The Problem
Finding a lawyer in Cameroon is slow, opaque, and often unreliable. Clients have no visibility on costs upfront, no way to track their case progress, and payments flow through informal channels with no guarantee of security. Lawyers, on their side, struggle to manage their caseload, collect payments, and communicate with clients across fragmented tools.
Tribunejustice needed a platform that would solve this from both ends — bringing trust, structure, and speed to a historically informal market.
For clients
Find the right expert in minutes, pay securely with escrow, and track every step of their case in real time — instead of waiting weeks for a callback.
For lawyers
A structured inbox, automated case lifecycle, integrated billing, and a CRM to manage leads and client relationships — all in one place.
What I Built
Modular backend (Laravel): The entire platform is organized around a Service Request — the central entity that carries the full lifecycle: creation, expert assignment, tracking, payment, resolution. A ServiceRequestStatusMachine state machine guarantees that no case can skip a step or revert to an invalid state.
Security — defense-in-depth: Legal data is highly sensitive. The platform went through a full security audit after launch:
- Granular RBAC with strict Admin / Super Admin separation
- Sudo mode (password re-confirmation) required for sensitive actions: 2FA changes, data exports, admin operations
- SSRF protection on the blog image proxy via strict allowlist
- Hardened CRM observers to prevent cross-module data leaks
- Redis TTL sessions for sudo (10-minute window)
Evolving Angular frontend: The monolithic AuthService (594 lines, 87 consumers) was refactored into 4 signal-based specialized services, making the auth layer predictable, testable, and maintainable. The ApiClient centralizes retry logic, error normalization, and typed error handling across all API calls.
Real-time messaging: Client-expert communication uses WebSocket via Laravel Reverb, with Horizon queue workers for async notification and email dispatch — no polling, instant delivery.
Search & discovery: Expert profiles are indexed via Typesense with real-time faceted search, reducing time-to-match for clients looking for the right specialist.
CRM & automation: A full CRM module tracks contacts, lifecycle stages, lead scoring, and campaign automation — connected to the core domain via observers and events.
Impact
41 vulnerabilities fixed
A post-launch audit identified and closed 41 security flaws across the blog, RBAC system, and frontend — before any breach could occur.
30% IT maintenance freed
The on-premise Exchange migration freed 30% of recurring IT time — redirected to product features instead of server maintenance.
Instant case visibility
Clients and lawyers now see every status change in real time via WebSocket — eliminating the back-and-forth emails that used to define case communication.
~50% recurring cost reduction
Architectural decisions (Redis caching, N+1 elimination, 4 composite indexes) cut server load significantly, reducing infrastructure costs as the user base grows.
Security Audit Results
- 17 blog vulnerabilities fixed: SSRF proxy, GET→POST logout, missing auth middleware, open redirect
- 14 RBAC flaws: Admin/Super Admin separation, critical permission protection (roles, permissions, settings)
- 10 frontend fixes: XSS via isomorphic-dompurify, open redirect via
isSafeRedirectUrl(), fail-closed guards - Sudo mode audit: 2FA enable/confirm routes without protection, change-password without sudo, broken admin verify-email route
What This Experience Taught Me
Architecting a legaltech platform forces a specific mindset: every feature has to answer two questions — "can this data leak?" and "can this workflow be subverted?" Security can't be layered on after the fact in a domain handling sensitive legal and financial data.
I also learned to balance velocity against quality: shipping security fixes without breaking user experience, migrating an Angular codebase without halting production, and documenting architectural decisions so the team could move independently.
Next Steps
The platform is now serving as a testing ground for AI agent integration — automated first responses, legal document analysis, and complex workflow orchestration directly connected to production data.