BoxIt

As an out-of-state student, every May and August brought the same scramble: commercial units sold out months ahead, self-storage needed a car most freshmen don't have, and three-month minimums meant paying for unused time. Meanwhile students with space could be earning from it. BoxIt connects the two: priced per box, restricted to verified .edu peers, with a video-verified chain of custody.

Architecture

The source stays private through launch, so this is the shape of the system rather than the code. It moves money between students and stores custody evidence, so most of the design work went into those two paths.

• Booking lifecycle modeled as an 8-status state machine.
• 41 services on AWS Lambda behind 35 REST endpoints, over a 12-table Postgres schema. Each route carries its own rate limit.
• Exactly-once payout settlement across 4 concurrent write paths. Idempotency keys come from the payout itself, and an append-only, event-sourced ledger is the source of truth.
• A lost update returns a 409 rather than allowing a silent overwrite.
• Tenant isolation enforced by row-level-security policies in Postgres, not in application code.
• A reconciliation sweep runs 10 severity-classified drift detectors against the payment processor, alerting on a mismatch before it reaches a user.
• 2,680 automated tests, at a 3.3:1 backend test-to-code ratio.

Stack

• React Native (Expo)
• AWS Lambda (Python)
• Supabase / Postgres
• AWS S3
• Stripe Connect