Working product
Responsive web and Expo mobile experiences support the complete shift lifecycle for workers, businesses and administrators.
Technology
A working marketplace, hardening in the open.
Flex operates a functional web and mobile marketplace today, running as an early pilot deployment. This page states plainly what is implemented, where the current limits are and the engineering direction.
Live pilot deployment
The marketplace runs on AWS with open registration into a real pilot environment, kept strictly separate from resettable demo data.
Hardening in progress
Transport security, rate limiting, account recovery and fuller monitoring form the active engineering track.
Implemented today
A complete marketplace loop with real safeguards.
The core loop runs end to end: businesses post shifts, workers apply, businesses select, hours move through submission and approval, and completed work builds rating history.
Product
Working web and mobile
- Post → apply → select → timesheet → approve → rate, end to end
- Worker, business and administrator roles
- In-app notification centre on web and mobile
- Profile photos and logos with validated uploads
- Admin oversight: users, shifts, invitations, audit history
Platform
Pilot safeguards in place
- Live pilot data separated from demo data, enforced server-side
- Audited administrative controls for invitations and data scope
- bcrypt password hashing, HTTP-only session cookies, role checks
- Upload signature and size validation, server-generated filenames
- Daily integrity-checked database backups and a defined rollback point
- 35-test regression suite guarding the data-isolation model
React · Next.js 16 App Router · TypeScript
React Native · Expo Router · Expo SDK 54
Next.js Route Handlers with role-based authorization
Prisma 7 relational schema and migrations
JWT sessions · HTTP-only web cookies · mobile bearer tokens · bcrypt
AWS EC2 · ARM64/Graviton · Ubuntu · nginx
Current limitations
Known limits, stated plainly.
Single server
The application, database and uploaded media run on one AWS instance; recovery relies on backups rather than redundancy.
SQLite database
Appropriate at pilot scale today; managed PostgreSQL is planned as usage grows, with load testing informing the timing.
Transport security
The product currently runs over HTTP; trusted HTTPS arrives with the domain cutover.
Abuse protection
Rate limiting and richer request protection are in progress.
Account recovery
Email verification and password reset are not yet available; account issues are handled by an administrator.
Monitoring
Health checks and daily backups run automatically; fuller error monitoring and alerting are planned.
Positioning
An early open pilot, not a finished production platform.
Flex is an early open-pilot deployment with selected safeguards implemented. Further production hardening remains required before scaling the user base, and that work is sequenced ahead of new feature depth.
Architecture position: retain the hardened Next.js monolith while the pilot validates the product. A separate service layer and managed PostgreSQL follow when scale, integrations or team structure justify the operational complexity — a meaningful engineering step, not a configuration switch.
Work with us
Bring a real operational use case.
Flex is onboarding early businesses and workers in Greater Vancouver, with founder-led onboarding and support.