Devam Shah

00 / Idea

Sutra

the thread that ties a small business's data together.

“Sutra” is Sanskrit for thread.

Phase 1 of 5 complete · Updated

Watch how it works ↓

How it works · 30 seconds

How Sutra works, in six steps

A client sends their tax slips.
  1. A client uploads their tax slips.
  2. Sutra reads each slip and pulls out the numbers.
  3. It files them in a database hosted in Canada.
  4. It compares this year with last year to spot missing slips.
  5. You ask "who is missing what?" and Claude answers and drafts reminders.
  6. A person approves each reminder before it is sent. Sutra never files with the CRA.

01 / The problem

Tax season runs on chasing slips.

Small tax practices lose days every season chasing clients for slips and re-typing numbers. Owners rarely have in-house data or AI skills. I run one, Devam Shah Tax Services, launching for the 2027 season, so I'm building the tool I need.

After

  • ✓ received Client A · T4, T5, RRSP
  • ⚠ missing Client B · T5 from last year's bank
  • ✓ received Client C · T4, rent receipts
  • ⚠ missing Client D · T2202 tuition slip

Example clients are synthetic.

02 / What Sutra does

Six steps, one thread.

  1. 1Upload

    The client uploads slips and receipts.

    Planned
  2. 2Classify & extract

    Hugging Face models identify T4, T4A, T5, RRSP, T2202, medical and rent documents and read their fields.

    Planned
  3. 3Store in Canada

    A Postgres star schema on Azure, Canada Central only.

    Built
  4. 4Compare

    This year vs last year gives each client's missing documents.

    Built
  5. 5Flag

    Big income changes and recurring slips that haven't arrived.

    Built
  6. 6Ask Claude

    “Who is missing what?” Claude drafts reminders that a person approves before anything is sent.

    Planned

03 / The journey

From idea to proof.

  1. Done Step 0 · The idea

    • Research: small businesses' top AI barriers are lack of expertise, weak data readiness and no clear first use case. For tax practices, the bottleneck is document intake.
    • Chose the name Sutra. Business model: Data Health Check → Brain Install → monthly Pulse.

  2. Done Phase 0 · Foundation

    • 🧰Toolsgit, Python and uv, Azure CLI, Terraform 1.17, Docker, gitleaks, GitHub CLI.
    • 📁RepoA shared core/ engine plus industry packs/, a README in every folder, a decision log.
    • 🔐Secrets never leave the laptopA gitleaks scan on every commit, and again in CI.
    • 🇨🇦Canada only, enforced in codeTerraform rejects any other region.
    • 🗄️Terraform stateStored in Azure with no access keys, versioned, soft-delete protected and locked against deletion.
    • 💸Cost guardrails firstA CA$10/month budget with email alerts at 50/75/80/90/100%, and logging capped inside the free tier.
    • 🤝No stored passwordsGitHub signs in to Azure with OIDC short-lived tokens.
    • ✅Every infra change is a pull requestfmt → validate → plan. CI can plan but never apply.
    Lesson GitHub's OIDC tokens now carry numeric owner and repo IDs, so Azure rejected my first trust rule. In security, almost matches should fail.

  3. Done Phase 1 · Data model & synthetic data

    • 🐍Python 3.12 foundationuv, ruff, strict mypy, pytest, with CI against a real Postgres.
    • 🐘Local Postgres 17 + pgvectorIn Docker, the same version as Azure, at $0.
    • ⭐Star schemafact_document, fact_engagement, dim_client, dim_document_type, dim_tax_year, dim_date. The database enforces provinces, client codes, non-negative amounts and filing rules.
    • 🧪Synthetic data200 fake clients × 2 tax years = 1,023 documents. Deterministic, no real people, no SINs. 50 planted missing documents and 10 planted income jumps.
    • 📊Two viewsvw_missing_documents (type + issuer matching) and vw_yoy_changes (a LAG() window function).
    • 🎯Proof36 tests. Both views return exactly the planted answers.

  4. Next Phase 2 · Ingestion

    PDF upload → Azure Function → Postgres → processed / quarantine. 300 synthetic slip PDFs.

  5. Planned Phase 3 · ML

    2–3 commercially licensed Hugging Face models benchmarked (target above 95% accuracy), anomaly detection, and CRA guides searchable with pgvector.

  6. Planned Phase 4 · MCP server

    Read-only tools for Claude, containerised on Azure Container Apps, authenticated, with every call audit-logged.

  7. Planned Phase 5 · Brain, dashboard, security, docs

    Claude + Gmail/Calendar demo, a dashboard, a security review and a 2-minute demo video.

  8. Planned Then

    Pilot (Jan 2027) → live in my own practice (Feb 2027) → second industry: trucking (spring 2027).

04 / Guardrails before features

Safe first, clever second.

  • 🤝No stored passwords

    GitHub signs in to Azure with short-lived OIDC tokens.

    Why: nothing to leak, nothing to rotate.
  • 🇨🇦Canada-only

    Terraform rejects any region outside Canada.

    Why: client tax data stays in Canada.
  • 💸Cost caps

    CA$10/month budget, alerts at 50/75/80/90/100%.

    Why: no surprise bills.
  • 🔐Secret scanning

    gitleaks on every commit and in CI.

    Why: secrets never reach the repo.
  • ✅Plan before apply

    Every change is a pull request: fmt → validate → plan.

    Why: a person reviews before anything changes.

Sutra prepares; people review and file. It never files with the CRA or gives tax advice.

05 / Architecture

How the thread runs.

Hover, tap or tab to a node for details. Solid = built, dashed = planned.

🇨🇦 Azure · Canada Central

  1. Client upload (planned)
  2. Azure Blob raw folder (planned)
  3. Azure Function: classify and extract with Hugging Face (planned)
  4. PostgreSQL + pgvector: star schema and CRA guidance (built locally)
  5. MCP server on Container Apps: read-only, audit-logged (planned)
  6. Claude + Gmail/Calendar (planned)
  7. Reminders a person approves (planned)

Platform

  • Laptopplan → review → apply
  • GitHub Actionsfmt · validate · plan · gitleaks · signs in with OIDC · never applies
  • Terraform statelocked

06 / The data model

A star, not a spreadsheet.

Hover or tap a table to see its grain.

{"box_14_employment_income": 62000}

Document fields are stored as JSONB, so each slip type keeps its own boxes.

07 / Proof, not polish

36 → 10

0

 

08 / Proof

Green checks, every time.

$ gh pr checks
✓ gitleaks
✓ lint, types and tests   (36 passed)
✓ plan (dev)              No changes. Your infrastructure matches the configuration.
  • 36tests
  • 1,023synthetic documents
  • 22documented decisions
  • 5CI checks
  • CA$0monthly cost
  • 0stored passwords

09 / Stack

What it's made of.

  • Azure Storage (Blob)
  • Azure Functions planned
  • PostgreSQL Flexible Server planned
  • Container Apps planned
  • Key Vault planned
  • Log Analytics
  • Terraform
  • Python 3.12
  • uv
  • SQL / PostgreSQL / pgvector
  • Hugging Face planned
  • MCP (FastMCP) planned
  • Docker
  • GitHub Actions
  • gitleaks
  • Claude planned

Solid = in use today. Outlined = planned.

10 / Built to reuse

One core, many industries.

core/shared engine
  • Tax building
  • Trucking next
  • Restaurants later
  • Importers later
  1. Data Health Checkwhere your data stands
  2. Brain InstallSutra set up for your practice
  3. Pulsemonthly

Coming 2027

11 / Follow along

Watch it get built.

Run a small practice? Tell me what eats your tax season.

All data shown is synthetic. Sutra prepares; people review and file. Not tax advice.