Tuzluk
Multi-tenant QR menu and table-ordering platform for restaurants.
Tuzluk is a multi-tenant SaaS platform I built end to end for restaurants and cafés: a live QR menu, waiter-approved ordering from the table, a floor plan for the front of house and a kitchen display, all fed from the same data. It runs on Next.js 16 with PostgreSQL through Prisma, JWT auth over a role hierarchy (owner › manager › waiter › kitchen), tenant isolation enforced both in application queries and with Postgres row-level security, and Upstash Redis rate limiting with an in-memory fallback. Orders reach the kitchen screen over SSE with polling as a fallback. Table secrets are stored hashed and AES-GCM encrypted so they never leak through the public menu API, and the anti-abuse layer — waiter approval, PIN, device and order limits — blocks ordering from outside the venue. Self-service signup, a QR poster studio, a campaign engine and per-branch pricing make up the product side.
Context
Most small and mid-size restaurants in Turkey put a PDF behind the QR code: static, unsearchable and out of date the moment a price changes.
Problem
A digital menu on its own does not change how the floor runs. Taking orders from the table is where the hard problems start — preventing remote or abusive ordering, keeping each business's data isolated inside one shared database, and getting an order onto the kitchen screen fast enough for the staff to trust it.
Approach
I designed it as an operations system rather than a menu viewer. Tenant safety is layered: scoped queries in the application, with Postgres RLS underneath as a safety net. Table secrets are hashed and encrypted at rest, and ordering runs through waiter approval with PIN, device and order-count limits. Realtime is SSE-first with a poll fallback, so the kitchen display degrades instead of breaking.
Outcome
Shipped as a live product at tuzluk.app with self-service signup, five packages from free to enterprise, and KVKK documentation covering data processing, transfer and breach response. On PageSpeed Insights (Lighthouse 13.4.1, 20 Aug 2026) the landing page scores 100 Performance on desktop and 92 on mobile, with 100 Best Practices and 100 SEO on both form factors — Largest Contentful Paint 0.7s on desktop and Cumulative Layout Shift 0 on both.