Serverless Backend Developer — Credit-Pull Funnel from Beta to Production

Serverless Backend Developer — Take a Credit-Pull Funnel from Beta to Production (Cloudflare + Supabase + Third-Party Credit API) About the project We are a credit repair company. We run a marketing funnel where a visitor watches a video sales page, enters their contact info, then their SSN, and our system pulls their credit report through a partner credit monitoring API, emails them a secure link to their results, and shows them a booking calendar to schedule a call with a credit specialist. This is a production system handling SSNs and credit data — security discipline is non-negotiable. Important: the frontend is done. All pages will be handed to you as finished, custom-designed HTML. Your job is 100% the backend mechanisms underneath them. What you'll be handed Finished HTML/designs for every page (VSL, contact form, SSN step, results, booking) A working beta (Next.js 15 / TypeScript) deployed on Vercel that you can check out — it proves the full credit-pull flow works against the vendor's staging environment: API authentication → enrollment → identity verification (KBA) → report pull and parsing. It's a proof of concept, not production-ready; your job is to take it to production. Vendor API docs, staging credentials + test identities, Supabase project, CRM access What you'll build Deploy the funnel to Cloudflare (we want off Vercel — see question below) Take the credit-pull flow from beta to production — the core job: contact → SSN → enrollment → KBA identity questions → report pulled, reliable and fast under real traffic, with proper error handling for failed pulls and failed KBA Supabase as the system of record — contact created on first form submit, funnel stage tracked at every step (contact created / SSN entered / KBA passed / report pulled / call booked), sessions stored in Supabase (the beta uses in-memory sessions — must be replaced). We handle everything downstream of Supabase ourselves (CRM sync, conversion events) — you just need to write clean stage data to it. Custom booking calendar backend — our designed calendar page needs an endpoint that pulls real-time availability from our CRM's calendar API (4 specialists, round-robin) and creates the booking Secure report delivery — expiring emailed link, DOB-gated; reports are never attached to emails Answer these in your proposal (proposals that skip them are ignored): The beta stores sessions in an in-memory Map. What happens to that on Cloudflare, and what would you replace it with? Would you keep the app on Next.js (via the OpenNext Cloudflare adapter) or rebuild the backend as native Cloudflare Workers (e.g., Hono), reusing the beta's API client code? Justify either way — we're open, but the working integration logic should be ported, not rewritten from scratch. Strong TypeScript + serverless experience (Cloudflare Workers and/or Next.js App Router) Supabase (Postgres, RLS) in production Third-party REST API integration experience with token lifecycles (token refresh, retries, vendor quirks) PII discipline: secrets server-only, redacted logging, no SSN persistence — ever NDA required; access is to staging/test credentials until launch Scope & terms: Fixed-price milestones (Cloudflare deploy → credit-pull production flow → Supabase integration → booking calendar).