Strand

The problem

Teams and consultancies sit on valuable document libraries — internal wikis, legal contracts, research papers — but searching them is painful. Existing solutions are either too generic (ChatGPT file uploads) or too expensive (enterprise RAG platforms). There's no simple way to turn a document set into a shareable, embeddable AI agent with usage limits and billing built in.

What I built

I built a multi-tenant AI agent platform on Next.js 16, Supabase with pgvector, and OpenAI. Users create agents, upload documents (PDF/TXT), and the ingestion pipeline parses, chunks, embeds, and stores them. Chat uses cosine similarity retrieval + GPT-4o streaming with inline citations. Agents can be shared publicly or embedded via a widget script.

• RAG chat with inline citations

  Conversational interface with GPT-4o streaming responses. pgvector cosine similarity retrieves relevant document chunks, displayed as clickable citation badges with source popover. Speech-to-text input via Web Speech API.

• Document ingestion pipeline

  Upload PDF or TXT files with magic byte validation. Token-aware chunking (js-tiktoken, 100-token windows with overlap), OpenAI text-embedding-3-small for vectors, stored in pgvector. Real-time status polling: uploading → processing → ready.

• Public agents and embeddable widget

  Deploy agents at /a/:slug — no auth required for visitors. Embeddable floating chat bubble via a script tag (under 10 KB). Origin whitelist enforcement, compact iframe layout, plan-based Powered by Strand branding on free tier.

• Agent customization

  Custom system prompts, greeting messages, avatar upload. Color picker for widget bubble, message backgrounds, and accent colors. Public/private toggle and slug-based URLs for sharing.

• Stripe billing with 3-tier plans

  Free (1 agent, 50 msgs/mo), Pro $19/mo (5 agents, 2K msgs), Business $49/mo (20 agents, 10K msgs). Stripe Checkout, Customer Portal, webhook idempotency via processed_events table. Atomic usage tracking with TOCTOU prevention.

• Analytics dashboard

  Real-time event tracking — conversation starts, messages sent/received. Aggregate stats with messages-per-day chart, recent conversations list with message counts. Agent-level isolation via RLS.

• Security hardening

  RLS on every table, SECURITY DEFINER functions with search_path lock, prompt injection mitigations (XML delimiters, input caps), signed URLs for file access, magic byte validation, webhook idempotency for payments.

The result

The platform handles the full AI agent lifecycle — from document upload through embedding, retrieval, and streaming chat to public deployment, website embedding, and usage-metered billing. Every action is RLS-isolated, rate-limited, and audit-tracked.