MinTax - Enterprise Tax & Expense Analysis Platform

Overview

I was the sole developer on MinTax, a production-grade desktop application used by UK tax professionals and accountants to perform complex tax calculations, analyze expenses, and generate HMRC-compliant reports. Every line of code, every architecture decision, every deployment pipeline was mine.

The core challenge: take messy Excel files with 64+ expense columns and thousands of rows, run real-time tax categorization across P11D, PSA, and PAYE frameworks, and deliver results in under 2 seconds, all while keeping sensitive financial data encrypted and the entire system running 100% offline.

What I Owned (Solo Developer Scope)

As the only engineer on this project, I was responsible for every layer of the stack, from pixel to deployment:

Why I Chose This Stack

Every technology choice was driven by the specific constraints of this project: offline-first, security-critical, data-heavy.

Technical Architecture

The application employs a multi-layer architecture with strict security boundaries between each layer:

┌─────────────────────────────────────────────────────────────────────────┐
│                         PRESENTATION LAYER                              │
│  ┌─────────────────┐  ┌─────────────────┐  ┌─────────────────┐          │
│  │   SvelteKit +   │  │   Tailwind CSS  │  │ WebContentsView │          │
│  │    Svelte 5     │  │    Styling      │  │   Multi-Tab     │          │
│  └─────────────────┘  └─────────────────┘  └─────────────────┘          │
└─────────────────────────────────────────────────────────────────────────┘
                                    │
                          IPC Communication
                          (Context Isolated)
                                    │
┌─────────────────────────────────────────────────────────────────────────┐
│                         APPLICATION LAYER                               │
│  ┌─────────────────┐  ┌─────────────────┐  ┌─────────────────┐          │
│  │  Electron Main  │  │     License     │  │   Auto-Update   │          │
│  │    Process      │  │   Management    │  │     System      │          │
│  └─────────────────┘  └─────────────────┘  └─────────────────┘          │
└─────────────────────────────────────────────────────────────────────────┘
                                    │
                    Encrypted IPC + Session Keys
                                    │
┌─────────────────────────────────────────────────────────────────────────┐
│                           DATA LAYER                                    │
│  ┌─────────────────┐  ┌─────────────────┐  ┌─────────────────┐          │
│  │  SQLite + AES   │  │   Knex.js       │  │    Secure       │          │
│  │   Encryption    │  │   Migrations    │  │  Repositories   │          │
│  └─────────────────┘  └─────────────────┘  └─────────────────┘          │
└─────────────────────────────────────────────────────────────────────────┘
                                    │
                    AES-256-GCM Encrypted API
                                    │
┌─────────────────────────────────────────────────────────────────────────┐
│                    ANALYSIS ENGINE (Python FastAPI)                     │
│  ┌─────────────────┐  ┌─────────────────┐  ┌─────────────────┐          │
│  │  Multi-threaded │  │    WebSocket    │  │     Pandas      │          │
│  │   Processing    │  │    Streaming    │  │   Data Engine   │          │
│  └─────────────────┘  └─────────────────┘  └─────────────────┘          │
└─────────────────────────────────────────────────────────────────────────┘

Technology Stack

Key Features & Capabilities

Multi-Tab Navigation System

Implemented a browser-like tabbing system using Electron’s WebContentsView API. Each tab operates as an isolated renderer process with its own lifecycle, enabling users to work across multiple companies and reports simultaneously without data cross-contamination.

Real-Time Analysis Engine

Developed a Python-based expense analysis engine that processes complex Excel files (64+ columns) with real-time streaming updates. The engine categorizes expenses into taxable, non-taxable, and excluded categories while identifying review points requiring human attention.

Enterprise-Grade Security Architecture

Implemented comprehensive security measures including end-to-end encryption for all API communications, field-level database encryption for sensitive data, and secure session key management.

Advanced Data Table with Dynamic Filtering

Built a high-performance, Excel-like data table component handling thousands of expense records with automatic type detection, dynamic filter generation, and real-time updates from streaming WebSocket data.

Professional Report Generation

Comprehensive reporting system generating client-ready documents for tax compliance and analysis review.

Technical Challenges & Solutions

Challenge 1: Cross-Platform Encryption Compatibility

# Python AES-GCM Encryption (matching browser WebCrypto)
class EncryptionManager:
    def __init__(self, encryption_key: str):
        self.salt = b'electron_api_salt_2024'
        kdf = PBKDF2HMAC(
            algorithm=hashes.SHA256(),
            length=32,  # 256 bits
            salt=self.salt,
            iterations=100000,
        )
        derived_key = kdf.derive(encryption_key.encode('utf-8'))
        self.aesgcm = AESGCM(derived_key)
 
    def encrypt_data(self, data: dict) -> str:
        nonce = os.urandom(12)
        json_bytes = json.dumps(data).encode('utf-8')
        ciphertext = self.aesgcm.encrypt(nonce, json_bytes, None)
        return base64.b64encode(nonce + ciphertext).decode('utf-8')

// TypeScript AES-GCM Decryption (matching Python EncryptionManager)
class CryptoService {
  private key: CryptoKey;
 
  async deriveKey(password: string): Promise<CryptoKey> {
    const salt = new TextEncoder().encode('electron_api_salt_2024');
    const keyMaterial = await crypto.subtle.importKey(
      'raw', new TextEncoder().encode(password), 'PBKDF2', false, ['deriveKey']
    );
    return crypto.subtle.deriveKey(
      { name: 'PBKDF2', salt, iterations: 100000, hash: 'SHA-256' },
      keyMaterial,
      { name: 'AES-GCM', length: 256 },
      false, ['decrypt']
    );
  }
 
  async decrypt(encrypted: string): Promise<object> {
    const data = Uint8Array.from(atob(encrypted), c => c.charCodeAt(0));
    const nonce = data.slice(0, 12);      // First 12 bytes = nonce
    const ciphertext = data.slice(12);     // Rest = ciphertext + tag
    const decrypted = await crypto.subtle.decrypt(
      { name: 'AES-GCM', iv: nonce }, this.key, ciphertext
    );
    return JSON.parse(new TextDecoder().decode(decrypted));
  }
}

Challenge 2: Encrypted Database Migrations

// Step 1: Schema-level migration: add the consolidated column
exports.up = function(knex) {
  return knex.schema.alterTable('payroll_elements', (table) => {
    table.text('merged_custom_types');  // New column for consolidated data
    table.boolean('is_consolidated').defaultTo(false);
  });
};

// Step 2: Application-level migration: runs through encrypted repo layer
async function consolidatePayrollElements(companyId: string) {
  // Auto-decrypts on read via SecureDbService
  const elements = await payrollRepo.getByCompanyId(companyId);
  
  const consolidated = groupByCategory(elements);
  
  for (const [category, items] of Object.entries(consolidated)) {
    const mergedTypes = items.flatMap(i => i.custom_types);
    // Auto-encrypts on write via SecureDbService
    await payrollRepo.update(items[0].id, { 
      custom_types: mergedTypes,
      is_consolidated: true 
    });
    
    // Delete duplicates — encrypted data handled transparently
    for (const item of items.slice(1)) {
      await payrollRepo.delete(item.id);
    }
  }
}

Challenge 3: Real-Time WebSocket Streaming with Encryption

# Streaming encrypted analysis results over WebSocket
async def stream_analysis_batch(websocket, batch_data, encryption_manager):
    # Recalculate formula columns — Excel formulas don't transfer as values
    if "Taxable Amount (£)" in batch_data.columns:
        batch_data["Taxable Amount (£)"] = (
            df["Expense Amount (GBP)"].values * df["%"].values
        )
    
    # Handle NumPy/Pandas types that break json.dumps
    clean_data = batch_data.replace({np.nan: None}).to_dict(orient="records")
    
    # Encrypt batch and stream — client decrypts with matching AES-GCM key
    encrypted = encryption_manager.encrypt_data(clean_data)
    await websocket.send_json({"encrypted": encrypted, "progress": batch_index / total})

Challenge 4: Multi-Tab UI Performance with Heavy Components

<!-- Dynamic component mounting: only active tab exists in DOM -->
<script lang="ts">
  let activeTab = $state('expenses');
  
  // Components lazy-load and mount only when their tab is active
  // Previous tab is fully destroyed, freeing memory
  const tabComponents = {
    expenses: () => import('./ExpensesDataTable.svelte'),
    summaries: () => import('./SummariesTab.svelte'),
    review: () => import('./ReviewPointsTab.svelte'),
  };
</script>
 
{#key activeTab}
  {#await tabComponents[activeTab]() then module}
    <svelte:component this={module.default} {data} />
  {/await}
{/key}

Database Architecture

The application uses a normalized relational database design with field-level encryption for sensitive data. The SecureDbService layer automatically encrypts/decrypts designated fields transparently to the application logic.

Core Entities

Entity Relationships

Companies (1) ─────┬───── (*) Entities
                   ├───── (*) Reports ────── (*) Entity_Reports (junction)
                   ├───── (*) PSA_Categories
                   ├───── (*) Payroll_Elements
                   ├───── (*) Annual_Events
                   ├───── (*) Analysis_Positions
                   ├───── (*) Long_Service_Awards
                   ├───── (*) Client_Gifts
                   └───── (*) Incidental_Expenses

Performance Optimization

What Users Say

Results & Impact

Project Metrics

Skills & Competencies Demonstrated

Full-Stack Development

• Frontend: Svelte 5 with runes-based reactivity ($state, $derived, $effect)
• Backend: Python FastAPI with async endpoints and WebSocket support
• Desktop: Electron with process isolation and secure IPC patterns
• Database: SQLite with Knex.js migrations and repository pattern

Security Engineering

• Cryptographic implementation: AES-256-GCM, PBKDF2, session key management
• Cross-platform encryption compatibility (Python ↔ Node.js ↔ Browser)
• Secure architecture: Context isolation, sandboxed preload scripts
• Data protection: Field-level encryption, secure local storage

Software Architecture

• Monorepo management with npm workspaces
• Clean separation of concerns across packages
• Repository pattern for data access abstraction
• Event-driven architecture for real-time updates

Data Engineering

• Complex Excel processing with 64+ column datasets
• Pandas data transformation and analysis pipelines
• Real-time streaming data processing with WebSockets
• Dynamic type detection and intelligent filtering systems

DevOps & Tooling

• CI/CD pipelines with GitHub Actions
• Cross-platform builds with electron-builder
• E2E testing with Playwright
• Auto-update distribution system

Conclusion

MinTax was a solo effort across every layer of a production-grade desktop application, from cryptographic primitives to pixel-perfect data tables. It demonstrates that I can take a complex, security-critical, data-heavy product from architecture to deployment, alone, and deliver software that 500+ professionals rely on daily.

Built solo. Shipped to production. Serving 500+ users. Generating $180K+ in annual revenue.