What actually happens when someone books.
Seven chapters. No jargon. Every number is real, every gap is named. Tap any card to translate the tech into plain English.
The customer sees one form.
They open the site, pick a service, pick a slot, tap book. From their side, that is the whole thing.
It is a diary that never gets lost.
Like the paper booking sheet at a salon, except every entry is instantly copied to the office, the cleaner's phone, and the invoice file. All at once, all the same.
Tap for the tech267 hand-built pages. One PHP file per endpoint.
No React. No Vue. No build step. The booking form posts to a single PHP file that checks it, writes it to Airtable, and returns a reference number. Nothing else runs.
Tap to go backUnpaid by the server. Nobody, not even an admin, can mark a booking paid without an actual payment coming through.
Two South African gateways.
The customer picks Ozow or Yoco at checkout. Both handle the money and confirm it back to us with a signed message.
Two cashiers, one receipt book.
Ozow is the speed counter, instant EFT and card, done in seconds. Yoco is the card machine at the till. Both stamp the same receipt and send a copy straight to us.
Tap for the techOAuth2 and signed webhooks. HMAC-SHA256.
Ozow uses OAuth2 with a 5-minute timestamp window. Yoco uses a bearer token. Both send back a signed message only they can produce. If the signature does not match, the payment is rejected and logged.
Tap to go backWhere the booking actually goes.
Everything lives in one place: Airtable. Three bases, 66 tables in the main one. Nothing sits in two places.
One shared notebook. Everyone sees the same page.
Imagine a big shared notebook the whole team can read at once. When one person writes a line, everyone's copy updates. Nobody is working from an old page.
Tap for the techAirtable behind a single PHP gateway.
Every request to the data layer passes through one file. It decides what is allowed in, what gets stripped, and what value is forced regardless of what the client sends.
Tap to go backA booking, minute by minute
Customer taps book
Form posts to the server. Reference generated. Payment status forced to Unpaid.
Gateway link sent
Ozow or Yoco gets the amount, read from our booking, never the browser.
Payment confirmed
Signed webhook arrives. Signature verified. Replay check passes. Booking flips to Paid.
Both sides notified
Email fires to the office and to the assigned partner. No manual step.
Job shows up in the workspace
The partner opens their workspace and the job is already there, already paid.
Partners and staff see the job instantly.
Once a booking is paid, it appears in the right workspace, customer, partner or admin, with the right permissions on each.
Three doors, three keys.
Customers open one door. Partners open another. Staff open the third. Each door shows only what that person needs to see, no more.
Tap for the techThree account tables. Cookie-based sessions. Signed in one place.
Users, Clients and Team Members are separate tables. Login picks the right one, sets a secure cookie on the domain, and sends the person to the right workspace.
Tap to go backNothing gets lost, nothing gets duplicated.
Every payment, invoice and expense is logged with a timestamp. When something does not match, it is visible immediately.
Every rand has a paper trail.
From the moment a customer pays, the record exists in three places: the gateway's log, our log, and the booking itself. If any of the three disagree, we would know.
Tap for the techWebhook log plus dedup plus notification stream.
Every webhook stores its transaction ID. A replayed message gets rejected. Every state change fires a notification email: completed, failed, cancelled, refunded.
Tap to go backSecurity, uptime, backups.
The parts nobody sees, but the parts that decide whether you sleep at night.
A locked front door, a paper shredder, and a smoke alarm.
HTTPS on every page. Passwords never stored in the open. Payments verified by signature. Not glamorous, but it is the difference between a business and a cautionary tale.
Tap for the techHSTS, CSP, SameSite cookies, signed webhooks, dotfile blocks.
Strict content-security policy. Framed pages blocked. HTTPS enforced for a year. Dotfiles, backups and config files blocked at the server. Both gateways reject unsigned webhooks with 401.
Tap to go backAlready built. Still improving.
The platform ships today and runs a real business. These are the next pieces, in plain language.
A workshop that never closes for renovation.
Everything already works. New tools get added at night, tested, and swapped in when they are ready. Nothing stops for an upgrade.
Tap for the techNo scheduled tasks yet. No monitoring yet. Both coming.
Deploys are a file copy. No pipeline, no downtime. The platform runs on any standard host with PHP 8.2. Moving it elsewhere is a tarball and a config file.
Tap to go backSimple by choice. Portable by design.
Any standard host with PHP 8.2 can run this. No framework to migrate. No bundler to maintain. The code is the deployment.
Talk to us