Initial Consulation for Web Application

I would like 1 hour of your time in a meeting and 1 hour of your time writing recommendations on what we have discussed. There is most certainly opportunity for future work. I'm building a B2B web application in the financial admin space. It handles calculations and generates files that customers use elsewhere — the platform itself never holds or moves money. Multiple organisation types with different levels of access to shared records. Stack is Next.js, TypeScript, Prisma and PostgreSQL on Neon. Built with AI assistance, no independent review to date, not live yet — test data only. That's why I'm reaching out. Five things we can discuss (recommendations on what to do next are also a suitable answer): 1. Is the architecture sound enough to keep building on? Several distinct user types with overlapping access to the same records. Does a foundation like that hold, or is it the kind of thing that needs restructuring before more goes on top? 2. Security around sensitive financial data. The app stores information that, if altered, would send money to the wrong place. My concern isn't so much theft of the database as someone getting into a legitimate account and changing a field. I've been advised encryption at rest, a one-time code before changes, and alerting the account holder. Is that the right set, what's missing, and how would you sequence it against getting core functionality finished? 3. Audit logging. There's currently no record of who changed what, and I understand it can't be added retrospectively. Worth building now? And would routing database writes through consistent service functions today make it cheaper to add later? 4. Third-party integrations. Accounting software integration is likely down the track, and a regulated third-party financial service after that. Let's discuss feasibility - particularly with xero invoices integration for bank lince reconciliation and futue integration with an Australian Superannuation Clearing House 5. What would you do differently? Open question. Anything that stands out, and anything I should be asking that I'm not. Thanks