Loading…
.jpg&w=3840&q=75)
E-commerce & Inventory EngineeringSanyu Botanicals2026
A Storefront That Cannot Oversell Its Own Stock
Sanyu is our own brand, so nobody hired us to build this and we are not presenting it as client work. We include it because it proves something our client engagements do not: that we can ship commerce that takes real money, ships to real addresses, and never sells a jar twice.
25
tables · 52 migrations
8
stored inventory procedures
≤60s
stock sync lag
2
signed webhooks, separate secrets
The bottom line
A live storefront that takes real money in Rands, ships nationwide, and is structurally incapable of selling the same jar twice. Our own brand, built to the standard we sell.
.jpg&w=3840&q=75)
Die Uitdaging
Selling a physical product direct to customers is where software stops being forgiving. Money moves, stock is finite, and someone is waiting for a parcel. Sanyu had to sell in Rands with fulfilment South Africans actually trust, while keeping stock counts truthful against a separate operations system that manufactures the product, so that the storefront could never take payment for a jar that no longer existed. That last constraint is the whole engineering problem.
Our Own Brand, Built Like a Client’s
Sanyu Botanicals is ours. We formulate it, we pack it, and we sell it, which means no client chose us for this work and it does not carry the weight of a third party vouching for us. We are saying that plainly because the alternative, letting it sit among client case studies and be mistaken for one, would undermine every other number on this site.
What it does prove is capability, on the discipline that is hardest to fake. We built it on the same stack, with the same row-level security and the same review standards we apply to paid work. If you want to know whether we can build you a store that survives contact with real customers, this is the store we run our own money through.
.jpg&w=3840&q=75)
Stock That Cannot Lie
Overselling is the failure that costs an online brand its reputation, and it almost always comes from inventory logic living in application code where two simultaneous checkouts can both read "one left". So we put it in the database instead. Reserve, commit and release are stored procedures over a simple truth: available equals stock on hand minus stock already reserved.
A reservation takes a row lock, then updates only where enough stock still exists, which is a compare-and-swap. Two customers clicking checkout at the same instant cannot both claim the last jar, because the database refuses the second one. Bundles are derived rather than tracked separately, recomputed by a trigger from their components, so a gift set can never show as in stock while the oil inside it is sold out.
Twenty-five tables, fifty-two migrations and eight stored inventory procedures, so that a customer never gets an apology email.
Paid For The Way South Africans Actually Pay
Checkout runs on PayFast in Rands, taking local and international cards, and the payment notification handler is written for the real world rather than the happy path. It rejects a mismatched amount, exits early if the order is already paid, and flips status with a guarded update so a duplicate notification returns "already processed" instead of fulfilling the order twice.
Card and EFT settle on completely different clocks, so reservations expire on different clocks too: thirty minutes for a card, three business days for an EFT, with weekend-aware date maths. An abandoned cart releases its stock quickly, but a customer paying by EFT on a Friday does not lose their order over the weekend.
Delivery is Pargo pickup points nationwide, chosen on a map, or free personal delivery in kuGompo City.
One Source of Truth, Two Signed Directions
The storefront and the operations engine that manufactures the product are separate systems, and only one of them is allowed to be right about stock. The engine owns inventory truth; the store mirrors it and cannot author its own counts.
They talk over two signed webhooks, and the two directions use two different shared secrets, each with a five-minute replay guard. Stock on the storefront is never more than about sixty seconds behind the engine. It is the same pattern we build for multi-branch clients, where the branch and the back office have to agree without either being able to overwrite the other.
Begin 'n Projek
Gereed om iets soos hierdie te bou?
Vertel ons van jou projek. Ons sal dit omlyn, prys, en 'n benadering voorstel, binne 24 uur.