Rozka Capitals — Forex Client CRM Mobile App
Engineering a unified, high-security mobile portal for an international forex brokerage: empowering global traders to provision MT4/MT5 live and demo accounts, route crypto and fiat deposits instantly, execute atomic internal transfers, complete multi-step KYC verification, and track Introducing Broker affiliate commissions with sub-second accuracy.
Verified Live App on Google Play Store
Published and actively deployed under package identifier com.rozkacapitals.app. Designed for traders requiring instantaneous deposits, fast withdrawals, seamless account provisioning, and live MT5 account telemetry in the palm of their hands.
The Transformation: From Desktop Friction To Sub-Second Mobile Execution
In international retail forex brokerage operations, time is capital. Historically, Rozka Capitals clients relied on a legacy web back-office to generate trading accounts, submit deposit receipts manually, and await manual back-office approvals. In fast-moving currency markets, a trader missing an entry due to a slow deposit confirmation triggers anxiety, support escalation, and churn.
As lead mobile engineer, I architected and built the Rozka Capitals Client CRM Mobile App from the ground up using Flutter and Dart. By binding the app directly to Rozka's Node.js REST services, the FiveX payment infrastructure, and MetaTrader 5 trading servers, we reduced the trader onboarding and funding cycle from hours to under 60 seconds.
- Instant Multi-Account Provisioning: Clients open live or demo MT5 Standard & STP accounts in 2 taps with custom leverage up to 1:100.
- Hybrid Treasury Rails: Unified deposits across Bitcoin (BTC) with auto-generated QR addresses, bank transfers, and local mobile wallets (EasyPaisa / JazzCash).
- Atomic Internal Transfers: Zero-fee account-to-account balance shifts executed with idempotent validation, guaranteeing zero ledger drift.
- Bank-Grade 3-Tier KYC: Complete identity verification directly inside the app with camera/file document captures, multi-part upload, and live status badges.
- Full IB Affiliate Suite: Introducing Brokers generate dynamic referral links, monitor client lot volumes, and track earnings in real-time.
Verified Production Impact Metrics
End-To-End System Architecture
The mobile client was engineered with a modular separation of concerns. The presentation layer consumes typed services via clean dependency injection, caching security tokens with AES-encrypted local preferences and maintaining resilient network retry mechanisms.
[ Flutter Client Layer (Dart 3) ]
├── Presentation: Material 3 ThemedScaffold + Cosmic Gold HSL Tokens + Google Fonts
├── Core Services: AuthService • TradingAccountService • FundTransferService • IbService
├── Push & Telemetry: Firebase Cloud Messaging (FCM) + Microsoft Clarity Integration
└── App Resilience: Google Play In-App Updates (Forced) + Secure Session Refresh
│
│ HTTPS REST + Bearer JWT (Automatic Token Rotation)
▼
[ Node.js API Gateway & Middleware Layer ]
├── Auth & Device Middleware: Device ID logging, FCM token binding, IP rate-limiting
├── Environment Sanitizer: Strict URL trimming & trailing-slash normalization
└── Transaction Dispatcher: Idempotency keys for fund movements & deposits
│
┌─────┴───────────────────────┬────────────────────────┐
▼ ▼ ▼
[ MetaTrader 5 Bridge ] [ FiveX Payment Gateway ] [ PostgreSQL DB ]
• Account Creation • Bitcoin BTC Address QR • Client Profiles
• Leverage Configuration • EasyPaisa / JazzCash • Multi-Tier KYC
• Live Equity / Balance • Bank Wire Reconciliation • IB Commission Ledger
Production Screen Gallery & Technical Spotlight
Examine the authentic production user interface designed with Rozka Capitals' signature dark cosmic luxury aesthetic, warm gold typography tokens, and high-contrast financial telemetry.
01. MetaTrader 5 Account Provisioning & Equity Management
Clients can view all their active Live and Demo accounts with live balances, switch between accounts seamlessly, and inspect comprehensive financial statistics: leverage (1:100), equity, margin, and available withdrawal balances. A guided 2-step wizard allows instant creation of new MT5 accounts directly from the mobile app without administrative intervention.
02. Treasury & Payments: Deposits, Withdrawals & Atomic Internal Transfers
The mobile treasury engine connects traders to diverse international and regional payment methods. Clients can fund accounts via Bitcoin (BTC) with auto-generated crypto addresses, bank wire, or mobile wallets (EasyPaisa). Furthermore, the Internal Transfer engine lets traders move capital between MT5 standard and STP accounts with atomic precision and zero waiting period.
03. Automated 3-Step KYC Verification Flow
International financial compliance mandates rigorous identity verification before enabling unrestricted withdrawals. We engineered an intuitive 3-step wizard in Flutter: Step 1 verifies client email; Step 2 captures government photo IDs (Passport, National ID Card, Driver's License) with strict file size bounds (≤ 20MB) and mime type validation; Step 3 captures proof of residential address.
04. Introducing Broker (IB) Affiliate Ecosystem
Introducing Brokers are the growth engine of any forex broker. The Rozka Capitals mobile app provides IBs with a full partner control center: unique 8-digit referral codes with one-tap clipboard copy, metrics on total referrals, active referrals, acceptance rate (10%), lot commission tracking, deposit commission toggles, and total accumulated payout summaries.
05. Client Onboarding, Security & Sensory UX Polish
A premier forex brand requires impeccable visual and sensory polish. The onboarding suite implements strict input validation (password complexity checks, password visibility toggle, country dial code selector). In addition, background ambient sound powered by audioplayers provides a luxury experience with a visible mute switch, while Google Play forced in-app updates guarantee client security.
In-Depth Architectural Challenges & Engineering Solutions
Atomic Ledger State in Volatile Internal Fund Transfers
The Context: In Forex trading, clients frequently shift capital between Standard and STP accounts to manage open position margin requirements during high-impact economic news releases. A network timeout or double-click during transfer could result in duplicate debits or uncredited balances.
The Engineering Solution: In FundTransferService.dart, we implemented client-side idempotency tracking paired with atomic server-side transactions. Each internal transfer request packages a cryptographically unique request UUID, validating source account margin before dispatching. If the network drops mid-flight, retries carry the exact same UUID, ensuring the backend never executes double debit mutations.
Resilient Multi-Part Document Uploads & Base64 Fallback
The Context: Mobile traders submit high-resolution 48MP camera photos of passports and utility bills. Large raw image payloads caused memory pressure, slow upload timeouts on 3G/4G connections, and HTTP payload truncation.
The Engineering Solution: In CompleteApplicationPage.dart, we implemented client-side image compression prior to dispatch, constraining all document uploads strictly under 20MB. The client checks mime integrity (JPG, PNG, PDF) and encapsulates the binary in a memory-bounded streaming multi-part payload with automatic session token refresh if the JWT expires during a heavy multi-megabyte upload.
Defensive Environment URL Sanitization & Trailing-Slash Stripping
The Context: Across multi-stage releases (staging, QA, production), accidental trailing slashes or invisible whitespace in .env configurations can silently construct double-slash endpoints (//api/mobile/auth), triggering silent 404 routing failures on Android HTTP clients.
The Engineering Solution: Engineered a centralized, immutable base URL getter across all services that strictly trims leading/trailing whitespace and strips any accidental trailing slashes:
// Enforced defensive sanitization across all network clients
static String get baseUrl {
final rawUrl = dotenv.env['API_BASE_URL'] ?? 'https://rozkacapitals.com';
var trimmed = rawUrl.trim();
if (trimmed.endsWith('/')) {
trimmed = trimmed.substring(0, trimmed.length - 1);
}
return trimmed;
}
Mandatory Immediate In-App Updates for Protocol Integrity
The Context: In financial applications, allowing clients to run outdated binaries with deprecated API endpoints or security rules can expose trading operations to risk.
The Engineering Solution: Integrated Google Play's in_app_update package via a specialized UpdateService.dart. On application bootstrap, the client immediately checks Google Play update availability and invokes performImmediateUpdate(). This presents a non-dismissible Google Play modal preventing execution until the latest certified binary is installed.
Production Code Architecture Spotlight
Direct excerpts from the client's internal transfer service demonstrating clean error boundaries, asynchronous HTTP serialization, and bearer token authorization:
class FundTransferService {
final AuthService _authService;
final http.Client _client;
String get _baseUrl => '${AuthService.baseUrl}/api';
Future<Map<String, dynamic>> transferInternal({
required String fromAccountId,
required String toAccountId,
required double amount,
String? notes,
}) async {
try {
final token = await _authService.getAccessToken();
if (token == null) {
return {'success': false, 'message': 'Not authenticated'};
}
final response = await _client.post(
Uri.parse('$_baseUrl/fund-transfers/internal'),
headers: {
'Content-Type': 'application/json',
'Authorization': 'Bearer $token',
},
body: jsonEncode({
'fromAccountId': fromAccountId,
'toAccountId': toAccountId,
'amount': amount,
'notes': notes,
}),
);
final data = jsonDecode(response.body);
if (response.statusCode == 201 || response.statusCode == 200) {
return {'success': true, 'data': data};
} else {
return {'success': false, 'message': data['message'] ?? 'Failed to process transfer'};
}
} catch (e) {
return {'success': false, 'message': 'An error occurred: ${e.toString()}'};
}
}
}