Supplier Onboarding MVP for a Food Marketplace

Supplier Onboarding MVP gives a low-carbon food marketplace a working proof of concept for grants and investors: suppliers register, moderators review, every decision is audited.

4 wks from kickoff to a working MVP

13 participant types onboarded in one flow

3 data-protection laws covered: UK GDPR, EU GDPR, Kenya DPA

Partner's Profile

Background

The client is a UK food-tech startup connecting African farmers and producers directly with buyers in the UK, EU and Asia. The marketplace removes intermediaries between smallholders and international buyers, and low-carbon, deforestation-free sourcing is at the core of the model. The first milestone was supplier onboarding, used by farmers, producers and the client's own moderation team.

Objective

Deliver an MVP that works as a proof of concept for grants and investors. It had to onboard very different participants, from an individual farmer to a cooperative, an exporter or a bank, collect the data needed for deforestation traceability, record consents under UK GDPR, EU GDPR and Kenya's Data Protection Act 2019, and give moderators a clear way to review applications and documents.

Solution

Working the way we run startup projects, we first built a clickable prototype of 72 screens, then built the MVP in 4 weeks across 51 pull requests. Registration covers 13 participant types, including individuals, registered companies, exporters, cooperative societies and their members, manufacturers, logistics companies, aggregators, financing institutions and experts. Each goes through a multi-step onboarding wizard that saves drafts. Moderators review applications and documents with statuses such as needs info and needs support, and suppliers receive email notifications.

Traceability shaped the data model. GPS location is mandatory for farmers at registration to support EU Deforestation Regulation (EUDR) traceability, captured on a map built with PostGIS and Leaflet. A daily task flags documents that are about to expire or already have.

The engineering challenge was a moderation workflow that stays consistent, with every decision traceable, even at MVP speed. That is where our product development discipline went:

All application transitions go through one service module that writes an immutable decision record, syncs the supplier status, adds an audit entry and sends the email via on_commit. If the transaction rolls back, no email goes out.
The product rule "rejection is never final" is enforced by a database constraint. An admin rejection uses the same terminal status as a supplier's own withdrawal and is distinguished by initiator and notification; closed accounts release their email for re-registration.
An authorization audit found missing refresh-token rotation; we added rotation and blacklisting after rotation.
The frontend calls the API through openapi-fetch with types generated from the OpenAPI schema.

The MVP ships with about 500 backend and 390 frontend tests, role-based access and a full audit trail.

13 Participant Types, One Flow

Farmers, cooperatives and their members, exporters, manufacturers, logistics companies, banks, experts and more register through multi-step wizards tailored to their type. Drafts are saved, so a supplier can stop and continue later without losing data.

Farm Location for EUDR

GPS location is mandatory for farmers at registration to support EU Deforestation Regulation traceability. Suppliers place their location on a map built with PostGIS and Leaflet, and the coordinates are stored in a spatial database.

Moderation That Never Dead-Ends

Moderators review applications and documents and can set an application to needs info or needs support. Rejection is never final: a database constraint enforces it, and closed accounts release their email so the supplier can register again.

Consent Across Three Jurisdictions

Suppliers give consents under UK GDPR, EU GDPR and Kenya's Data Protection Act 2019 during onboarding. Consents sit next to role-based access and an audit trail that records every decision on an application.

Document Expiry Tracking

Supplier documents carry expiry dates, and the platform tracks them. A daily background task flags documents that are about to expire or already have, so the moderation team can follow up with the supplier in time.