MX Travel
travel.mavex.aeOperations, finance and HR for travel companies, one workspace per company.
ReactTypeScriptSupabasePostgreSQLVercelClaude
THE STACK
Everything Mavex runs on.
Four products, five repositories, one way of working. This is the real list, taken from the code: what each product is built with, where it runs, how it stays safe, and the checks every change has to pass.
4products in production
6,100+commits across five repositories
1,200+database migrations, each through one gate
47scheduled jobs in MX Travel alone
BY PRODUCT
Which product uses what.
Each product is its own codebase on its own domain. The layers below tag every tool with the products that use it.
Mavex for Dealers
mavex.ae · dealers.mavex.aeThe car market for buyers, and the system dealerships run their stock and books on.
ReacttRPCFastifyDrizzlePostgreSQLNx
MX Auction
iOS · AndroidLive auctions on the phone, with deposits, bidding and handover in one app.
FlutterDartFirebaseFirestoreStripe
Mn Wain
mnwain.aeCompares business and first class fares across departure airports.
PythonSQLiteSerpApiDockerRailway
01
PRODUCT APPS
What people actually touch.
Four products, three ways of drawing a screen, one rule: both languages, equally.
React · TypeScript · Vite
Every web app is React in strict TypeScript, bundled with Vite.
MX TravelMavex for Dealers
tRPC · TanStack Query
Typed calls from the market and the dealer system straight to the API. A renamed field breaks the build, not the page.
Mavex for Dealers
Tailwind CSS
Styling for the travel workspace, held to a design-system checklist that only lets the score go up.
MX Travel
Flutter · Dart
One codebase for the auction app on iPhone and Android.
MX Auction
PWA
The travel system installs to a phone or desktop home screen like a native app.
MX Travel
Python
Server-rendered pages from one Python process; fare results stream in as each airport answers.
Mn Wain
HTML · CSS
This site: hand-written pages with no framework, checked for broken markup before every deploy.
Company site
Arabic and English
Every product ships both languages with mirrored right-to-left layouts. Arabic type is designed in from the start.
MX TravelMavex for DealersMX AuctionMn WainCompany site
02
DATA & BACKEND
Where the records live.
Relational where money is involved, a document store where the app is live and mobile, and nothing heavier than the job needs.
PostgreSQL · Supabase
MX Travel and Mavex for Dealers each run on one managed Postgres database.
MX TravelMavex for Dealers
Append-only ledger
Money events are written once to a hash-chained log. Balances are projections of it that can be replayed and reconciled.
MX Travel
Supabase Edge Functions
34 Deno functions for invitations, email, billing and messaging, next to the database.
MX Travel
Fastify · Drizzle · Zod
The Market API: typed queries, validated input, and an outbox so events leave only after the record is saved.
Mavex for Dealers
Firebase
Firestore, Auth, Storage and Cloud Functions. Bids are placed by the server, never written by the phone.
MX Auction
SQLite
Mn Wain runs on the Python standard library alone, with a single database file on a persistent disk.
Mn Wain
Scheduled jobs
47 jobs on a clock: payroll drafts, leave accrual, revenue recognition, reminders, retention and billing.
MX Travel
PDF rendering
Invoices, vouchers and itineraries are rendered in headless Chromium with Arabic fonts embedded.
MX Travel
sharp · Tesseract
Photos are resized and watermarked, and the printed zone on the back of an ID card is read from a photo instead of typed.
Mavex for DealersMX Auction
03
PAYMENTS & MESSAGING
Money in, messages out.
Each product uses the provider that fits it, and every webhook is verified before it touches a record.
Stripe
Hosted checkout and signed webhooks: Travel subscriptions and customer payments, auction deposits and listing fees.
MX TravelMX Auction
Lemon Squeezy
Search-token top-ups on Mn Wain.
Mn Wain
Postmark
Transactional email for MX Travel, with delivery webhooks and automatic retries.
MX Travel
SendGrid · Resend
Account email for the auction app (SendGrid) and Mn Wain (Resend).
MX AuctionMn Wain
Bring your own mail
A dealership sends from its own mailbox: SMTP, Microsoft 365, Gmail, Amazon SES, Resend, Postmark, Mailgun or SendGrid.
Mavex for Dealers
WhatsApp Cloud API
Customer conversations inside the travel workspace, connected per company.
MX Travel
Firebase Cloud Messaging
Push alerts when you are outbid or an auction you watch is about to end.
MX Auction
SerpApi · Open-Meteo
Live Google Flights fares for Mn Wain under a monthly budget cap; destination forecasts for travel companions.
Mn WainMX Travel
04
AI
AI that is checked, capped and grounded.
Models write drafts from facts we pass in. They do not invent prices, and they do not get the last word.
Travel companions · Claude
Drafts a personal trip guide from the bookings, the traveller’s preferences, a country brief and the forecast. A cost guard runs before the call, a validator after it, one retry, then a person.
MX Travel
Model choice, logged
Each company picks Claude Sonnet, Haiku or Opus for its companions, and every run is recorded with its provider and model.
MX Travel
Mavex Assist
Writes listing copy in English or Arabic from the car’s own record. The dealership chooses the provider: Anthropic, OpenAI, Azure OpenAI or a compatible endpoint.
Mavex for Dealers
Keys stay sealed
A dealership’s AI key is stored encrypted and never sent back to the browser.
Mavex for Dealers
Photo integrity
Each listing photo gets a perceptual fingerprint, a metadata read and an OCR pass, so a picture reused from another dealer or another car is flagged.
Mavex for Dealers
05
HOSTING & DELIVERY
Where it runs, and how it gets there.
Managed platforms, so our time goes into the product and not into servers.
Vercel
The travel app with its serverless API and 19 cron routes, Market’s showcase, dealer system and console, and this site.
MX TravelMavex for DealersCompany site
Supabase
Managed Postgres, sign-in, file storage and edge functions.
MX TravelMavex for Dealers
Railway · Docker
Containers for long-running servers: the Market API with its background dispatcher, and Mn Wain.
Mavex for DealersMn Wain
Firebase
The auction’s database, functions, file storage and hosting.
MX Auction
GitHub Actions
Builds, guards, database migrations and scheduled jobs all run here.
MX TravelMavex for DealersCompany site
Our domains
travel.mavex.ae, mavex.ae, dealers.mavex.ae, mnwain.ae and about.mavex.ae.
MX TravelMavex for DealersMn WainCompany site
06
SECURITY & RELIABILITY
Each company sees its own data. Nothing is assumed to work.
Isolation is enforced in the database, not only in the screen. Backups are restored, not just taken.
Row-level security
Every MX Travel table has row-level security. Market’s app connects as a restricted role that cannot step around it.
MX TravelMavex for Dealers
Security rules
The auction’s database and uploads are locked by rules; admin actions run as server functions.
MX Auction
Sign-in
Supabase Auth on Travel; passkeys and scrypt-hashed sessions on Market; salted PBKDF2 with HttpOnly cookies on Mn Wain.
MX TravelMavex for DealersMn Wain
Abuse checks
Cloudflare Turnstile on public forms, rate limits on the Market API.
MX TravelMavex for Dealers
Secrets stay server-side
Payment keys live only in server environment variables; the database stores the variable’s name, never the key.
MX Travel
Audit trail
Who changed what, and when, recorded by the system rather than remembered by people.
MX TravelMavex for Dealers
Backups and restore drills
A daily backup is taken, validated and kept encrypted for 90 days. Every week production is restored into a throwaway database and checked.
MX Travel
Monitoring
Sentry on the travel app and the Market API, Crashlytics and Performance Monitoring on the auction app, and an ops monitor that reports every four hours.
MX TravelMavex for DealersMX Auction
Production is checked daily
A read-only smoke test walks production every morning, and every deploy is confirmed to serve the exact commit that was merged.
MX Travel
Dependency audit
A critical vulnerability in a dependency blocks the merge on Travel, and GitHub alerts watch every repository.
MX TravelMavex for DealersMX AuctionMn WainCompany site
Security headers
This site refuses to be framed and sends strict content-type, referrer and permissions headers on every page.
Company site
07
ENGINEERING PRACTICE
The checks that run before anything ships.
Rules we wrote down once and made the build enforce, so nobody has to remember them.
pnpm · Nx
Market is one workspace: four apps on shared core and domain packages, with cached builds.
Mavex for Dealers
dependency-cruiser
The build fails if one business domain reaches into another.
Mavex for Dealers
Vitest · Playwright
Unit tests on every change, browser smoke tests against the running app, and 281 SQL check files for the travel database.
MX TravelMavex for Dealers
Ledger conformance
CI buys, reconditions and sells a car against a real database, and fails if the books disagree.
Mavex for Dealers
ESLint · knip
Our own lint rules, a hooks-order guard and a dead-code check on every pull request.
MX Travel
Twin components
The brand components shared by Travel and Market are compared on every build, and both marketing sites must make the same promise.
MX TravelMavex for Dealers
Version gate
No pull request merges without a version bump, and production reports the version it is running.
MX TravelMavex for Dealers
Git
More than 6,100 commits across five repositories, each one a readable step.
MX TravelMavex for DealersMX AuctionMn WainCompany site
HOW WE BUILD
Six habits every change goes through.
- 1A version number on every change.
Pull requests without a version bump do not merge, and production answers with its version, so we always know which build a customer is on.
- 2Database changes go through one door.
Migrations ship through a single gated workflow. One marked hold cannot reach production, and every morning the repository is compared with what production has applied.
- 3Guards before merge.
Structure, governance, design-system and sign-in safety checks run on every pull request, next to type checks, unit tests and a production-identical build.
- 4Restores are proven, not assumed.
Daily encrypted backups, and a weekly drill that restores production into a throwaway database. A drill that cannot run fails red instead of passing quietly.
- 5Watch production after release.
A read-only smoke test every morning, an ops monitor every four hours, and error tracking on every app.
- 6AI shows its work.
A cost guard before the model is called, a validator after it, and a person when it fails twice.
DESIGN CRAFT
How the look and feel is made.
IDENTITY
A living brand system
The spiral mark is drawn by code. It rotates with your scroll, scales from favicon to wall, and never pixelates because it is pure geometry.
Vector SVGGenerative markDesign tokens
TYPOGRAPHY
Two voices, one rhythm
Space Grotesk carries the headlines, Inter handles the reading, and IBM Plex Sans Arabic gives the Arabic voice equal weight, designed together with the Latin, never after it.
Space GroteskInterIBM Plex Sans Arabic
MOTION
Scroll driven storytelling
The signal lines, the rotating core and the colours that shift between sections are drawn live on canvas and SVG, with a reduced-motion mode for anyone who prefers stillness.
Canvas 2DSVGReduced motion
IMAGERY
Real photographs, art-directed
Licensed photographs of real people and places, graded into the brand palette inside the file, then feathered into the page so no photo sits in a hard frame.
WebPLicensed photosLazy loading
Tools are only half the story.
The other half is what they do for a travel agent, a dealer or a family buying a car. See the technology, then meet the products.
SEE THE TECHNOLOGY