Travel Agency Management Platform · Multi-tenant SaaS
MassarOne
An all-in-one operations, sales, finance, and customer-management platform for travel agencies, tourism operators, and Hajj & Umrah organizations.
The challenge
Travel agencies often rely on disconnected spreadsheets, messaging apps, PDFs, and accounting tools. Operational and financial records become fragmented, permissions are difficult to control, and teams repeat data entry from the first customer request through invoicing and VAT reporting.
The solution
MassarOne connects agencies, branches, staff, customers, offers, bookings, services, suppliers, payments, wallets, invoices, VAT, documents, tasks, calendars, internal chat, and the agency’s public website in one tenant-aware workspace.
Key outcomes
- One connected operational and financial record
- Granular agency, role, module, and branch permissions
- Traceable invoicing, revisions, VAT, payments, and documents
Platform capabilities
Agencies, branches, subscriptions, employees, roles, and permissions
CRM, traveler profiles, passport OCR/MRZ, and Excel import
Tourism offers, bookings, Hajj/Umrah programs, and room allocation
Standalone travel services, quotations, orders, and branded documents
Automated final invoices and proformas with idempotency controls
VAT ledger, suppliers, procurement, wallets, banks, cheques, and charges
Real-time chat, notifications, WebRTC signaling, tasks, and calendar
Agency public website, offer catalog, leads, and headless API
Connected business workflow
- STEP 1Customer or lead
- STEP 2Quotation or travel service
- STEP 3Booking, fulfilment, and payment
- STEP 4Final invoice or proforma
- STEP 5VAT ledger and accounting records
- STEP 6Versioned document archive and audit history
System architecture
- Angular 21 application with super-admin, agency-admin, staff, and public workspaces
- Express API with domain services, tenant-aware middleware, validation, uploads, documents, and scheduled jobs
- Prisma 6 and PostgreSQL across operational, financial, collaboration, and governance domains
- Multi-stage Docker builds, unprivileged Nginx runtime, health checks, and deployment migrations
Security & integrity
- JWT authentication backed by hashed, revocable server-side sessions
- Layered global roles, agency membership, module actions, and branch scope
- Server-side tenant authorization repeated on protected API and database operations
- Upload type, size, and file-signature validation with optional ClamAV scanning
- Immutable invoice revisions, audit logs, decimal calculations, and controlled reversals
- Helmet, explicit CORS allowlist, rate limiting, bcrypt, Zod, and hashed public API keys