Two-sided marketplace at directory scale

What it is

Owners claim their listing by proving they are who they say they are. Anyone can search the directory, but a claimed listing is the only one that carries verified reviews and direct contact. The model answers a question Yelp never does: is this listing actually run by these people?

The consumer side is a search over 2.76 million Arizona businesses. The owner side is a full portal: listings, leads, reviews, real-time messaging, ads and billing. Behind both sits a staff moderation queue and a super-admin view with revenue reporting.

It is feature-complete and deployed. The final audit runs now, launch comes after.

Under the hood

• Three separate admin panels (super-admin, staff moderation, company owner) with isolated auth guards. A customer session can never reach staff actions.
• Sub-second search at 2.76 million rows using materialized views and GIN trigram indexes in PostgreSQL.
• Stripe Cashier subscriptions hardened against webhook replay with an idempotency table. No event can double-grant a plan or a credit.
• A credits ledger and ads marketplace with impression tracking and a self-minting check.
• Real-time messaging between consumers and owners over Reverb websockets, with background work on Horizon queues.
• 172 tests across 79 migrations, deployed to production with the queue and websocket services managed by systemd.

What was hard

Three things. Search had to hold under a second at 2.76 million rows, which ruled out the obvious query shapes and ended with materialized views and trigram indexes. The three admin surfaces all looked alike to the browser. Each got its own guard and its own policy classes. And the money paths had to be boring: a webhook that lands twice, a refund that arrives out of order, a plan change mid-cycle. Each one is a test now.

Stack