Acuity Finance

My accountancy and bookkeeping practice, with a client portal and an iOS app.

Presenting problem: A new accountancy practice needed a site that brings in enquiries, and a secure place where clients send documents, answer requests and approve work.
Assessment: Financial documents are sensitive, and approvals have to stand up later. Clients should never need to remember a password. Small-business owners will mostly use a phone.
Plan: Laravel 11 with Blade and Tailwind for the site. A Livewire client portal and a Filament admin, where TOTP is mandatory for admins. A Sanctum API for the SwiftUI client app. Clients sign in with an emailed six-digit code. Uploads have their type checked from the file's bytes and are hashed and stored in Cloudflare R2 behind signed URLs. Approval decisions are immutable, each with a PDF certificate. Direct Debit is through GoCardless, and company lookup through Companies House.
Outcome: Site and portal live at acuity-finance.co.uk. iOS client app approved and live on 17 Sep 2026. GoCardless live and FreeAgent connected on 18 Sep 2026.

Acuity Finance homepage: 'Your numbers, in sharp focus.' with a 'Kept in order' checklist panel. — Desktop

Acuity Finance homepage on a phone. — 390px

One way in for files

Every file, from the portal, the app or the admin, goes through a single service. It works out the type from the file’s bytes rather than its name, records a SHA-256 hash, stores it under a random key, and queues a scan. Downloads are short-lived signed URLs. Nothing else in the code writes to storage.

Approvals that hold

An approval decision is never edited. Re-issuing creates a new record. Each decision produces a PDF certificate, so the practice and the client keep the same copy of what was agreed.

The API contract

The iOS app talks to a versioned JSON API with a written OpenAPI contract. The contract is frozen: additions are allowed, and breaking changes go to a new version. Errors follow RFC 7807 problem details, and sign-in, uploads and general use are each rate limited.

Integrations that fail quietly

GoCardless and Companies House integrations degrade gracefully when not configured. Onboarding still works and nothing errors on the client’s screen.