Torque Advisory Group & VINtage

Why it exists

Independent used-car dealers run on margins they mostly can't see. A unit gets bought at auction, picks up reconditioning costs at outside repair shops — a brake job here, a detail there, receipts in a truck cab — and by the time it sells, nobody can say what the store actually made on it. The tools that answer that question are built for franchise groups and priced like it.

VINtage was built from the other direction: by someone who spent over a decade running dealership fixed operations, for the small dealer whose "inventory system" is a spreadsheet and whose recon receipts never make it into it. The design brief for every feature is the same — remove the friction at exactly the point where the data dies.

What it is

Two customer-facing products sharing one backend: a marketing site and storefront selling fixed-ops analysis tools as one-time digital downloads, and VINtage — an installable web app where a dealer scans a VIN, logs purchase and reconditioning costs, and sees true margin and days-in-inventory across the whole lot, from a phone, on the lot.

• VIN scanning and decode — the camera reads the barcode; year, make, model, trim and engine fill themselves from the federal vPIC database.
• AI receipt scanning — photograph a repair invoice and the line items are extracted server-side and presented for review; nothing is saved until the user confirms it. The receipt image is archived privately with the vehicle, so every recon dollar keeps its paper trail.
• Live profit math — recon totals, total investment, gross profit, margin and days in inventory, computed as the user types.
• One search box across stock number, VIN, year, make, model and trim; CSV export; per-dealer branding; a real home-screen icon via PWA install.

Architecture

The marketing site is plain HTML, CSS and JavaScript — no framework, no build step, nothing to break. The app is React 18 + Vite 6 over Supabase (Postgres, Auth, Storage, Edge Functions), with Stripe handling every dollar. A handful of decisions carry most of the weight:

• The database decides who sees what, not the application. Row-level security on every table, every policy keyed to the authenticated user. Application code never gets the chance to leak another account's rows.
• Storage paths are the schema. Photos, logos and receipts live at deterministic paths keyed by user and vehicle ids — no tracking columns, no orphaned references. Receipt filenames are capture timestamps, so their labels need no database at all.
• Edge functions call payment and AI APIs with plain fetch, never SDKs. Vendor SDK HTTP clients have broken on the edge runtime; the REST APIs are single JSON posts. Boring survives.
• AI output is never auto-committed. Receipt extraction lands in a review panel where every line can be edited or removed, with a warning when the items don't sum to the receipt total. Financial data gets a human gate.
• Uploads are non-fatal. The vehicle row saves first; a failed photo or receipt upload costs the attachment, never the numbers.
• The expensive endpoint is guarded. Receipt scanning spends real API money per call, so it requires a signed-in session — an anonymous caller gets a 401 before a cent is spent.

Security posture

• Row-level security on every table, each policy keyed to the caller's own auth.uid() — ownership, not mere login.
• Receipt images — financial documents — live in a private bucket behind short-lived signed URLs, unlike the deliberately public vehicle photos.
• Stripe webhooks are signature-verified against the raw request bytes before anything is trusted; failures return non-2xx so Stripe retries rather than silently losing a sale.
• Secrets exist only in the backend vault and local shell environment. No key of any kind appears anywhere in git history — audited across every commit before the repository went public. GitHub secret scanning and push protection guard the gate from here on.
• Edge functions enforce an origin allowlist; the AI-backed endpoint additionally requires an authenticated session because it spends money per call.
• No advertising trackers, no session recording, no third-party analytics anywhere on the site or app.

Launch readiness

Worked through against a published launch checklist for consumer apps. Much of it did not apply — no children's or health data, no user-generated content shown to other people, no app-store listing, and no third-party tracking of any kind, which makes the consent-and-banner obligations moot by construction rather than by policy.

• Subscriptions cancel online, self-serve, through Stripe's own portal — nobody to call, nobody to talk you out of it. Auto-renewal is disclosed at the button that starts the charge, and again in the terms.
• Every company that processes customer data is named in the privacy policy — including the AI provider, with a plain statement that receipt photos are used for extraction only, reviewed by the user before saving, and never used to train models.
• Email is authenticated — SPF, DKIM and DMARC live on the domain. A notable find: DKIM had been enabled at the mail provider for months but its DNS record was never published, so earlier outreach went out failing authentication. The fix was one TXT record; the lesson, verify by received headers, not by dashboard status.
• Marketing claims are provable. No invented clients, outcomes or certifications anywhere; illustrative screens are labeled as sample data.
• Site imagery carries a license trail. Images whose provenance could not be established were replaced with freely-licensed equivalents, sources logged in the repository; any new image gets its license line in the same commit.
• Terms carry a liability cap, a refund position, and the renewal mechanics. Marketing email carries the physical address and a working opt-out.
• Dependencies: zero known vulnerabilities, lockfile pinned, licenses MIT/BSD/Apache/OFL throughout — no GPL or AGPL anywhere.

Tested, rather than reasoned about

Policies that have been written are not the same as policies that have been tried. These ran against live production.

• Acting as a stranger — no session, using only the publishable key that already ships in the browser — every customer-data table returned zero rows and every write was refused. The one readable table is the product catalog, which is public by design.
• Email authentication was proven by delivery: a test message's received headers at Gmail read spf=pass, dkim=pass (signed by the business domain), dmarc=pass.
• The billing portal was exercised in live mode — a throwaway Stripe customer was created, a real portal session came back against the default configuration, and the customer was deleted.
• Automatic sales tax was verified with a real checkout the day it went live: the correct state tax appeared on the correct line of a real transaction.

Known gaps

Stated rather than omitted, because a technical overview that lists only what is finished is a sales document.

• The privacy policy and terms are written from what the code actually does, but have not yet been reviewed by a lawyer. They should be before marketing at scale.
• DMARC runs in monitor mode; it tightens to an enforcing policy after a few clean weeks of reports.
• Account deletion is honored by email request rather than an in-app button — stated in the policy, appropriate at current scale, and on the list as the user count grows.
• Database backups are automatic and daily, verified running — but not continuous. A restore could lose up to a day of entries; point-in-time recovery is an available add-on if the customer base justifies it.
• One person operates everything. That is the nature of a solo business, and it is mitigated with hardware-independent code hosting and documented runbooks — but there is no second pair of eyes on a deploy.
• No formal keyboard-only or screen-reader pass has been done end to end.

Commercial model

VINtage sells as a subscription — $50/month or $480/year after a 14-day card-up-front trial — with cancellation two clicks through Stripe's own portal. Alongside it, three fixed-ops analysis tools sell as one-time digital downloads ($79–$499), delivered through expiring signed links, with a free calculator as the lead magnet. Automatic sales tax is collected where registered.