Engineered for Drífa, from the ground up.
Drífa is Iceland's national tyre marketplace, a complete, built-from-scratch e-commerce platform that unifies every major supplier into one intelligent search, compare, and booking experience, with live cross-supplier pricing at national scale. Behind the storefront runs a full operations stack: role-based portals, a custom CRM, a daily supplier-data engine, automated payments, and a programmatic growth system.
One of the production systems we have engineered for demanding Icelandic operations. Detailed outcomes, metrics, and references available on request.
- A complete tyre e-commerce platform built from scratch, search, cart, multi-rail checkout and live payments
- Plate-to-fitment search wired live into Iceland's vehicle registry, matched across every supplier at once
- Operations, supplier, B2B fleet and customer-CRM portals on a scalable Supabase backbone
- A daily data engine of supplier integrations, EU-label enrichment, and programmatic SEO
A system of systems.
Drífa is not one product but a connected platform of purpose-built systems, each engineered to do one job exceptionally well.
Tyre Search Engine
Live-connected to Iceland's vehicle registry, the Tyre Search Engine resolves fitment at the source, a single license plate fans out through a Supabase edge function to mitra.is, returning the car's exact front-axle and rear-axle dimensions, alternative approved sizes, load and speed ratings, which the catalogue then splits into separate front and rear fitment lists and even surfaces a dedicated Electric Vehicle tyres lane for EVs. It handles both metric (205/55 R16) and imperial flotation sizing for jeeps and SUVs, transparently encoding inch measurements into the catalogue's internal scheme so a 35x12.5 R15 search lands on the right rubber, and it can read a worn sidewall straight from a phone photo via OCR when the plate isn't enough. Every result is filtered live across all Icelandic suppliers at once, real price, real stock and reserved-stock counts, and full EU-label grades for fuel efficiency, wet grip, noise and the 3PMSF snow and ice pictograms. Beneath the search layer sits a demand intelligence engine: every distinct size, vehicle type and region in the live inventory is mapped and correlated across the catalogue, feeding a continuously expanding network of SEO-optimised landing pages, complete with canonical URLs, FAQ and speakable schema, that mirror exactly what Icelandic drivers are looking for.
Multi-Rail Guarded Checkout
Built for a marketplace where tyres ship from many independent suppliers, the checkout routes every basket down one of three fulfilment rails, supplier pickup, an in-shop service booking, or kennitala-tagged freight, with cross-rail guards that resolve real-world conflicts before they reach payment: special-order tyres are forced pickup-only, a live workshop booking locks out shipping, and incompatible supplier-workshop pairings are rejected outright. Nothing the browser sends is trusted: the create-order function re-derives identity from the JWT, re-fetches every tyre's price from the supplier table, recomputes coupons, recovery codes and delivery fees server-side, and refuses any order whose total drifts by more than one króna. One-time recovery codes are claimed atomically and released again the instant an order is rejected, so a legitimate customer never loses their code to a failed attempt. Pending orders that never complete payment expire themselves after thirty minutes, with a separate sweep for abandoned pay-on-site bookings that never touches a confirmed appointment, while the success page verifies the Netgíró signature, polls for Rapyd settlement, and only clears the cart once the order is genuinely paid.
Dual-Rail Payment Reconciliation Engine
Two payment rails, Rapyd hosted-checkout card payments and Netgíró installment financing, converge on a single hardened reconciliation core that treats every inbound callback as hostile until proven otherwise. Rapyd webhooks are validated with HMAC-SHA256 signatures recomputed across multiple canonical URL paths, while Netgíró callbacks are checked against a server-side SHA-256 signature using a timing-safe comparison; only after a signature passes does the engine assert that the amount the provider actually charged equals the order's database total, refusing to mark anything paid on a mismatch and raising a critical alert. Crucially, the sum that gets signed for Netgíró is always re-derived from the stored order total rather than any client-supplied figure, closing the underpayment vector where a tampered amount parameter could have flipped a full order to paid for less. Every confirmation is idempotent by construction: an insert-first dedup key absorbs duplicate deliveries and an atomic status claim advances orders only out of pending states, so replayed or out-of-order webhooks can never double-charge, double-email, or clobber a terminal order. Once an order is genuinely settled, the same pass reconciles it into the database, dispatches the paid lines to the correct suppliers, and triggers receipts, with JWT-verified checkout identity, IP-based rate limiting, and admin-gated config endpoints that never leak raw keys guarding the whole path.
Workshop Booking Engine
Wired directly into Iceland's NOONA workshop network, the Workshop Booking Engine turns a tyre purchase into a confirmed fitting appointment without a phone call. It fetches live availability from each partner garage, resolving real open slots by employee, by bookable resource, and by the exact service duration, then holds the customer's chosen time with a five-minute reservation while they pay. OAuth access tokens are refreshed and rotated server-side against the NOONA HQ API, and a secret-verified, replay-proof webhook stream keeps bookings, customers, blocked times, and event types continuously mirrored back into the platform. The actual supplier booking is only ever created after payment clears, behind an atomic idempotency claim and a paid-status gate that make duplicate or unpaid appointments structurally impossible, across both Noona HQ and Marketplace partners. The result is a single checkout that books real workshop time across a network of independent garages, safely and automatically.
Drífa Tyre Advisor & AI Chat Assistants
Live-connected to Iceland's vehicle data through the Mitra plate registry, the Tyre Advisor resolves fitment at the source, a guided wizard takes a license plate and returns the exact width, profile and rim size, with manual entry and tyre-photo OCR as fallbacks when no plate is given. It parses both metric and American/Arctic-truck imperial sizing, computes rolling diameter to flag jeppadekk, and handles staggered cars by pairing the same model family across front and rear axles, pricing and cart bundling stay balanced per axle automatically. On top sits a dual LLM layer: an Azure OpenAI assistant and an OpenAI (gpt-4o-mini) advisor that both stream replies, detect Icelandic versus English, and are grounded in live search context, the model only recommends tyres that are actually in stock, structured into budget, mid-range and premium tiers from the real catalogue. Beneath the search layer runs a demand-intelligence engine: every plate lookup is cached and aggregated server-side, weighted by repeat searches and cross-referenced against live supplier coverage per size, feeding an expanding network of SEO size-landing pages and sitemaps that mirror exactly what Icelandic drivers are searching for.
Sidewall Scan
Point a phone at a tyre and Sidewall Scan does the rest, a purpose-built in-browser camera, complete with a wheel-alignment overlay and back-camera capture, hands the image to a multi-stage extraction pipeline that detects the tyre, reads the embossed markings, and resolves them into structured width, profile, rim size, speed rating, brand and DOT code. Behind the lens sits a hardened Supabase edge function that validates and rate-limits every request, retries with exponential backoff against the vision service, and turns a raw photo into a confirmed fitment the buyer simply approves before being dropped straight into matching catalogue results. Upload, drag-and-drop and live capture all feed the same path, with format handling tuned for the messy reality of mobile, HEIC, missing MIME types and oversized files included. And every scan is instrumented: success rates, processing times and extracted specs flow into a usage-tracking layer that turns each photo into demand signal on exactly which tyres Icelandic drivers are holding up to the camera.
Customer CRM & 360° Profiles
Built into the back-office as a purpose-built CRM, the customer platform gives the team a true 360-degree view of every account. Each profile fuses editable relationship data, admin notes, free-form segmentation tags, customer tier and loyalty-member link, demographics and address, with a live behavioural summary drawn straight from the platform: page views, searches, the licence plates a customer has looked up, the cars they have saved, which suppliers they buy from, and the seasonal split of what they have purchased, all the way through to calculated lifetime value. Writes flow through a single server-side RPC with a resilient direct-update fallback, so the panel keeps working even as the underlying schema evolves. The result is a relationship system that turns raw transactions into customer intelligence a lean team can actually act on, who someone is, what they drive, what they value, and what they are worth over time.
Operations Control Plane
Behind Drífa's storefront runs a single back-office that reshapes itself to whoever signs in: admins, marketing, moderators, finance, suppliers and workshop partners each land on a sidebar and tab set scoped exactly to their role, with access verified server-side through a SECURITY DEFINER `has_admin_access` RPC and re-checked on every window focus and token refresh, not trusted to the browser. From here the whole operation is run in one place: orders with multi-axis filtering and server-computed metrics, users and loyalty CRM, a tyre catalogue paginated and edited against the live database, supplier and store management, Noona-synced bookings, and content. Beneath the operational surface sits a finance layer that reconciles each order into a live ledger and a dashboard streaming the day's trading figures, so the numbers the team acts on are derived from settled orders rather than assembled by hand. Every tab loads on demand and every panel reads from cached, time-windowed queries, so the same console stays fast whether it is settling a single order or surfacing what Iceland searched for this morning.
Supplier Inventory & Sales Portal
Built for the tyre suppliers and workshops behind Drífa's marketplace, the Supplier Portal is a role-scoped command centre: admins see every supplier while each partner is mapped, through supplier_users, to only their own data, with a live scope selector that re-filters dashboards, orders, sales and inventory in one click. Suppliers edit price, stock and delivery time inline against tire_suppliers, layer per-listing overrides like custom display names and notes, and track demand through KPI tiles, low-stock alerts (under five units), date-ranged sales and order histories that attribute every line item back to the right supplier, exportable to CSV via a dedicated detailed-sales function. Feeding it all is a server-side ingestion pipeline that pulls vendor JSON feeds, normalises brand, model, season and EU-label fields, parses both metric and imperial tyre sizes into structured dimensions, and bulk-upserts tyres and supplier offers in batched chunks. The same sync run deactivates any offer not seen this cycle within a grace window and recalculates stock across the whole catalogue, so listings stay accurate without manual reconciliation. Every privileged path is locked down, JWT and admin-role checks gate the sync, origin-aware CORS gates the rest, and critical-alert hooks fire the moment a feed goes dark.
Fleet Command
Built for corporate customers running tyres across whole vehicle fleets, Fleet Command is a dedicated B2B portal that turns a marketing landing page into a governed sales pipeline. The intake funnel validates Icelandic company identity at the door, enforcing a 10-digit kennitala checksum, Icelandic phone formatting, fleet-size banding and a GDPR consent gate before a lead is ever dispatched, then routes qualified enquiries through a timeout-guarded email handoff so no submission silently hangs. On the fulfilment side sits a tokenized quote-delivery layer: each B2B quote is exposed only through a paired id-plus-public-token URL, rate-limited per IP and verified server-side, while the edge function strips every internal cost-side field server-side, so the company-facing view renders article, quantity and sell-side line totals and nothing more. The same kennitala-aware logic threads back into standard checkout, letting any order flip to a business booking that issues a receipt and XML invoice. The result is a single fleet surface where trust, confidentiality and conversion are enforced in code, not policy.
Supplier Price & Inventory Sync
Every day, a fleet of per-supplier integrations pulls live pricing and stock from each partner wholesaler's own system, each one built against that supplier's chosen interface, from REST and JSON APIs to product-search and e-commerce endpoints, then routes everything through one normalisation engine. That engine doesn't just copy rows: it disentangles brand from model, classifies season and studding type (nagladekk vs. óneglt), lifts EU label data, fuel efficiency, wet grip, noise grade, snow and ice pictograms, and resolves both metric (205/55R16) and imperial flotation sizing (38x15.5R15), deriving overall diameter and cross-format search tokens so a flotation tyre is findable by its metric equivalent and back again. Clean, deduplicated payloads are bulk-upserted into the marketplace catalogue through a server-authenticated ingestion edge function that batches, retries on rate limits, auto-splits failing chunks and falls back row-by-row so one bad record never sinks a run. Each tyre is keyed to a stable identity and joined to its supplier, while dedicated inventory functions hit each supplier's API on demand to confirm real-time stock before a customer ever commits. The result is a catalogue that mirrors Iceland's tyre supply at source, accurate prices, true stock, normalised specs, refreshed automatically, every single day.
EU Label & TyreReviews Enrichment Engine
Every tyre in the catalogue is resolved against two external authorities at once: the EU's official EPREL energy-label registry and the TyreReviews professional ratings database. EPREL IDs are extracted straight from supplier feeds, even when buried inside label SVG and fiche-PDF URLs, then matched first by registration number and, where that fails, by a brand-plus-size fallback, pulling back fuel-efficiency class, wet-grip grade, external-noise level and the severe-snow and ice pictograms that Icelandic winter buyers actually search on. Because TyreReviews is model-based and the catalogue is size-based, a dedicated normalisation layer strips sizes, load and speed indices, XL and run-flat noise, even Icelandic "notuð" tokens and known brand typos, before a weighted scorer (brand, Jaccard model similarity, season, SUV/EV heuristics) picks the single best match above a confidence threshold and flags genuinely ambiguous cases rather than guessing. The whole pipeline is cache-first and API-frugal: a 282, 000-row EPREL cache and dedicated TyreReviews cache tables mean the live EU and ratings APIs are only ever called for genuine cache misses, with TTL-based refresh, rotating nightly cron coverage and post-scrape triggers keeping the catalogue continuously enriched as new stock arrives.
Vildarklúbbur Membership Engine
Vildarklúbbur turns Drífa's loyalty programme into a self-running membership engine across three signup paths, consumer, corporate fleet, and staff-association. Onboarding is a two-step, race-safe handshake: a minimal email-and-plate signup mints a UUID completion token with a 30-day expiry and dispatches a branded completion email, while the finalisation endpoint atomically claims that token in a single query to close the TOCTOU window, provisions a digital wallet pass through PassKit, and idempotently issues a single-use 7.5% welcome coupon via compare-and-swap claim with orphan cleanup. Beneath the forms runs an automation layer that reads the last digit of each Icelandic license plate, maps it to the vehicle's statutory inspection month, and fires service reminders roughly two weeks ahead, detecting custom plates for manual review and logging every send to prevent duplicates. Consent is first-class throughout: token-based unsubscribe flips both contact flags, every operation masks PII in logs and writes a security-audit trail, and Resend-aware sequential sends with retries and critical alerts keep the whole pipeline resilient.
Vildarkort Wallet Pass Service
Vildarkort issues real Apple Wallet and Google Wallet membership cards for Drífa's Vildarklúbbur loyalty program from a single, hardened Node service. Each signup is enrolled into PassKit over a long-lived, mutually-authenticated gRPC channel, the member is created, activated, and patched with their Icelandic license plate as card metadata, with an automatic fallback to the PassKit REST API and a JWT-signed call for the cases gRPC can't carry. The service resolves the member's pass and hands back one region-aware deep link that auto-detects the device, so an iPhone user lands in Apple Wallet and an Android user in Google Wallet without a second code path. It runs strictly server-to-server behind a Supabase Edge Function: certificate-backed, no browser-facing CORS, timing-safe token auth, an SSRF host allowlist, per-IP rate limiting, and PII-masked logging throughout. The result is a one-tap loyalty card that lives in the customer's phone and quietly carries the vehicle plate Drífa needs to serve them.
Programmatic Content Engine
Beneath Drífa's tyre search layer sits a demand intelligence engine that turns real shopper behaviour into ranked content. Every anonymous vehicle search is captured, aggregated by make and model, and correlated against the catalogue, the engine ranks each car's tyre sizes by how often Icelandic drivers actually searched them, promotes the most-requested fitment to a primary size, and continuously upserts a living network of landing pages that mirror exactly what the market is looking for. That network spans regions (resolved town-by-town with correct Icelandic grammar), brands, vehicle types from EVs to vans, and individual tyre sizes, each page carrying its own meta titles, descriptions, and JSON-LD structured data including LocalBusiness, GeoCoordinates, ItemList, breadcrumb, and FAQ markup. Specialised sitemaps are auto-built straight from the database, paginating through thousands of records and assigning crawl priority by live search volume so the highest-demand pages surface first. With edge middleware injecting clean Open Graph and schema for every crawler, and dedicated llms.txt files for AI systems, the result is an SEO surface that expands itself, page by page, in lockstep with demand.
Editorial Studio
Editorial Studio is Drífa's full publishing pipeline, built on a Novel/TipTap editor that gives writers a Notion-style canvas, slash commands, a formatting bubble menu, drag-and-drop image upload to Cloudflare, and YouTube embeds, while persisting clean content as both structured JSON and pre-rendered HTML. Authors start from one of ten purpose-built templates (how-to guides, product reviews, comparison tables, listicles, news briefs and more), each seeding the document with the right Icelandic-language scaffold, and the editor handles slugging, debounced auto-save, draft/scheduled/published lifecycle states, and a live SEO panel that scores meta-title and description length, focus-keyword usage and word count as you type. On the reading side, the renderer sanitises every article through DOMPurify, allow-lists only trusted embed domains, injects anchor IDs into H2/H3 headings to drive an automatic table of contents, and emits BlogPosting, Breadcrumb, HowTo and Speakable schema for rich-result eligibility. Beneath it all, a topical-clustering engine scores related articles by shared category and overlapping tags to weave internal link networks, while build scripts pull every published post from Supabase to regenerate the blog sitemap and RSS feed, so the editorial surface stays continuously crawlable and discoverable.
Sentinel Identity & Access Platform
Sentinel is the access spine of Drífa's tyre marketplace, built on Supabase Auth and hardened so that credentials are never the last line of defence. Sign-in is split into two server-validated stages: a credential check issues a short-lived signed proof token (a JWT carrying a login_challenge purpose), which is the only key that can mint a single-use email 2FA code, admins are always forced through the code, while trusted devices can skip it, and the code itself is rate-limited and dispatched out-of-band by email. Behind every protected route sit deny-by-default guards that revalidate the JWT server-side and call SECURITY DEFINER role functions (has_admin_access, has_partner_access) on a 30-second poll and on every window focus, so a revoked admin or supplier loses access in real time rather than at next login. Privileged account creation runs through an approval workflow: when a non-main admin tries to provision an admin or marketing user, the request is parked as a pending approval, password AES-GCM-encrypted at rest, until the main admin explicitly approves or rejects it, with every grant, rejection, and creation written to an immutable security-events audit trail. The result is a layered identity system where email verification, two-factor codes, role-based route enforcement, and human approval all compose into a single, auditable gate.
Email & Notifications Platform
Built on a durable pgmq-backed queue, the Email & Notifications Platform decouples every outbound message from the request that triggers it, confirmations, supplier alerts and newsletters are enqueued with a priority class and an optional send-time, then drained by a dedicated worker that hands them to Resend. It is engineered for reliability the customer never sees: failed sends retry on exponential backoff, exhausted jobs raise a critical alert and land in a delivery log, and Resend calls are time-boxed so a stalled provider can never block the pipeline. On the transactional side it generates VAT-itemised Icelandic order confirmations with attached PDF receipts pulled from storage, fires template-driven supplier order alerts with per-notification status tracking, and verifies order ownership before a single email goes out. On the marketing side it syncs every newsletter signup into a Resend Audience with deduplication, rate limiting and one-click List-Unsubscribe, while a live purchase feed surfaces real recent orders, brand, model, city, as on-site social proof.
Cart Abandonment and Recovery Engine
When a shopper walks away mid-purchase, the Recovery Engine captures the abandoned cart at the source, persisting a sanitised snapshot of every tyre and service, its value, and the visitor identity behind it, whether they were logged in or browsing anonymously. A 15-minute cron then drives a three-step dunning sequence, reminder, then urgency with social proof, then a tiered discount code, but only after clearing every shopper through a GDPR consent gate and a paid-order race guard, with per-recipient de-duplication so no one is ever emailed twice in a run. Each email carries a single-use, cryptographically random recovery token that IS the authentication: no login required, redeemed atomically against expiry to eliminate replay, and on click it rebuilds the exact pending cart and drops the shopper straight back into checkout with their discount pre-applied. Beneath the recovery flow sits a reconciliation worker that re-verifies stuck orders live against Rapyd before promoting any to paid, matching status, capture state, and amount to the ISK, so recovered revenue is real, not assumed.
Ledger Bridge
Ledger Bridge turns a completed checkout into a fully booked accounting record across Iceland's two dominant bookkeeping platforms, Payday and DK Plus, without a single manual entry. On the Payday side it resolves every buyer through a multi-strategy customer match, database mapping, email, then 10-digit kennitala, creating or updating the contact, gating Icelandic e-invoicing (rafræn reikningagerð) on a valid national ID and transparently recovering from Payday's own electronic-invoice rejections, all behind a cached, auto-refreshing OAuth token that retries on expiry. Invoices are assembled line by line in ISK with a discount engine that knows the difference between a tyre and a booked service, honours event-type eligibility and free-service rules, and enriches Noona and Cal.com bookings into human-readable Icelandic date-and-time descriptions before pushing to Payday and pulling back the legally-binding PDF receipt, served only behind an ownership gate of a signed-in user or a constant-time public token. In parallel, supplier-flagged wholesale orders are posted straight into DK Plus as sales orders, with failures kept non-blocking so a bookkeeping hiccup never breaks a paid order. Closing the loop, an admin-gated export engine produces invoice-record, VAT and full-backup files in JSON or CSV, checksummed and tagged to Icelandic regulation Reglugerð nr. 505/2013, so the books reconcile the moment the accountant opens them.
Let's build something exceptional.
Tell us your ambition and we will show you exactly what is possible, with a precise plan, a clear quote, and a team that delivers at speed.