Company management system

Django + PostgreSQL business system for a professional services firm (Egypt) — seeking a fixed-price quote WHAT IT IS A multi-role internal system replacing Excel-based record-keeping for an accounting / professional-services firm. It manages client companies, their payroll and social-insurance records, a supervised approval workflow, and statutory reporting. UI is English; the data is Arabic and English mixed. Scale: thousands of client companies, hundreds of thousands of employee rows. ROLES AND WORKFLOW Three roles: Employee, Supervisor, Administrator. - Everyone can view all clients; you may only EDIT clients assigned to you. - Once a record is approved ("posted"), only the Administrator may edit it. Everyone else raises an in-system Change Request with a written reason, which the Administrator reviews as a before/after diff and applies. - New clients and new employee registrations go through a two-signature approval chain. Nobody can approve their own submission - enforced in the service layer, not by hiding buttons. - A change request that has gone stale (the record moved on while it queued) must be detected and marked superseded rather than silently overwriting. MODULES 1. Accounts & security Email login, 3 roles, mandatory TOTP two-factor for Supervisor/Admin, trusted-device remembering, account lockout on repeated failures, admin-created accounts only (no self-registration), forced password change. 2. Client database Client records with multiple contact persons and one manager, many-to-many services, auto-generated client codes (race-free, DB sequence not row count), assignment of staff to clients. 3. Social insurance module One employee table answering three statutory questions - Form 1 (current roster), Form 6 (departures filed), Form 2 (POINT-IN-TIME: who was insured on a given date). Form 2 must reconstruct any past date correctly; it is not "Form 1 minus Form 6". A registration gate: employees are blocked from registration by open periods, inspections, or missing documents, with reasons shown and re-evaluated automatically in both directions on every save. Excel import with per-row validation, a preview screen showing errors by row and column, and an all-or-nothing commit. 4. Contracting insurance module Contracts with responsible engineers, a statutory 30-day objection window, deadline tracking with 5-day reminder stages, and its own approval flow. 5. Reporting 6 defined reports plus a contracts register. Filters on all of them, pagination, and every report renders to screen, PDF and Excel from one query definition. PDFs must shape Arabic text correctly. 6. Audit Two mechanisms: full row-versioning on the main tables ("what did this record look like in March?") and an append-only event log ("what did this person do?" - including logins, failed logins, approvals and exports). NON-FUNCTIONAL REQUIREMENTS (these are most of the cost - please price them) - Arabic search: letter-variant and diacritic normalisation so "احمد" finds "أحمد", with trigram indexing for fuzzy matching. No second search engine. - No hard deletes anywhere - soft delete only, for statutory retention. Uniqueness constraints must be partial (unique among non-deleted rows). - Content-Security-Policy with script-src 'self' - NO inline JavaScript or inline styles anywhere, enforced by tests. - Object-level permission checks in every view (IDOR-safe), not template logic. - National IDs masked in lists, full value only on detail pages, and viewing one writes an audit event. - Excel export must neutralise formula injection. - The data is regulated personal data under Egypt's PDPL 151/2020. Retention, access control and audit are requirements, not nice-to-haves. - Automated tests are required, not optional. Expect the test suite to be comparable in size to the application code. - Deployment: Docker Compose on a VPS, HTTPS with automatic certificate renewal, database backup and tested restore, a deployment runbook. STACK (open to discussion, but this is what it is built for) Django 5.x / Python 3.12, PostgreSQL 16, Docker Compose, gunicorn, Caddy, server-rendered templates + htmx + Bootstrap 5 (no Node build step), WeasyPrint for PDF, openpyxl for Excel. WHAT I NEED FROM YOU 1. A fixed-price quote, broken down by the six modules above. 2. Your estimate in weeks, and how many people. 3. What you would price separately or push back on. 4. One example of a comparable system you have delivered. Please quote the whole scope. I am specifically interested in how you price the non-functional section, because that is where estimates usually diverge.