ClaimLens

Overview 

ClaimLens is a multi-tenant motor-insurance claims platform: a customer files a claim, OCR reads the documents, the damage photos are checked for tampering and reuse, a rules engine scores the risk and explains itself, an investigator is assigned, and the claim is approved or rejected — every step scoped to one insurer and written to an append-only audit trail. It runs as a Spring Boot API, a Next.js frontend and a Python/FastAPI image-forensics service, with a fourth Tesseract OCR service kept as an offline alternative to Google Vision.

The problem 

Insurance claims sit in a permanent tension between speed and caution. Settle too fast and you leak money to fraud; scrutinize everything and you punish honest customers while burying investigators in paperwork. Both failure modes are expensive, and a regulator will still ask why any given decision was made — a question most automated systems can't answer.

The solution 

Do the mechanical work automatically, surface only the claims that genuinely look suspicious, and record why every decision was made — so a human still owns each real decision. That demands two things most demos skip: isolation that can't be forgotten, and automation that can explain itself. Tenancy is a Hibernate @TenantId discriminator appended to every query including load-by-id, so a cross-tenant read returns 404 rather than a 403 that would confirm the record exists. And every fraud score keeps its per-rule breakdown, every RAG answer keeps its citations, every state change is audited.

Architecture 

A Next.js frontend calls a Spring Boot API that owns the claim lifecycle and PostgreSQL. Document and image work is delegated to Google Vision and a Python/FastAPI OpenCV service, whose signals feed a fraud engine and then auto-assignment. Every external client sits behind an interface with an offline default, so the system stays green without cloud keys.

Key features 

• Multi-tenant isolation enforced by a database discriminator on every query — a rival tenant gets a 404, never a 403
• Customer portal with a second ownership gate below the tenant, scoped from the JWT rather than the request body
• OCR document intake (Google Cloud Vision) extracting registration numbers, policy numbers and amounts from RC books, FIRs and repair estimates
• Image fraud forensics — perceptual-hash duplicate detection, ORB feature matching, three-state EXIF checks, and a synthetic-image signal
• Config-driven fraud engine that scores each claim and shows exactly which rules fired and why
• RAG policy Q&A grounded in the claim's pinned policy version, with citations back to the clauses
• Permission-based RBAC resolved server-side from the database — the JWT carries only a role id, never a permissions array, so a signed token can never carry stale authority
• Rate limiting on sign-in per client IP and on the cost-bearing AI and upload endpoints per user, shared across instances via Redis — and failing open, because a throttle outage must never become a login outage
• Invitation-based onboarding — a new user gets a single-use, expiring link to set their own password, so an administrator never knows anyone else's credential
• Two-way information requests — an investigator asks for a document, the customer uploads it from the portal, and the claim re-opens and reprocesses itself
• Full lifecycle — three-step intake, auto-assignment, investigation, decision — with document versioning and an append-only audit trail
• Branded HTML claim emails with an attached PDF report carrying the incident description, the decision and who made it, and the customer's uploaded photos embedded in the PDF
• Cross-tenant platform console with analytics, tenant lifecycle and impersonation

Tech stack 

My role & impact 

• Designed tenancy as a database concern — a Hibernate @TenantId discriminator appended to every query and set automatically on insert, so isolation can't be forgotten at a call site
• Built a second ownership boundary for the customer portal, since tenant scoping alone doesn't separate two customers who share an insurer
• Wrote an explainable fraud engine that keeps a per-rule breakdown behind every score, and image forensics that treats missing EXIF as neutral rather than suspicious — social apps strip it, so punishing it would flag honest claimants
• Made every external dependency swappable behind an interface with an offline default, so OCR, embeddings, chat, email and storage can each degrade instead of hanging a claim
• Treated shared infrastructure as optional rather than assumed: the permission cache and the rate limiter both fail open, so a Redis outage costs a cache hit instead of taking the service down
• Backed it with 92 integration and unit tests running against real PostgreSQL rather than H2, plus a 240-check sweep verifying every role can do exactly what it should and nothing more