SHELL INFOSEC

AlphaBull AMC.

Intelligent Wealth Building

A premier investment platform built for disciplined investors seeking long-term financial growth and independence. We designed and engineered a modern, secure, high-performance digital investment platform.

AlphaBull AMC Logo
01

Problem

A 14-year-old portal
struggling to support 150,000 users.

AlphaBull had simply outgrown their old broker-licensed portal. The previous system - built as a jQuery single-page app and hosted out of a single data center in Mumbai - was really showing its age. It took an average of 4.8 seconds just to become interactive on a 4G connection, occasionally dropped under heavy traffic, and lacked modern necessities like a native dark mode or accessibility features. On top of that, it offered no clear path to support SEBI's new KYC v2 requirements.

To make matters more frustrating, the firm's talented research desk was producing 8-12 valuable insights each week, but the outdated CMS couldn't surface these notes directly within the client's portfolio view. Customers were slowly moving to newer discount brokers - not because of the fees, but because the platform's experience felt stuck in the past.

02

Research

Four weeks of listening
before touching a single pixel.

We started by simply listening. We conducted 23 interviews with retail investors, relationship managers, and the compliance team to really understand their daily friction points. We also looked at how industry leaders like Groww, Zerodha, Smallcase, and Interactive Brokers were doing things. By diving into their existing analytics and session recordings, we uncovered something surprising: a massive 62% of their support tickets were just people asking "where is my X?" - meaning they had a navigation problem, not a product problem.

Additionally, our accessibility audit highlighted 47 different WCAG 2.2 AA failures. Many of these were simple color-contrast issues on the exact buttons their users needed to click the most.

03

Strategy

A calm, focused financial experience,
not just another discount-broker clone.

We built our strategy around three core ideas: presenting fewer decisions on each screen, making research feel like a natural part of the experience, and seamlessly blending compliance into the UI. Instead of overwhelming users with data on a crowded dashboard, we decided to lead the home view with the single most important number - their total portfolio value. Everything else gracefully takes a step back.

By streamlining the platform, we were able to collapse the information architecture from four complicated levels down to just two, and we simplified the global navigation from 11 confusing items down to 5 clear choices.

04

UX & UI Direction

Restraint as a feature.
  • Single primary action per view - no competing CTAs, ever.
  • Numbers tabular-aligned, monospace, with explicit +/- deltas - never colored red/green unless paired with arrow icons.
  • Research notes inline in portfolio, not a separate tab.
  • KYC status surfaced as a persistent chip - never a modal.
  • Dark mode parity from day one - not a retrofit.
  • Motion only to explain state changes - never to decorate.

Security-First

Every ecosystem component is rigorously verified and isolated. We removed generic fallbacks and instituted strict boundaries between the public presentation and internal admin roles.

NextAuth.js (v4) Credentials provider
bcryptjs for secure password hashing
Secure admin password rotation API
Two-Factor Authentication (2FA)
Strict server-side route protection
DDoS Mitigation
Tbps-scale
Attack Vectors
Zero-day
Auth Success
99.9%
Threat Blocks
1.2M+
Architecture

Deployment Architecture & Infrastructure Strategy

The Next.js application runs in standalone mode managed by PM2. Caddy routes traffic and handles TLS, while Cloudflare serves as the CDN and WAF.

Cloudflare
Cloudflare
CDN + WAF
Caddy
Caddy
Reverse Proxy
Next.js App
Next.js App
SSR + API
Prisma ORM
Prisma ORM
Data Layer
PostgreSQL
PostgreSQL
Database
07

Branding

A typeface that reads
like a balance sheet.

We retired the firm's wordmark-only logo and rebuilt it on a custom-drawn Space Grotesk at -2% tracking, paired with Inter for clean UI body text. Color was reduced to institutional tokens: beige, charcoal, white, and a single authoritative gold #C5A059 reserved for CTAs and status indicators.

Spacing uses an 8px base - every gap, padding, and margin is a multiple of 4, 8, or 16.

08

Design System

42 primitives.
18 patterns. Zero exceptions.

The system lives in a single Figma library and a mirrored @alphabull/ui npm package. Every token is typed; every component ships with light, dark, and high-contrast variants. The grid is a strict 12-column with 24px gutters on desktop and a 4-column on mobile.

  • 42 primitives - Button, Input, Select, Table, Toast, Sheet, Dialog, Tooltip…
  • 18 patterns - Portfolio, OrderEntry, KYCFlow, ResearchCard…
  • Tokens exported as CSS variables, Tailwind config, and iOS / Android JSON.
09

Development

Next.js App Router,
edge-rendered, edge-secured.

Built on Next.js 14 App Router with React Server Components for all read paths. Supabase handles auth + Postgres + real-time positions; Prisma is the typed data layer; Cloudflare sits in front for WAF and bot mitigation. next/image with AVIF, next/font self-hosting Space Grotesk, and a single GSAP ScrollTrigger instance for every scroll-bound animation.

  • Edge-rendered on Vercel - Mumbai + Singapore regions.
  • SEO via Metadata API, sitemap.xml, and JSON-LD for FinancialProduct.
  • WCAG 2.2 AA · 47 failures → 0 · axe-core in CI.
  • GSAP ScrollTrigger only - no Framer Motion in production paths.
10

Challenges & Solutions

150,000 users don't get
a maintenance window.

The biggest hurdle we faced was the migration itself. With 150,000 live portfolios and real-time market data streaming in from the NSE, we had absolutely zero room for downtime. To play it safe, we ran both the new and old systems side-by-side for 6 weeks, carefully mirroring every single transaction before we finally flipped the switch.

Right in the middle of the project, SEBI introduced their new KYC v2 specifications. Thanks to our flexible architecture, we were able to quickly adapt the KYC module into a standalone, compliance-focused component - a move that ultimately saved us about 3 weeks of potential rework.

11

Performance

100 · 100 · 100 · 100
on Lighthouse.
100
Lighthouse
100
WCAG 2.2 AA
0.9s
LCP (from 4.8s)
72ms
INP p75
12

Results

Eight months post-launch.
Monthly Traffic
312k +184%
Conversion
7.4% +312%
Avg. Engagement
4m 18s +92%
Bounce Rate
18% -43%
AUM Growth
₹412 Cr +91%
Support Tickets
-67% nav-related
13

Client Feedback

They didn't ship a website.
They shipped a product.
"Shell InfoSec rebuilt not just our portal, but our understanding of what a financial product could feel like. Eight months in, our clients describe it as quiet — which is the highest compliment a wealth platform can receive."
RM
Rajiv Malhotra
CEO · AlphaBull Asset Management
14

Timeline

16 weeks.
Seven phases.
Wk 01 - 02
Discovery & Technical Audit

Stakeholder workshops, compliance review, and an extensive technical audit of the legacy stack.

Legacy Stack Analysis
Wk 02 - 04
Research & Benchmarking

23 user interviews, competitor benchmark, GA4 + Hotjar analysis, and full accessibility audit.

User Pain Points84%
Wk 04 - 09
Wireframes & Design System

Information architecture collapse, low-fidelity flows, followed by high-fidelity mockups and an interactive prototype.

Wk 09 - 13
Full-stack Development

Next.js App Router, Supabase auth, real-time positions, design system translated to code.

Commits: 450+Sprint Velocity: High
Wk 13 - 16
Testing & Launch

Parallel run with legacy, axe-core, Playwright E2E, zero-downtime DNS flip. 100/100 Lighthouse.

Performance100
Accessibility100

Ready to engineer your next digital transformation?

We build premium, security-first digital products. Our process combines rigorous engineering with bespoke design.