Repulabs

Repulabs serves Australian local and multi-location businesses that depend on public reviews for new custom. It closes a gap most reputation tools leave open: software alone can only reach a customer once the visit has ended, by which time intent has decayed. Repulabs pairs the application with printed QR stands, plaques and NFC cards placed at the point of service, so the ask happens while the customer is still present.

Every scan is recorded, which yields what software-only competitors cannot produce: measured scan-to-review conversion per unit, per location, per day. Revenue comes from subscriptions billed per location, with hardware sales as the acquisition channel into them.

Tenancy is not enforced in application code. Every tenant query runs in a transaction that switches to a Postgres role without bypass rights, then sets a per-request organisation identifier that row-level security policies read. 79 tables carry an organisation column, 76 have row-level security enabled, 47 force it even for the table owner, and 77 policies are defined. A forgotten filter cannot return another tenant's rows, because the database will not hand them over.

Each unit carries a ten-character Crockford base32 slug, and the public scan endpoint is the only internet-facing surface that must stay fast and abuse-resistant while still writing analytics. On scan it applies a per-IP and per-slug rate limit, resolves the device, verifies an HMAC signature computed at activation over the slug, the destination and an expiry, emits a scan event deduplicated by a hash of slug, IP and hour bucket, then redirects.

The signature is the interesting decision. Without it, anyone able to write to the redirect column could silently repoint printed hardware already sitting on counters at destinations the business never chose. Verifying at read time means a tampered row fails closed rather than sending customers somewhere hostile.

The device also runs a real state machine: unactivated inventory, active and bound, retired into a recoverable trash, and released back to unactivated so the same physical unit can be configured again. Activation is race safe, claiming only when the row is still unactivated and unowned, so two people scanning the same stand at once cannot both bind it. The scan write is fire and forget, so analytics never delay the redirect.

ARCH