JLJoão Lorenzo
ENPT

Work / Travel marketplace

A travel marketplace, live on iOS and Android in four months

Members-only stays, tours and restaurants, with split payments, calendar sync with Airbnb and Booking.com, and an API that AI agents can query.

Role
Lead engineer and DevOps, through Pyp System
Period
Mar 2025 — present
Context
A Brazilian travel startup
Stack
NestJS, PostgreSQL, Redis, Next.js, React Native, Docker

The product

A subscription travel club. Members book stays, tours and restaurants at member prices. Hosts list their properties, go through identity verification and get paid automatically.

Pyp System built it from scratch. I led architecture, delivery and DevOps while a team of developers built most of the features, and I wrote the parts where a mistake costs the most: deploys, calendar sync, the AI-facing API and security.

What we shipped

  • API (NestJS + PostgreSQL). Real-time chat over Socket.IO with a Redis adapter, push notifications, and a separate worker role so scheduled financial jobs have exactly one writer.
  • Web (Next.js) in Portuguese, English and Spanish, and mobile apps (React Native with Expo) on the App Store and Google Play.
  • Marketplace payments. Card and PIX with split payouts to hosts, identity verification for recipients, and reconciliation jobs.
  • Calendar sync with Airbnb and Booking.com through iCal and a channel manager, so a date booked anywhere is blocked everywhere.
  • Maps, Google and Apple sign-in, and server-side conversion events for ads.

Timeline

  1. Mar 2025

    First commit on the API, web and mobile apps.

  2. Jun 2025

    Production builds and release on the App Store and Google Play, about four months in.

  3. Feb 2026

    A second marketplace with near-identical needs: I forked the platform into a new product instead of starting over.

  4. Jul 2026

    Moved from in-place restarts to zero-downtime blue-green deploys with Docker.

  5. Oct 2026

    Security audit across the six repositories of both products.

Three engineering stories

  1. When calendar sync broke

    Calendar sync is where a marketplace loses trust: one wrong blocked date and a host loses a booking. When the iCal sync started blocking dates incorrectly in production, we shipped a hotfix the same day, ported it to the second product, and followed with a hardening release across all six repositories.

    I also wrote the incident explanation for the client myself. When you are someone's engineering team, owning the explanation is part of owning the fix.

  2. Making photo uploads cheap

    Hosts upload a lot of photos. Reworking the upload pipeline cut memory per request from 150 MB to 25 MB, made image encoding 2.5× faster and produced WebP files 36% smaller. Heavy processing runs in a BullMQ worker with Sharp, away from the request path.

  3. Letting AI agents in

    The catalog is exposed through an MCP server, so AI agents can search it in real time. A WhatsApp AI concierge uses it to answer leads about stays and the club.

    ConstraintIt is read-only by design, authenticated with API keys compared in constant time, and rate-limited to 300 requests a minute.

Security pass

In October 2026 I audited the six repositories of both products: authentication hardening, an access-control review of every endpoint, CORS rules per environment, least-privilege cloud credentials for backups, and versioned storage with lifecycle rules for daily database backups.

Outcome

~4 mofrom first commit to the App Store and Google Play
6×less memory per photo upload (150 MB → 25 MB)
2products in production, built from the same platform

The client's name, business rules and financial figures are withheld. The code is private.