Building WaylerTech, an IT business with security built in
I run a small IT business in Kenya, and I designed the platform behind it so customers' photos, details and feedback stay protected by default.
Where
- WaylerTech
When
- 2024 – present
Role
- Founder
Outcome11+ devices repaired and 37+ students supported, with a quote → repair pipeline customers can track live.
The business
WaylerTech does laptop and PC repair, Windows and Linux installs, networking, custom bootable drives and practical security help for students, creators and small teams in Kenya. So far that's 11+ devices repaired and 37+ students supported, with a typical quote reply in under two hours.
The problem
Repair customers usually have to trust a technician blindly: no clear price up front, no idea what's happening to their machine, and their personal data on a device in someone else's hands. I wanted the opposite: a price before any work starts, a job they can follow, and their data handled carefully.
What I built
wayler.tech is the full system behind the business:
- Quote from a photo. Customers describe the problem and attach photos or a short video, with no sign-up. They get an itemised quote on a private link, which they can accept, decline or ask about in one tap.
- A live job tracker from diagnosis to ready-for-pickup.
- Orders for bootable drives, recorded before the WhatsApp, email or SMS message opens.
- Verified reviews through single-use, expiring invite links, so only real customers can review.
- An admin panel with owner, admin and editor roles, an activity log and live updates.
Security decisions
These are the choices that mattered most to me:
| Decision | Why |
|---|---|
| Row-level security in Postgres for every table, not just checks in the app | If a bug slips into the app code, the database still refuses to hand over data. |
| Three roles: owner, admin, editor | Editors can update jobs but can't delete records or send prices. Fewer people with power means fewer accidents. |
| An audit log on every change | If something changes, there's a record of who did it and when. |
| Rate limiting with salted IP hashes that expire in a day | The quote form is protected from spam without storing anyone's raw IP address. |
| Private uploads through one-time signed URLs | Customers' photos of their devices (and sometimes their homes) aren't publicly reachable. |
| Anonymous feedback that really is anonymous | No login and no IP stored, so people can be honest. |
Running it
The site runs on a small Linux server (512 MB) that I set up myself: systemd keeps it running, Caddy provides automatic HTTPS, and deploys are a single script that keeps the last three releases for instant rollback. Database, auth and storage run on Supabase. Email notifications go out through Resend.
Next.js TypeScript PostgreSQL Supabase Linux Caddy
What I learned
Building for real customers changes your priorities. Security stopped being an add-on and became part of the product. It's also the reason someone trusts you with their laptop.