Multi-Tenant Quoting & Booking SaaS for Transport Operators

The two operators run radically different businesses — chartered coach hire with drivers, and self-drive daily car rental — yet needed one platform. Each had to embed a quoting widget on its own website under its own branding, with pricing rules, payment gateways and email templates configured per tenant and strict data isolation between them. All fare calculations had to execute server-side to prevent client-side tampering, and Australian realities — GST, driver-fatigue rules, licence classes and refundable security bonds — had to be handled natively rather than bolted on.

We built the platform as a decoupled stack: Vue.js 3 / Nuxt 3 powers both the admin panel and the embeddable booking widget, over a Node.js / Express REST API and a MySQL database managed with Prisma ORM. Multi-tenancy is enforced at the database level with a tenant key on every major table, and a tenant-aware JWT authentication pipeline scopes each request; the system runs on the DigitalOcean App Platform with AES-256 encryption on sensitive credentials. A dual-model pricing engine computes route-based charter fares — daily base rate, distance-based fuel charges from the Google Maps API, cleaning fees and hourly driver fees with minimum-hour rules and overnight allowances — alongside daily-hire pricing in strict 24-hour blocks with per-day insurance and a flat refundable security bond. Safety validations geofence address lookups to Australia and automatically flag any itinerary of 800 km or more with a persistent notice citing the 1,000 km and 12-hour daily driver limits, routing the booking to priority manual review. The admin dashboard tracks bookings through an explicit lifecycle from Requested to Balance Paid, generates serialized quotes valid for 30 days with tokenized conversion links, and handles vehicles, offline payments, pre-filled hire agreement PDFs, licence photo audits and post-rental bond refunds. Payments run through Square for one tenant and Stripe for the other, with tokenized card capture keeping the platform PCI-DSS compliant. The roadmap adds mobile vehicle inspections with photo comparison, SMS reminder cadences, eSignatures, and self-service signup with subscription billing.