SHR · Stakeholder Requirements
Stakeholder Requirements
Stakeholder register, roles, concerns, priorities, technical and regulatory constraints, budget limitations, risks, and dependency assumptions for DocuWealth.
👥 1. Stakeholder Register
👨💼
Waheed (Primary User & Admin)
System Owner · Administrator · Primary Data Custodian
Responsibility
Owns all data, configures system, enters records, reviews reports
Influence
Highest — approves all features and change requests
Key Concerns
Data security, no missed deadlines, simple data entry
Access Level
Full Admin — read/write/delete all modules
👩💼
Spouse / Life Partner
Secondary User · Emergency Access · Household Co-manager
Responsibility
Views family expenses, accesses insurance documents, reviews upcoming renewals
Influence
High — co-owner of household assets
Key Concerns
Easy to use, no technical knowledge required, mobile access
Access Level
User — read all + edit family expenses and documents
👴
Parents (Father & Mother)
Beneficiaries · Insured Persons · View-Only Users
Responsibility
Their insurance, medical, and ID documents are tracked in the system
Influence
Medium — needs drive insurance module requirements
Key Concerns
Health insurance continuity, document accessibility, senior citizen benefits
Access Level
Viewer — read own documents only (optional)
🏘️
Tenants / Rental Occupants
External Party · Indirect Stakeholders
Responsibility
Their rental payment records, agreements, and contacts are tracked
Influence
Low — data subjects, not system users
Key Concerns
Privacy of personal contact info stored in system
Access Level
None — no system access
🛠️
Developer / System Maintainer
Technical Stakeholder · Builder & Operator
Responsibility
Builds, deploys, and maintains the system; applies updates and backups
Influence
High — technical decisions within agreed constraints
Key Concerns
Clean architecture, documented APIs, maintainable codebase
Access Level
Server/DB Admin — infrastructure access
🔒 2. Constraints
2.1 Technical Constraints
| ID | Constraint | Implication |
|---|---|---|
| TC-01 | Self-hosted on Oracle Cloud Free Tier (24GB RAM, 4 OCPU) | Resource-aware design; no auto-scaling |
| TC-02 | Domain: wealth.justsimple.online (existing DNS) | HTTPS via Let's Encrypt; no CDN required initially |
| TC-03 | Local PostgreSQL 15 as primary database — self-hosted on Oracle Cloud server | Full DB control; backups are owner's responsibility; no vendor lock-in |
| TC-04 | Storage: Local filesystem (primary) or AWS S3 (optional) | Backup strategy is critical for local storage |
| TC-05 | Android only (no iOS) for mobile | React Native targeting Android 10+ |
| TC-06 | Gmail SMTP for email alerts (free tier) | Max 500 emails/day; app-specific password required |
| TC-07 | Google Document AI for OCR | Per-page API cost; batch small files to reduce cost |
| TC-08 | OpenStreetMap Nominatim for geocoding (free) | Rate limit: 1 request/second; cache results |
2.2 Budget Constraints
| Item | Budget | Current Provider |
|---|---|---|
| Server Hosting | ₹0/month (Oracle Free) | Oracle Cloud Free Tier |
| Database (PostgreSQL) | ₹0/month | Local PostgreSQL on Oracle Cloud — no external DB cost |
| Domain / SSL | ~₹800/year | Existing domain |
| Document AI API | ₹0–₹800/month (low volume) | Google Cloud Pay-as-you-go |
| Email (SMTP) | ₹0 (Gmail free) | Gmail App Password |
| Push Notifications | ₹0 (FCM free) | Firebase Free Tier |
| Total Budget | ≤ ₹2,000/month | Hard ceiling |
2.3 Regulatory & Privacy Constraints
| ID | Constraint | Action Required |
|---|---|---|
| RC-01 | Personal financial data must not leave India-based servers or be shared with third parties without consent | Self-host; audit all third-party API calls |
| RC-02 | Aadhaar numbers and PAN numbers stored must be encrypted at rest | AES-256 encryption for sensitive fields |
| RC-03 | Insurance policy documents contain confidential terms — access restricted by user role | RLS policies and role-based access controls |
| RC-04 | Tenant personal data (name, phone, address) — must have clear purpose limitation | Tenant data used only for rental management |
| RC-05 | No investment advice or tax filing output — informational only | Clearly label all financial summaries as informational |
⚠️ 3. Risks & Mitigations
High
Data Loss — Server failure without backup
Mitigation: Daily automated backup of PostgreSQL to local + encrypted cloud storage (Google Drive / Backblaze B2). Recovery RTO < 4 hours.
High
Scope Creep — Unlimited feature additions delay Phase 1
Mitigation: Strict phase gates. No new features added mid-phase. Change requests logged for next phase. Phase 1 must ship on time.
Medium
Alert Delivery Failure — SMTP or FCM issues causing missed notifications
Mitigation: Alert delivery logs with retry logic. Fallback to SMS via Twilio if email fails (Phase 2). Daily health check cron job.
Medium
Low Adoption — Family members don't use the system consistently
Mitigation: Mobile-first design, WhatsApp-style notification links, simple onboarding walkthrough, family demo session at launch.
Medium
Google Document AI Cost Overrun — Volume exceeds budget
Mitigation: Rate-limit uploads to batch processing. Fall back to manual entry if AI budget exceeded. Monitor usage in Google Cloud Console.
Low
PostgreSQL Disk Full — Local storage fills up with uploaded files and DB growth
Mitigation: Monitor disk usage with weekly cron alert. Oracle Cloud Free Tier has 200GB boot volume. Archive old files to Backblaze B2. pg_dump compressed backups.
Low
Security Breach — Unauthorized access to financial records
Mitigation: JWT auth on all API routes, bcrypt password hashing, AES-256-GCM encryption of sensitive fields, HTTPS only, rate limiting, fail2ban on server, PostgreSQL accessible on local socket only.
🔗 4. Dependencies
| Dependency | Type | Owner | Risk if Unavailable |
|---|---|---|---|
| PostgreSQL 15 (local) | Self-hosted Software | Owner (Oracle Cloud) | High — core data layer; mitigated by daily backups |
| Google Document AI | External API | Google Cloud | Medium — fallback to manual entry |
| Gmail SMTP | External Service | Medium — alerts fail; retry queue mitigates | |
| Firebase (FCM) | External Service | Low — email alert as fallback | |
| Oracle Cloud Free Tier | Infrastructure | Oracle | High — must monitor free tier continuity |
| OpenStreetMap Nominatim | External API | OSM Foundation | Low — coordinates can be entered manually |
| Let's Encrypt SSL | Certificate Authority | ISRG | Low — auto-renewed via Certbot |