Bluemap CitadelBluemap Citadel

Overview

Buying or renting property in Nigeria runs largely on trust between strangers, and there is usually very little backing that trust up. Listings are scattered across WhatsApp groups and classified sites, the same property turns up three times at three prices, and you often cannot tell whether the person showing it to you has any right to. Paying is the sharper end of it. Money frequently changes hands before anyone has confirmed anything, and once it has gone, it has gone. The management side was no better. Bluemap Citadel, like most of the sector, ran its rental portfolio on spreadsheets, physical record books and Word documents. This platform covers both halves. Buyers find a property that has been checked before it was published and pay through escrow rather than into a stranger's account. Landlords and managers run a portfolio properly, with applications, leases and rent collected on a schedule.

My role

Sole fullstack developer, responsible for all of it: the data model, everything a visitor sees, everything an administrator uses, the twelve-role permission system, the money layer holding escrow and wallets, the whole rentals pipeline, the payment, mapping, media and notification integrations, and the scheduled jobs that keep rent moving. I was engaged directly by the company's founder, on contract.

The problem

Nigeria's property market is fragmented and, more to the point, low on trust. Most listings are never verified. Some are passed along third-hand by people who hold no direct authority over the property they are showing you, and prices are often marked up well above what the owner is actually asking. A great deal of the market runs on WhatsApp, which means an agent re-sending the same photographs and videos to every individual enquiry, and no single place where a buyer can check anything. Paying carries the real risk. Money usually moves before anything has been confirmed, and there is no neutral party holding it while both sides do their checks. Renting leaves no trail either. No recorded application, no lease anyone could produce later, no payment history to point at when there is a disagreement. And managing property was still a paper exercise. Bluemap Citadel, like most of the sector, kept its portfolio in spreadsheets, physical record books and Word documents. That works at a small scale and becomes the constraint the moment you try to grow.

The solution

One platform covering the full journey rather than the first step of it. A property is listed and reviewed before it is published. A tenant applies and uploads their documents. Those are reviewed, a lease is generated, and from then on rent is collected on a schedule, either online or by uploading proof of a manual payment. Nothing about that chain relies on someone remembering to do it: scheduled jobs create each rent payment when it falls due and mark it overdue when it is not met. Money is the part built most carefully. Payments flow through escrow rather than directly between strangers, with a dispute process where an administrator can release, refund, or refund part of it. Withdrawals are held for 24 hours before settling. Every balance is stored in whole kobo rather than as a decimal, because decimals in money are where quiet losses come from. A referral programme credits a referrer 5 percent of the base rent when their tenant first pays. Anything that moves money into a balance runs through a single piece of code, so there is one place to reason about rather than several that can quietly drift apart.

Key features

• List a property through a step-by-step form covering location, features, photographs, documents and price, which is then reviewed before it goes public rather than appearing unchecked.
• Apply to rent a unit, upload the supporting documents, and have the application reviewed and turned into a lease without the process moving to WhatsApp halfway through.
• Pay rent on a schedule, online by card or by uploading proof of a manual payment, with each month's payment created automatically when it falls due and flagged when it is late.
• Hold the money in escrow instead of handing it to a stranger, and raise a dispute if something goes wrong, which an administrator can settle by releasing it, refunding it, or refunding part of it.
• Keep a wallet on the platform and withdraw to a bank account, with a 24-hour hold before the transfer settles.
• Earn 5% of the base rent for referring someone who goes on to become a tenant, credited automatically when they make their first payment.
• Verify your identity once, then transact against it, with administrators approving verification and every sensitive action recorded in an audit log.

Architecture & engineering

Next.js on the App Router, organised into route groups for the public site, authentication, the customer dashboard, the admin console and the API, with authentication resolved in server components through NextAuth. Authorisation is enforced in depth rather than in one place. There is a coarse redirect at the admin layout, sidebar visibility controlling what a user is shown, and then the gate that actually matters: a server-side permission check on every admin page and every API route, tested against flattened permission keys. The first two are convenience. Only the third is access control. Money is modelled as whole kobo in a BigInt from end to end, serialised to strings in JSON so nothing loses precision crossing the wire, and converted only for display. Nigerian rents and property prices are large numbers, and floating-point arithmetic on large amounts is exactly where value disappears without anyone noticing. The asynchronous money flows are driven by three scheduled jobs and a payment webhook. One job generates each rent payment as it falls due, one marks rent overdue, and one processes withdrawals once their hold has expired. Migrations follow a strict fix-forward, idempotent discipline against a Supabase Postgres, with migrations applied before the build runs. Media and documents go through Cloudinary with signed uploads, and a full set of security headers is set at the framework level. Scale: over 40 Prisma models and 12+ roles.

The hardest problem

The hardest part is that money here has to be right in two directions at once. It must never be created, and it must never be lost, and the same payment can legitimately be reported more than once. A card payment is confirmed through two independent channels: the bank calls the server, and the customer's browser returns from the payment page. Either can arrive first, either can arrive twice, and either can fail to arrive at all. Rent is generated on a schedule, so a job that runs twice must not produce two months of charges. Escrow adds a third dimension, because the money is held rather than passed straight through, and the release, refund or partial refund has to happen exactly once even when an administrator and a webhook act at the same moment. The approach throughout is that anything touching a balance is idempotent and has a single owner in the code. A movement is claimed before it is applied, so whichever channel arrives first wins and the second finds nothing left to do. Every credit runs through one path rather than being repeated at each call site, which means there is one thing to reason about instead of several that can gradually diverge. The referral reward follows the same rule, since it is money entering a balance and could otherwise be triggered by more than one route into the same account.

Results

Platform in production. Real tenants pay real rent through the platform on a schedule, with the payments recorded and money moving through escrow as designed. The marketplace side is live alongside it, with the property inventory being built up as the company grows. That matters more here than any feature list, because the entire product is a claim about trust. It only counts once people are willing to put their money through it. It also replaced a manual operation. The rental portfolio had been run on spreadsheets, physical record books and Word documents, and now runs on a system with recorded applications, generated leases, rent collected on a schedule and an audit trail behind every sensitive action.

Key learnings

In a product whose whole proposition is trust, correctness is the feature. Escrow is worth nothing unless the money is provably held and released exactly once, so the engineering effort went disproportionately into the paths that move money rather than into the surface a visitor sees. Two rules did most of that work. Money is stored in whole kobo rather than as a decimal, because floating-point arithmetic on large naira amounts loses value quietly and you find out late. And anything that credits a balance lives in exactly one place in the code, so there is a single thing to reason about instead of several call sites that gradually diverge. Authorisation belongs on the server, every time. Hiding a menu item is a courtesy to the user, not access control, and the difference has to be enforced per page and per route. The wider lesson was about replacing a manual process rather than building something new. The portfolio had been run on spreadsheets and record books for years, and the people using it were entirely fluent in that. Software only wins in that situation if it matches how the work is already done closely enough that nobody has to be talked into it.