Built in 1.5 Weeks, Saved 1,000+ Hours. Meet Nexus — Deel's Internal App Store.

 

 

 

 

We gave everyone at Deel the ability to ship software.

 

Not "submit a request" or "wait for bandwidth." Actually ship - in under 5 minutes.

 

Nexus is our internal app store. It was built in 1.5 weeks using Claude Code without a single line of handwritten code. 48 apps are live. One engineer maintains the whole platform.

 

 

The clearest way to explain Nexus is to show what gets built on it.

 

Every new Deel hire submits the same information before day 1 - address, tax details, bank info, emergency contact. For years, this ran on Typeform. HR sent a link, the hire filled it out, and someone downloaded the export, cleaned it up, and manually pushed the data into the systems that needed it. A few minutes per hire - longer when a field meant something different in Brazil than in Germany. At 125 new hires a month across 100+ countries, that's 25 hours of manual data-entry work every month.

 

Someone on HR built a Nexus app and eliminated the problem entirely. The form knows which country you're in and asks only what's relevant. Data lands directly where it belongs. The cleanup step is gone.

 

When a Deel AE gets off a call with a prospect, someone used to listen back to the recording, write down the requirements, cross-reference SKUs, check availability per country, and put together a scoped proposal by hand. Three to four hours per deal.

 

Someone built the AI SE Copilot on Nexus. It reads the call transcript, extracts the hardware requirements, and produces the proposal. Review takes 15 minutes. Proposals that took 3 days now go out the same day.

 

Below are some of the tools saving 100+ hours per department, every month.

 

 

Deploying an internal app used to take a DevOps engineer 1-3 days. Now it happens while you're getting coffee.

 

You open Nexus in your browser, sign in with your Deel account, and point it at a GitHub repo. No second form. No infrastructure menu. No dropdown asking you to pick a database tier.

 

Nexus reads your code and figures out what it needs. Database packages in your dependencies? It provisions a database. Storage libraries? File storage appears. The platform infers everything.

 

Then three buttons:

 

Scan - checks your project against Deel's standards

 

Test - builds it in a clean environment

 

 

Your app is live at its own URL, secured, and ready for your team to use.

 

The Engineering Behind Nexus

 

 

It verifies whether the repo matches Deel's tech policies.

 

Fetch all repo files from both default and dev branches in parallel.

 

Run seven static checks: package.json, Node v22+, lock file, package manager, next.config, AWS S3 SDK, and database packages.

 

Send the file snapshot to Gemini 2.5 Flash at temperature 0.1 to verify the stack.

 

Static checks catch about 80% of cases on their own. Static evidence can override a false-positive Gemini rejection, so if next.config exists on disk, the platform approves regardless of what the model says.

 

Auto-patch values.yaml on both branches when the scan detects pg or sequelize (enables the database) or @aws-sdk/client-s3 (enables file storage).

 

 

Builds a production container and verifies it is safe to ship.

 

Generate a multi-stage Alpine Node Dockerfile targeting next build --standalone.

 

Commit the Dockerfile to the dev branch.

 

Dispatch a GitHub Actions workflow that runs npm ci && npm run build.

 

Poll until the workflow completes.

 

On failure, Gemini 2.5 Flash diagnoses the logs and returns a root cause with a concise fix.

 

 

Twelve sequential sub-steps provision every piece of production infrastructure.

 

Commit the Dockerfile and patch next.config for standalone output.

 

Create an AWS ECR repo with a lifecycle policy that keeps three images.

 

Generate the ArgoCD Application manifest and commit it to argocd/{name}.yaml.

 

Push all env vars to AWS Secrets Manager as JSON, so secrets never touch Git.

 

Generate values.yaml with image URI, resource limits, ingress, and optional DB or S3 config.

 

Write .github/workflows/ci.yml using OIDC federation, so no long-lived AWS keys sit anywhere.

 

Assign the project an https://{name}.dp.com URL.

 

Create and merge the setup PR into dev, then delete the setup branch.

 

Merge dev into main and register the ArgoCD app.

 

Create a filtered merge that includes only user code, excluding helm/, .github/, and the Dockerfile, so user PRs can never overwrite platform infrastructure.

 

ArgoCD watches main/helm/ and auto-syncs to Kubernetes with CreateNamespace=true, auto-prune, and self-heal.

 

Pod is live in <5 mins end-to-end.

 

 

It uses two AI paths, both using Gemini 2.5 Flash with structured JSON output.

 

Build failures. Nexus sends the GitHub Actions logs with a prompt asking for root cause and a concise fix, at temperature 0.2.

 

ArgoCD deploy failures. Nexus sends the ArgoCD condition type, the message, and three files (values.yaml, Dockerfile, ci.yml) through the same path, at temperature 0.1. Near-deterministic by design.

 

 

There is layered security, applied by default which cannot be skipped.

 

Auth. Google OAuth with @deel.com domain enforcement at login.

 

Sessions. JWT with 8-hour TTL. Admin status refreshed every five minutes.

 

Tenancy. Every API route calls findProjectForUser(). No cross-tenant access.

 

Secrets. Env vars live in AWS Secrets Manager, synced into Kubernetes through the ExternalSecret operator. Never in Git.

 

Isolation. Every project gets its own namespace with resource limits. CPU 100m to 500m, memory 256Mi to 512Mi.

 

CI/CD. GitHub Actions uses OIDC federation via aws-actions/configure-aws-credentials@v4. No long-lived keys are stored anywhere.

 

Network. VPN enforcement at the network level. All *.dp.com endpoints are internal-only by design.

 

Supported stack today

 

 

TypeScript or JavaScript

 

 

 

Optional Postgres via Sequelize

 

 

Auto-generated Alpine Dockerfile

 

 

 

The three steps today are a safety measure, because steps 1 and 2 are what make step 3 succeed 99% of the time. The whole “deploy” runs in two to five minutes. A single click will replace the three steps in the near future.

 

 

Every tool on Nexus started as a problem someone was living with - one that never got fixed because the cost of building the solution was higher than the cost of tolerating it.

 

That calculation hits harder at a remote-first company operating across 100+ countries, where every handoff crosses a timezone. Nexus removes the handoff. Someone in São Paulo ships at 2pm without waiting for San Francisco to wake up.

 

 

48 apps is the surface count. What they actually represent is 48 pieces of institutional knowledge that used to live inside someone's head and now live inside production software. Years of tribal knowledge, encoded. Anyone can use them in a single click.

 

You can't buy this from a vendor. No off-the-shelf platform ships with workflows tuned to how Deel actually operates. The tools are valuable precisely because they're specific to us.

 

Most companies die by a thousand cuts - hundreds of tiny frictions, each one too small to justify fixing, collectively draining enormous amounts of time and energy. This is the default state of a scaling company.

 

Nexus made the cost of fixing them nearly zero.

 

So they're getting fixed. Every new app raises the baseline for the team using it. And every week there are more of them.