/ Docs / System Architecture v1 Β· 2026
Overview Β· Architecture

System Architecture

How the apps, the Go backend, the Cloudflare edge, the data stores and the third-party integrations fit together β€” optimized for low cost, offline-first villages, and scale to millions.

1. Architectural principles

πŸ’Έ

Platform holds no money

All funds sit in the payment gateway's escrow and split directly to partners/Points. No RBI nodal account.

πŸ“΄

Offline-first

Apps queue actions locally and sync; the network is treated as unreliable by default.

🧱

Modular monolith first

One Go binary with clean module boundaries; extract services (match/geo) only when scale demands.

⚑

Push work to the edge

Cloudflare Workers terminate static, cache, rate-limit and auth-precheck before origin.

πŸ”

Money is an append-only ledger

Every rupee movement is an immutable event; balances are projections. Auditable by design.

🧩

Idempotent & event-driven

Every external call (PG, SMS, KYC) is idempotent and webhook-reconciled; nothing assumes a single happy reply.

2. High-level topology

flowchart TB
  subgraph Clients["Client surfaces (Flutter + Web)"]
    PA["πŸ“± Partner app"]
    BA["πŸ“± Book app"]
    DA["πŸ“± Dispatch / Hub"]
    WEB["πŸ’» Next.js PWA
web booking + admin"] WA["πŸ’¬ WhatsApp bot / IVR"] end subgraph Edge["Cloudflare edge"] CF["CDN Β· WAF Β· DNS
Workers (auth precheck, cache, rate-limit)"] R2["R2 object store
POD photos Β· KYC docs (no egress fee)"] end subgraph Core["Go backend (modular monolith)"] GW["API gateway / BFF
REST + WebSocket"] AUTH["Auth + KYC module"] BOOK["Booking + state machine"] MATCH["Matching engine"] GEO["Geo + routing"] PAY["Payments + escrow + ledger"] NOTIF["Notifications"] FRAUD["Fraud / trust scoring"] end subgraph Data["Data stores"] PG["🐘 PostgreSQL + PostGIS
(ACID core, ledger, geo)"] REDIS["⚑ Redis
live locations Β· ETA Β· surge Β· queues"] end subgraph Ext["Third-party"] RZP["Razorpay (primary)"] CFP["Cashfree (fallback + Easy KYC)"] VAHAN["VAHAN / Sarathi"] MAPS["Maps + OSRM"] SMS["SMS / IVR / WhatsApp API"] FCM["FCM push"] end PA & BA & DA & WEB --> CF WA --> NOTIF CF --> GW CF --- R2 GW --> AUTH & BOOK & MATCH & GEO & PAY & NOTIF & FRAUD AUTH --> CFP & VAHAN PAY --> RZP & CFP GEO --> MAPS NOTIF --> SMS & FCM Core --> PG & REDIS classDef e fill:#fff3e0,stroke:#f4920b,color:#8a5200; classDef c fill:#e7f4ec,stroke:#1b7f4b,color:#115c36; classDef d fill:#e8f0fb,stroke:#1f5fae,color:#143d6e; class CF,R2 e; class GW,AUTH,BOOK,MATCH,GEO,PAY,NOTIF,FRAUD c; class PG,REDIS d;
End-to-end topology. Clients reach the Go core through the Cloudflare edge; the core orchestrates payments, KYC, geo and notifications via third-parties, persisting to PostGIS (ACID + geo) and Redis (live/hot).

3. Client architecture (Flutter + Next.js)

One Flutter codebase produces three flavors (Partner / Book / Dispatch) β€” shared design system, i18n, maps, networking and an offline sync layer; role-gated screens differ. The Next.js PWA serves public web booking + the ops/admin console.

LayerChoiceWhy
App frameworkFlutter (Material 3)One team, small APK for low-RAM devices, great offline + maps
StateRiverpod / BlocPredictable, testable, survives process death
Local storeDrift (SQLite) + outbox queueOffline-first: actions persist and replay on reconnect
RealtimeWebSocket (live track) + FCM (push)Battery-aware location streaming; push for offline jobs
WebNext.js PWAPublic booking without an app + admin dashboards; installable
i18nHindi-first, vernacular + audioLow-literacy users; icon/photo-led UI

4. Backend modules (Go)

A single deployable Go binary, internally partitioned into modules with explicit interfaces so the hottest ones (matching, geo) can be peeled into their own services later without rewrites.

ModuleResponsibilityDeep-dive
authPhone-OTP, sessions, RBAC, Cashfree Easy KYC, VAHAN/Sarathi, liveness, trust tiersOnboarding & KYC
bookingBooking lifecycle & state machine, parcels, legs, OTP/POD, cancellation/refundBooking flow
matchingEligibility matrix, scoring, dispatch cascade, bundling-first, fairnessMatching
geoLive locations, geofencing, addressing, routing (OSRM), VRP batching, ETAGeo Β· Routing
paymentsGateway abstraction (RZP→CF), escrow hold/release, append-only ledger, split, payouts, reconciliationPayments · Split
pricingFare formula, vehicle rates, tiers, surge, commission/take-rateCommission
notifyFCM, SMS, IVR, WhatsApp; templated multilingual messagesβ€”
fraudDevice/SIM fingerprint, mock-location, velocity & graph anomaly, trust scoringEdge cases

5. Data stores

PostgreSQL + PostGIS is the ACID system of record β€” transactional bookings, the append-only money ledger, and geospatial queries (nearest partner, geofence containment). Redis holds hot/ephemeral state: live partner GPS (geo sets), ETAs, surge multipliers, OTP caches, dispatch queues, rate-limit counters. Cloudflare R2 stores POD photos and KYC documents (no egress fee β€” a real saving at scale).

Money tables are append-only. escrow_ledger, payout, wallet_txn are never updated in place β€” balances are computed projections. This makes reconciliation and audit deterministic. See Split-Money Settlement.

6. Core data model

erDiagram
  USER ||--o| PARTNER_PROFILE : has
  USER ||--o{ BOOKING : books
  PARTNER_PROFILE ||--o{ VEHICLE : owns
  PARTNER_PROFILE ||--o{ KYC_DOCUMENT : submits
  PARTNER_PROFILE }o--o{ RIDECHAIN_POINT : serves
  BOOKING ||--|{ PARCEL : contains
  BOOKING ||--|{ LEG : "splits into"
  LEG }o--|| PARTNER_PROFILE : "assigned to"
  LEG }o--o| RIDECHAIN_POINT : "from/to"
  BOOKING ||--|| PAYMENT : "paid by"
  PAYMENT ||--|{ ESCROW_LEDGER : records
  LEG ||--o| PAYOUT : "releases"
  BOOKING ||--o{ RATING : rated
  BOOKING ||--o{ FRAUD_SIGNAL : flags
  USER {
    uuid id
    string phone
    enum role
    string lang
  }
  BOOKING {
    uuid id
    enum status
    enum pickup_mode
    enum drop_mode
    enum speed_tier
    int total_fare_paise
  }
  PARCEL {
    enum category
    enum size_bucket
    enum weight_bucket
    int declared_value_paise
    bool fragile
  }
  LEG {
    int seq
    enum status
    string pickup_otp
    string drop_otp
    int payout_paise
  }
  ESCROW_LEDGER {
    uuid id
    enum entry_type
    int amount_paise
    string gateway_ref
  }
        
Core entities. A Booking decomposes into ordered Legs (one for direct, many for relay/milk-run); money splits per leg via the escrow ledger. Partners serve many Points (coverage) but each parcel is custody-locked to one Point + one partner per leg.

7. Anatomy of a booking request

sequenceDiagram
  autonumber
  participant App as Book app
  participant CF as Cloudflare edge
  participant GW as Go API
  participant PR as Pricing
  participant PAY as Payments
  participant MA as Matching
  participant PT as Partner app
  App->>CF: POST /bookings (params)
  CF->>GW: forward (auth prechecked)
  GW->>PR: quote(size,weight,vehicle,geo,tier)
  PR-->>GW: fare + breakdown
  GW->>PAY: create escrow order (Razorpay β†’ fallback Cashfree)
  PAY-->>App: payment intent
  App->>PAY: pay (UPI/wallet)
  PAY-->>GW: webhook: captured (idempotent)
  GW->>MA: dispatch (bundling-first β†’ on-demand)
  MA->>PT: offer leg(s)
  PT-->>MA: accept
  MA-->>App: partner + ETA (live track begins)
        
The booking happy path. Pricing, payment (with gateway fallback), and matching are distinct idempotent steps; the webhook β€” not the client reply β€” is the source of truth for payment capture.

8. Third-party integrations

ConcernProviderNotes
Payments + splitRazorpay Route (primary) Β· Cashfree Easy Split (fallback)Success-rate routing behind a thin gateway interface; escrow + per-leg split
KYCCashfree Easy KYCAadhaar OKYC, PAN, bank/UPI penny-drop, name/face match
VehicleVAHAN (RC) Β· Sarathi (DL)Motorized partners only; cycle/cart skip
Maps / routingMaps SDK + self-hosted OSRMOSRM on rural OSM extracts keeps routing cost ~0
MessagingSMS Β· IVR Β· WhatsApp Business API Β· FCMNo-app booking + OTP + status; multilingual templates
Object storageCloudflare R2POD photos, KYC docs β€” no egress fees

9. Security & compliance posture

10. Deployment & environments

Containerized Go binary on low-cost compute behind Cloudflare; managed Postgres with read replicas and Redis. Three environments (dev / staging / prod) with separate Razorpay & Cashfree test vs live keys (both already held under Wetware). CI runs go vet, race tests, and the docs publish-doc link/asset checks. Detailed cost & scaling model in Scale & Low-Cost.