Europe/Istanbul, America/New_York)
3. AI prompt: Available slots presented in the business’s local timezone
4. Customer message: AI writes local time (“Thursday 2:00 PM”)
5. Storage: Converted to UTC server-side before writing to database

The date-fns-tz library handles these conversions reliably.

“There are only two hard things in Computer Science: cache invalidation and naming things.”
— Phil Karlton

We’d add a third: timezone management.

What We Learned from WordPress

We don’t want to end this article with “WordPress bad, modern stack good.” Because that’s not true.

WordPress taught us:

• User experience matters above all — The reason WordPress has a 43% market share globally isn’t technical superiority, it’s ease of use
• Think in plugin architecture — HeyCaly’s modular structure (each integration in its own lib/ folder) is inspired by WordPress’s plugin philosophy
• Backward compatibility matters — Migration-based schema management, Stripe webhook versioning — all the same principle
• Community power — shadcn/ui, Radix, Tailwind — open-source community components are the modern equivalent of WordPress’s theme/plugin ecosystem

Learn more about our WordPress projects →

Building HeyCaly, our WordPress experience was our greatest advantage. The years of “how does the user think” knowledge isn’t written in any framework documentation.

The Right Tool for the Right Job

When a client needs a corporate website, we recommend WordPress. When they need e-commerce, we set up WooCommerce. When they need a content-heavy, multilingual platform, we deliver WordPress + WPML.

But when the need is real-time AI, WhatsApp integration, event-driven background jobs, and multi-tenant SaaS architecture — we build with Next.js, Supabase, Inngest, and Claude AI.

It’s not about a technology war. It’s about using the right tool for the right job.

At The WP Clan, we have experience in both worlds. Let’s figure out together which world your project belongs to.

Get in touch for your projects →

Resources and Further Reading

• Next.js App Router Documentation
• Supabase Row-Level Security
• Anthropic Claude API
• Inngest Event-Driven Functions
• Sanity Headless CMS
• Clerk Organization-Based Auth
• 360dialog WhatsApp Business API
• Vercel Edge Network

This article was written by The WP Clan team. Check out our services for WordPress, headless CMS, SaaS development, and AI integration.