Mahjoub – Laravel, React, JavaScript

SaaS provider for marinas, boat clubs and shipyards in the DACH region.

• Led the Angular web app for a multi-tenant platform with a master database plus one database per tenant.
• Built a map-based berth-plan editor, occupancy scheduler, and booking wizard.
• Implemented payments and finance features including Stripe booking flows, subscriptions, SEPA runs, DATEV exports, and fiscal signature integrations.
• Implemented Keycloak SSO, API-key access for external clients, granular permissions, and per-tenant licence flags.
• Added mandatory i18n, Jest/Cypress tests, public-endpoint hardening, and Docker deployments via Bitbucket Pipelines.
• Performed code reviews across the team.

A two-sided marketplace for trading-card games (web + iOS/Android app, 01/2026–present) with its own closed-loop payment instrument. Collectors list cards against a fixed catalogue, buyers pay with platform credits, and the platform handles escrow, buyer protection, payouts and shipping labels. Target group: private collectors in the DACH/EU region.

• Designed and implemented a closed-loop platform credit as the sole payment instrument with escrow allocation and verified-account payouts.
• Structured the payment model to satisfy the EBA limited-network exclusion so that no e-money or payment-institution licence was required.
• Led the regulatory workstream around PSD2/SCA, ZAG, EBA Guidelines, and the BaFin notification procedure.
• Evaluated and integrated PSP options including escrow, split payments, webhook processing, reconciliation, and KYC/KYB and AML flows.
• Implemented fraud and security controls including TOTP 2FA, SMS/WhatsApp verification, audit logging, rate limiting, and role-based access.
• Built real-time offers and chat, a personalised feed, and shipping-label integration.

SaaS product for MPU counselling practices and traffic psychologists in Germany.

• Built a multi-tenant architecture with one database per tenant and tenant-scoped cache, queue, filesystem, and storage isolation.
• Implemented Stripe subscription billing with checkout, proration, scheduled changes, add-ons, Billing Portal, and signature-verified webhooks.
• Built three authentication planes with central accounts, tenant web sessions, and bearer tokens for the app.
• Implemented field-level encryption, file-access audit logs, activity logs, signed URLs, erasure cascades, and retention enforcement for GDPR-sensitive data.
• Built real-time messaging, appointment self-booking, Google and Microsoft calendar sync, .ics invites, push notifications, and a 13-screen customer app.

Child, youth and family support services provider in Münster.

• Built working-time and vacation accounting with monthly contract rows chained as a linked list and balances rebuilt from source data by queued recalculation jobs.
• Wrote a 60-section calculation specification for auditors.
• Implemented payroll exports and an invoicing wizard producing PDF and XRechnung 3.0 e-invoices.
• Built case management for families, children, youth-welfare offices, mandates, and approved-hour quotas.
• Implemented importers, Excel exporters, reporting, and nightly sync from an external Kimai instance.
• Implemented RBAC, optional and forced 2FA, authentication logging, failed-login monitoring, activity logging, and data-retention jobs.

Care-placement start-up.

• Implemented Stripe Connect Express onboarding for caregivers with mirrored account capabilities and requirements.
• Built hosted Checkout with destination charges, platform fees, and signature-verified webhooks.
• Implemented a booking state machine with counter-proposals, per-appointment chat, cancellation statistics, and queued notifications.
• Built an availability engine that merged recurring slots, blockers, and appointments into non-overlapping free segments.
• Implemented geo-radius search with Google Places autocomplete and map pickers.
• Built role-based access, a read-only admin back office, e-mail verification, and feature tests.

A two-sided marketplace for home-care services that connects families and patients with independent caregivers (web app, 08/2025–03/2026). Patients search caregivers by location and availability, book appointments, chat about the details and pay online; caregivers manage their availability, take posted jobs and receive payouts; a read-only back office gives the operator oversight.

• Built software for configuring task groups, buyer profiles, proxy pools, and scheduled release tasks.
• Implemented queued jobs that drove headless-browser workers to monitor products and run cart and checkout flows in parallel.
• Implemented resilience against captcha, bot detection, session and cookie constraints, proxy rotation, and retry logic.
• Secured customer accounts, payment profiles, and proxies with encrypted storage and licence handling.
• Ran load scenarios with high concurrent order volumes to validate throughput and stability.
• Built a React dashboard with live run status, success and failure statistics, and run history.

Mid-sized door and glazing company in Nuremberg.

• Built an offline-first field app for construction-site documentation.
• Implemented QR-code-based project loading and mirroring of the WebDAV project tree to the device for offline use.
• Built a local upload queue for photos, construction diaries, work reports, acceptance protocols, and measurement sheets with retry handling.
• Stored credentials securely, implemented full local wipe on logout, and added ZIP export of local data.
• Implemented tablet landscape layouts, report e-mail dispatch with attachments, and deployment to iOS and Android.

Institute for traffic-psychology assessment in Münster.

• Built a customer app and staff portal for document management and appointment booking.
• Implemented document-request workflows, multi-page document scanning, PDF merging, and automatic SharePoint archiving via Microsoft Graph.
• Built appointment booking from Outlook free/busy schedules and automatic event creation for attendees.
• Implemented staff-customer messaging, bulk messages, and push notifications.
• Implemented per-device tokens, role middleware, ownership middleware, signed download URLs, automatic deletion, and cascade deletion of customer data.
• Built customer CRUD, Excel import, dashboard widgets, scheduled greetings, and self-help tools with local SQLite storage.

Social-media start-up.

• Built web and mobile PWA prototypes for a social network restricted to university e-mail domains.
• Implemented profiles, feed, discovery and matching, groups, events, chat, and notifications.
• Built a shared Laravel backend serving a Vue 3 PWA with offline shell and push support.
• Delivered two prototype variants for user testing.
• Implemented an image pipeline, object storage, roles, reporting, blocking, and moderation back office.
• Dockerised and deployed the prototypes on Google Cloud and iterated with founders based on user feedback.

ANAB-accredited personnel certification body for ISO/IEC 27001, data protection, business continuity, compliance and AI certifications.

• Built a company-internal CRM covering the full certification lifecycle of a 17024-accredited body.
• Implemented candidate and training-partner management, exam registrations, certification applications, certificate issuance, recertification, CPE tracking, and maintenance fees.
• Automated certificate-award workflows with accreditation-grade traceability and record-keeping.
• Integrated LinkedIn and HubSpot for partner and lead management.
• Built a modular Spring Boot backend, Keycloak-based authentication and SSO, and a responsive front end.
• Tested and deployed the platform with Docker on Google Cloud.