Agencies must never see each other
Every agency’s clients, bookings and documents live in one shared platform and must be completely separated.
Case study · Travel & hospitality · In development
Taking East African travel agencies from WhatsApp and spreadsheets to a secure operating system.
A multi-tenant platform for travel agencies covering bookings, visas, invoicing and branded documents, developed alongside a paying design-partner agency.
- 9
- operational modules built
- 18
- data models in a single shared schema
- 1
- paying design-partner agency
Many travel agencies in East Africa still run on WhatsApp, paper and spreadsheets. Tickets, vouchers and invoices are assembled by hand, client records are scattered, and owners lose hours each day to paperwork.
TravelOS is being built with a working agency as design partner, so every module is shaped by real daily operations rather than assumptions.
The challenge
What made it hard.
Their brand, not ours
Agencies send documents to their own customers, so output must carry the agency’s identity, on the agency’s own subdomain.
Local payments
Subscriptions have to work with mobile money as well as international cards.
Our approach
How we solved it.
- 01
Database-level isolation
Row-level security policies in PostgreSQL enforce tenant separation beneath the application layer.
- 02
Document factory
A form becomes a branded PDF ticket, voucher or invoice, emailed to the client and saved to their record automatically.
- 03
Security by default
Signed file URLs, HTTP-only sessions, rate limiting, an explicit cross-origin allowlist and verified payment webhooks.
- 04
Simplified architecture
A separate API service was consolidated into the main application, reducing the attack surface and the operational load.
Highlights
Also delivered.
- White-label subdomains per agency
- Plan-based feature access
- Card and mobile-money billing
Technology
The stack.
- Next.js
- TypeScript
- PostgreSQL
- Prisma
- Row-level security
- Turborepo
- Sentry
What comes next
Before launch: automated tenant-isolation tests, a CI build gate and broader test coverage, held to the same standard as our other platforms.
Hurbad, Watin, TravelOS and CaafimaadAI are platforms built and operated by the Resolv team as our own ventures. We publish them because they are the clearest evidence of how we work: the same people, standards and methods we bring to client engagements.
More work
Other platforms we have built.
Education · Live in production
Hurbad LMS
Moving a 14,800-student learning platform off WordPress without a single forced password reset.
Education · Live on iOS and Android
Hurbad Mobile
A native learning app for iOS and Android, engineered to pass app-store payment policy by design.
Financial services · Live platform
Watin
A compliance-first accounting and e-invoicing platform engineered for a national tax mandate.
Health & wellness · In development
CaafimaadAI
AI skin readings with biometric privacy designed in from the first line of code.
Want this standard on your system?
A senior engineer reviews every enquiry and replies within one business day.