The context
Concierge CR is a platform aimed at high-net-worth international clients visiting Jacó, Santa Teresa, and Tamarindo in Costa Rica. It's not an informational landing page — it's a complete operational platform: a premium public site plus an admin panel with roles, built for a real team to manage requests, payments, and bookings every day.
The challenge
A luxury concierge service sells distinct experiences (villas, private transportation, activities), each with its own pricing and availability logic, and needs to process real deposits and payments without friction, while an internal team (not just the owner) follows up on every request from a panel with differentiated permissions.
The solution
A full-stack platform built on Next.js 14 and TypeScript, with Prisma and PostgreSQL as the data layer, NextAuth for authentication, Stripe payments in USD, and an admin panel with Admin and Staff roles — each with a different access level — plus an analytics dashboard for tracking requests in real time.
Key features
- Villa rentals: gallery, amenities, pricing, and availability per property
- Premium transportation: helicopter transfers, yacht rentals, and more
- Experiences: surf coaching, wellness retreats, exclusive events
- Multi-step request system with real-time validation (Zod)
- Automated confirmation and follow-up emails via Resend
- Online payments (deposits and full payments) integrated with Stripe
- Admin panel with Admin / Staff roles and differentiated access control
- Analytics dashboard and request management
- WhatsApp widget with pre-filled messages for direct contact
The most interesting technical challenge
Beyond the service catalog, the critical piece was the security layer: rate limiting on public endpoints, CSRF protection on forms, input sanitization against XSS, security headers (CSP, HSTS, X-Frame-Options), server-side validation with Zod on every API route, SQL injection prevention via the Prisma ORM (parameterized queries), and an audit log that records every action taken inside the admin panel. For a platform handling real payments and guest data, that layer isn't optional — it's as much a part of the product as the villa catalog.
Tech stack
Next.js 14 · TypeScript · Tailwind CSS · Prisma · PostgreSQL · NextAuth · Stripe · Resend · Framer Motion · Zod