SpendVault
When we started auditing how our own clients buy stock, we kept finding the same leak: money leaving the business without proof that anyone approved it, received it or matched it to an invoice. So we built the control layer ourselves. SpendVault is our own procurement governance platform: 16 portal modules, a mobile delivery app that works offline, and a free audit that scores 17 control checks. It is live, not a prototype.
SpendVault is our own product. Every item below is a real part of the live product, and each one carries the proof so you can check it yourself rather than take our word for it.
What we built, and why
-
The portal itself
Sixteen working modules covering the whole purchase-to-pay chain: purchase orders, deliveries, suppliers, customers, inventory, stock issues, staff requests, returns, tickets, reports and user management. Not a mock-up of a dashboard: every module is a live route with its own data layer.
Sixteen modules, all shipped and in use in the live app.
-
Tenant isolation in the database
Every table carries a tenant id, every query is scoped by a Postgres function that reads the signed-in user, and Row-Level Security enforces it at the database. Even if the client-side code were compromised, one business cannot read another business’s data.
Row-Level Security on every table, documented in the project’s architecture record, with 66+ SQL migrations behind it.
-
The mobile delivery app
Warehouse staff receive deliveries on a phone: photograph the goods and the invoice, match them against the purchase order, capture a signature, and it syncs when the signal comes back. Built as an installable PWA so it holds up in a warehouse with no WiFi.
Live at /supplyd-portal/delivery-app/, a service worker and IndexedDB queue the offline captures.
-
Approvals that cannot be skipped
A purchase order cannot leave the business without a one-time code sent to the approver. Supplier banking detail changes trigger re-verification, because that is the single most expensive thing a fraudster can change.
OTP approval gate and bank-detail re-verification, both described on the live /security page.
-
The Triple-Lock Framework
The product’s whole method, named and enforced: Controlled Purchasing, then Verified Delivery, then Enforced Invoice Matching. Money cannot leave without auditable proof passing all three gates in order.
Three gates named on the live /methodology page, backed by 14 named controls it lists explicitly.
-
A free audit that does real work
Seventeen procurement control checks scored against South African SME risk benchmarks across 11 stages of the buying cycle, ending in a scored readiness report. No signup, no email wall, open it and use it.
Live at spendvault.co.za/audit; the page states "17 procurement control checks" and the 17 checks span 11 distinct stages.
The Triple-Lock Framework
Three gates in sequence. Each one produces evidence the next one checks, which is why the control holds even when the person approving is the person who benefits from the purchase.
- Gate 1
Controlled Purchasing
A purchase order exists, it was approved by a one-time code to the right person, and the supplier is on the approved list before anything is ordered.
- Gate 2
Verified Delivery
What arrived is photographed and matched against what was ordered: by the person receiving it, on a phone, offline if need be.
- Gate 3
Enforced Invoice Matching
Approval, purchase order and delivery evidence must all reconcile before an invoice can be paid. A bank-detail change re-opens verification.
16 modules, one data layer
Counted from the product's own live navigation. This is not a feature list written for a brochure. Open the demo and you will find every one of them.
- Dashboard
- Live spend visibility and the approvals waiting on you.
- Purchase orders
- Order creation, approval routing and workflow events.
- Deliveries
- Goods receipt with photo and signature evidence.
- Suppliers
- Supplier records and banking detail controls.
- Customers
- Customer records and sales-side documents.
- Inventory
- Stock on hand, movements and serial numbers.
- Stock issues
- Issuing stock out, with line items recorded.
- Staff requests
- Internal requests through approval to fulfilment.
- Customer returns
- Returns and the credits they should generate.
- Tickets
- Internal issue tracking.
- Reports
- Financial and compliance reporting with accounting export.
- Users & roles
- Six roles from owner through to viewer.
- Settings
- Tenant configuration and thresholds.
- Public request form
- The external entry point, tenant-scoped on ingest.
- Help
- In-product guidance.
- Mobile delivery app
- The offline-first PWA warehouse staff use on a phone.
14 named controls
Each one is a rule the platform applies, not an advisory. Listed exactly as the product's own method page lists them.
- Approved Supplier Enforcement
- Spend Thresholds
- Fraud Pattern Detection
- Real-Time Spend Visibility
- Mobile Delivery Capture
- Automated 3-Way Match Enforcement
- Discrepancy Locking
- Back Order Tracking
- Goods Receipt Record
- Enforced Invoice Matching
- Banking Detail Change Controls
- Duplicate Invoice Detection
- One-Click Accounting Export
- Audit Trail
The stack
Deliberately boring where it counts. No framework and no build step in the client, because every byte on the wire has to be justifiable in an app that handles money.
- Hosting
- Cloudflare Pages, global CDN
- Edge compute
- Cloudflare Workers for AI, email and lead intake
- Database
- Supabase PostgreSQL 15 with Row-Level Security
- Auth
- Email/password, magic link and TOTP MFA
- Client runtime
- Vanilla JavaScript (ES2022): no framework, no build step
- Offline
- Service worker plus IndexedDB in the delivery PWA
- Transactional email for OTPs and alerts
Compliance and controls
Anyone can put a compliance logo on a page. These are the documents and mechanisms that are actually live and public. Open the privacy policy or the PAIA manual and read them.
- POPIA
- Published privacy policy at /privacy-policy
- PAIA
- PAIA manual published at /paia-manual
- Tenant isolation
- Row-Level Security on every table
- Transport
- TLS 1.3 at the Cloudflare edge
- Approval
- One-time-code gate before a purchase order can be sent
- Data portability
- Full export through the Reports account pack
Free procurement control audit
A working diagnostic, not a lead form. Seventeen control checks scored against South African SME risk benchmarks across the full buying cycle, ending in a scored readiness report. No account, no email wall.
- Control checks
- 17
- Stages covered
- 11
- Signup required
- None
- Page weight
- ≈ 63 KB
The live product, captured
Every image below was captured from the running product: the marketing site and the app in public demo mode. Nothing here is a concept render. All of it is running at spendvault.co.za.
Five stages, in this order
- 01
Find the leak first
Before a line of code: work out where money escapes a small business. Not invoicing and not stock control. The gap is between someone approving a purchase and someone proving it arrived.
- 02
Model the data first
The data model came before the interface. Tenants, roles, purchase orders, deliveries, evidence, matches and an unbroken event trail, because a control you cannot audit is not a control.
- 03
Build the modules
Sixteen modules, one data layer: purchase orders, deliveries, suppliers, customers, inventory, stock issues, staff requests, returns, tickets, reports. Each one usable on its own, all sharing the same tenant-scoped queries.
- 04
Take it into the warehouse
The part most procurement software never solves. Delivery evidence is captured by the person holding the box, on a phone, often with no signal, so it was built offline-first from the start.
- 05
Harden and document
Row-Level Security on every table, MFA, POPIA and a published PAIA manual, plus the engineering record: architecture, data flow, permission model and a written debt register.
What ships with the build
A platform nobody can safely change is not finished. These are the documents written alongside the code: the decisions, the data flow, the permission model and the debt we have not paid off yet.
- Architecture record
- Data flow
- Authentication flow
- Permission model
- Design decisions log
- Deployment pipeline
- Coding standards
- Regression guard
- Technical debt register
- Movement model decision
Before you ask
Does Supplyd build software, or only websites?
Both. Our day-to-day work is websites, identity and print, but we also build and operate our own software. SpendVault is ours, and it is live in public: a procurement governance platform with 16 portal modules, a mobile delivery app and a multi-tenant database. It is the same team writing both.
What is SpendVault?
SpendVault is a procurement governance platform for South African businesses. It enforces a purchase-to-pay workflow built on three gates (Controlled Purchasing, Verified Delivery and Enforced Invoice Matching), so money cannot leave the business without auditable proof that it was approved, received and matched to an invoice. It is a separate software product with its own site at spendvault.co.za, not a Supplyd service.
Is SpendVault part of what Supplyd sells me?
No, and it is worth being clear about that. SpendVault is a separate product with its own site and its own pricing. We include it here as a case study of our engineering work, not as something bundled into a website or branding project.
What is SpendVault built with?
Cloudflare Pages and Workers at the edge, Supabase PostgreSQL 15 for the database with Row-Level Security providing tenant isolation, and vanilla JavaScript with no framework and no build step. Authentication is email/password, magic link and TOTP multi-factor, and the mobile delivery app is an installable PWA using a service worker and IndexedDB so it keeps working without signal.
Can I try SpendVault without signing up?
Yes. The whole portal runs in public demo mode: open the dashboard link on the case study page and click through the 16 modules with no account. There is also a free procurement control audit at spendvault.co.za/audit that scores 17 checks across 11 stages of the buying cycle, with no signup and no email wall.
What does SpendVault control, exactly?
Fourteen named controls, listed on its own method page: approved supplier enforcement, spend thresholds, fraud pattern detection, real-time spend visibility, mobile delivery capture, automated three-way match enforcement, discrepancy locking, back order tracking, goods receipt records, enforced invoice matching, banking detail change controls, duplicate invoice detection, one-click accounting export and an audit trail.
Why would a web design company build its own platform?
Because we kept auditing the same problem in client businesses. Money leaves without proof that anyone approved, received or matched it, and the paperwork that should catch it is spread across email, WhatsApp and a delivery note nobody signed. Building the control layer ourselves is how we came to understand it, and it is the same discipline we bring to the sites we build.
Who owns the code and the data?
SpendVault is our own product and we own it. The distinction matters for client work: on a client project the identity files, the site and the source code are handed over to the client. SpendVault is included here to show the engineering behind it, not as a template we resell.
SpendVault is ours. What would we build for you?
Building our own platform is how we learned to do this. Data models before screens, evidence before claims, and handing over the source rather than holding it. It is the same discipline we bring to a client's website, identity and Google presence.
And it starts the same way: we build a working version first, and you look at it before you commit to anything.