Multi-Tenant Address and Last-Mile Delivery Platform

Couriers in the client's market often cannot find the door from a written address, so deliveries fail and drivers phone the customer for directions. Customers who shared a home address with a courier had no way to take that access back. Delivery companies ran driver onboarding, document expiry, vehicles and packages in separate tools. The client needed one platform for consumers, businesses, delivery companies and its own operators, sold as subscription SaaS.

Every address gets a short ID derived from the owner's phone number and address type. It can be read out over the phone or shown as a QR code, and it resolves to an exact point plus access instructions. Owners decide who sees a private address: a courier gets a share link that expires, or submits an access request stating a purpose that the owner approves or rejects. Businesses keep one address book for head office, branches and temporary sites. Delivery companies onboard drivers, track document expiry and dispatch packages from one portal.

Five audiences had to share one backend while each organisation kept its own data and branding. Addresses had to be found by distance, not only by exact match. Sign-in had to work for users who only have a phone and no password. Sensitive data sent from the mobile apps needed protection on top of standard transport encryption.

One API serves all five clients. Each organisation is a separate tenant with its own data, colours, logo, language, timezone and currency. Addresses are indexed for geo-distance search. Sign-in uses a one-time code sent over WhatsApp or email. Sensitive mobile payloads are encrypted end to end at the application layer.

Six codebases (an API, three web portals and two mobile apps) had to move together, so a change to an address or delivery rule reached every client at once. Scope was held against an agreed feature list while the product design kept evolving, and the client ran its own QA rounds against the live build.

We wrote the requirements, the source-code reference and a security control checklist alongside the build, and tracked every agreed line item against the code. Client QA findings were triaged item by item, fixed in each affected codebase and retested against the live environment.