paytrader.net: escrow that pays when the job is done

The brief

Home-improvement jobs go wrong when money and work fall out of step. Pay up front and the homeowner carries the risk; pay at the end and the tradesperson does. paytrader.net sits in the middle: the job is agreed as stages, each stage is paid into holding before it starts, and the money reaches the tradesperson only when the homeowner approves the work.

It is PayTrader Ltd's own product, so we set the constraints ourselves. The money is never PayTrader's to hold; a regulated payment provider holds it. People use it on a phone, in the middle of a job, without reading the terms. And no payment is treated as made because a status says so: it counts when the provider confirms the money moved.

What we built

Four parts in one TypeScript codebase, started on 8 April 2026: an iOS and Android app in React Native and Expo, an API in Node and Express on PostgreSQL and Redis, a web admin portal in React, and the paytrader.net site. The API and its payment worker run as separate services on Railway.

Money is stored in whole pence. Every release, refund and split is written to an outbox in the same database transaction as the change that caused it, then carried out by a background worker that retries on failure, so a dropped connection cannot lose a payment. Each audit log entry carries a hash of the one before it, and the admin portal can check the whole chain. Seven admin reports, reconciliation and settlement among them, export to CSV and PDF.

Payments sit behind one interface, and each job stays with the provider it was created on. That paid for itself in May 2026, when the first provider declined to support escrow: the product moved to a provider that holds each stage as its own transaction, without touching the business logic around it.

The rest is what homeowners and tradespeople touch: a stage plan shared with a six-digit code, photo proof before release, job chat, a dispute flow that freezes the money while support reviews it, and a release after 14 days only if the homeowner says nothing at all. Tradespeople can photograph a paper quote and have it read into stages. Identity checks run through the provider's hosted onboarding, so PayTrader stores no identity documents. Consumer-contract disclosures, the 14-day cancellation right and marketing consent are built into sign-up, and an account can be deleted from inside the app.

How we checked it

API

2,673 tests in 145 suites, recorded 16 September 2026, run as a blocking check before every push that touches the API.

Mobile app

1,744 tests in 107 suites, plus scripted journeys run on iOS and Android devices.

Admin portal

54 browser tests in Playwright.

Real money

Card and bank-transfer funding are tested with real payments in the provider's sandbox, not simulated responses. The live provider suite passes 18 of 18.

Money-path changes

Any change to payment, refund, dispute or payout code is reviewed on its diff before it is committed.

Lighthouse, 16 Sep 2026

paytrader.net on a phone: performance 97, accessibility 95, best practices 100, SEO 100. On desktop: 100, 95, 100, 100.

What changed

paytrader.net is live and taking waitlist sign-ups; the app store badges still say soon. The iOS app is in beta on TestFlight, where testing on real devices still finds what the suites miss. On 16 September 2026 it turned up three defects in the Sign in with Apple deletion journey, and each fix landed with a test shown to fail without it.

Between 8 April and 16 September 2026 the repository took 1,906 commits. There are no customer or revenue figures because it has not launched. They will be published here once there is a quarter of them to report.