BoxIt

As an out-of-state student, every May and August brought the same scramble: commercial units sold out months ahead, self-storage needed a car most freshmen don't have, and three-month minimums meant paying for unused time. Meanwhile students with space could be earning from it. BoxIt connects the two: priced per box, restricted to verified .edu peers, with a video-verified chain of custody.

Architecture

The source stays private through launch, so this is the shape of the system rather than the code. It moves money between students and stores custody evidence, so most of the design work went into those two paths.

• Booking lifecycle modeled as an 8-status state machine.
• 40 AWS Lambda services behind 35 REST endpoints, each route carrying its own rate limit.
• Exactly-once payout settlement across 4 concurrent write paths, using per-tranche idempotency keys over an append-only ledger as the source of truth.
• A lost update returns a 409 rather than allowing a silent overwrite.
• Tenant isolation enforced by row-level-security policies in Postgres, not in application code.
• A reconciliation sweep with severity-classified drift detectors, alerting on ledger and processor mismatch before it reaches a user.
• 2,680 automated tests, at a 3.3:1 backend test-to-code ratio.

Stack

• React Native (Expo)
• AWS Lambda (Python)
• Supabase / Postgres
• AWS S3
• Stripe Connect