Architecture & rollout
How the MVP scales to production
Phase 1 — Navigable MVP (done)
- All five role experiences in English, USD, US units and formats
- Request flow under a minute: service type, location, notes, photos
- Live auction with timer, lowest-bid highlight and counter offers
- Company, dispatcher and admin consoles with mock data
Phase 2 — Backend & accounts
- Postgres + row-level security, roles: customer, company, dispatcher, driver, admin
- Email/password and phone (SMS) sign-in, password recovery, rate limiting
- Realtime bid channel, auction close and notify-losers job
- Document upload and verification workflow
Phase 3 — Maps, payments, notifications
- Google Maps: geocoding, routes, ETA, live driver markers
- Stripe: cards, Apple Pay, Google Pay, authorize on accept / capture on complete
- Automatic 5% application fee and Connect payouts
- Push, SMS and email for request, bid, acceptance, en route, arrival, completion, payment
Phase 4 — Intelligence & scale
- AI ranking on distance, traffic, history, rating and equipment capacity
- Backhaul matching and triangle-mode corridor search
- Fraud scoring, dispute tooling and audit logs
- Analytics warehouse, reports and 1099-K exports
Data model
users
id, role, name, email, phone, verified_at
companies
id, legal_name, dot_number, insurance_expires_at, status
drivers
id, company_id (nullable), cdl_number, availability, last_location
jobs
id, ref, customer_id, service_type, tractor, trailer, load, weight_lb, pickup, dropoff, miles, status
bids
id, job_id, bidder_id, price, eta_minutes, status, counter_price
job_events
id, job_id, status, actor_id, photo_urls, created_at
payments
id, job_id, stripe_payment_intent, amount, fee_amount, captured_at
notifications
id, user_id, channel, template, payload, sent_at
Security model
- Roles stored in a separate user_roles table, never on the profile record
- Row-level security on every table; bidders can read final prices but never winner identity
- Customer contact details released only to the accepted bidder
- Server-side validation on every write, plus spam and rate-limit protection on bids
- Audit log of status changes, transfers and payouts