How PassReady Is Built: Security, Payments and Reliability Behind a Free Driving Instructor App
Your diary, your pupils' details and your money deserve better than a hobby project. This is how PassReady is built and run, in plain English.
PassReady runs on Google Cloud, takes payments through Stripe, and runs nearly 3,900 automated tests on every change pushed to its code. Card details never touch our servers, lesson money goes straight into the instructor's own Stripe account, and the rules that decide who can see what are tested automatically. It is built and run in the UK by StagHill Software Ltd, a registered company you can look up.
A driving instructor app holds pupils' names and phone numbers, your diary and your income. “Free” should never mean cutting corners on any of that, so here is what sits underneath.
| At a glance | |
|---|---|
| Infrastructure | Google Cloud via Firebase, with server functions in Google's London region |
| Payments | Stripe, certified to PCI DSS Level 1, the highest level in the card industry |
| Where lesson money goes | Straight into the instructor's own Stripe account |
| Automated tests | Around 3,900, run on every change, including 100 that test who can see what |
| Backups | The whole database, every night |
| Company | StagHill Software Ltd, Companies House 16878671, ICO registration ZC110096 |
Built on Google Cloud
PassReady runs on Firebase, Google's platform for apps, which sits on the same Google Cloud infrastructure used by some of the biggest services in the world. Our server functions run in Google's London region. There are no servers in a cupboard to fall over, and capacity grows with use.
It is also real-time. When a pupil books, cancels or moves a lesson, the change shows up on your phone straight away, without pulling down to refresh.
Payments: Stripe holds the card, you hold the money
When you switch on card payments, you connect your own Stripe account. Stripe is the payment company behind millions of businesses and is certified to PCI DSS Level 1, the strictest standard in the card industry.
- Card details never reach PassReady. Pupils type their card into Stripe's own checkout page, not ours.
- The money is paid into your Stripe account, and Stripe pays it out to your bank.
- The maths is tested. Automated tests check that the fee a pupil is shown matches the fee they are charged, and that every penny of every payment is accounted for between the instructor, card processing and PassReady.
Who can see what
Every time the app reads or saves anything, security rules check whether that person is allowed to. A pupil can see their own lessons and progress, not another pupil's. An instructor can see their own diary and pupils, not another instructor's.
Those rules are tested automatically. A set of 100 tests tries to read and write things it should not be allowed to, and they run on every change pushed to PassReady's code. Account roles, such as whether someone is an instructor or a pupil, are set by our servers when the account is created, so they cannot be changed from inside the app.
Pupils joining from an instructor's invite sign in with a one-time code texted to their own phone, which expires after a few minutes. Sensitive actions like sending codes and messages are rate limited, so they cannot be hammered by automated attacks.
Guards against the expensive mistakes
The mistakes that cost instructors money are double charges, double refunds and double bookings, so those have their own protection:
- No double charging or double refunds. Payment and refund steps are built so the same action cannot run twice, even if a phone signal drops halfway and the app retries.
- No double bookings. A slot is checked for clashes when it is offered and again at checkout.
- No repeat messages. The same reminder, text or email cannot go out twice for the same lesson.
- Texts at sensible hours. Invite texts to pupils are held outside 8am to 8pm, so nobody gets a message from your driving school at midnight.
- A stop button for payments. If anything ever looked wrong, online payments can be paused within a minute while it is checked, without taking the rest of the app down.
When something goes wrong
Software has bugs. What matters is how quickly they are found. When something fails in the app, an error report reaches us automatically with enough detail to fix it, usually before the instructor has had to tell us. On top of that, the whole database is backed up every night.
Your data stays yours
- Take it with you. Export your lessons, earnings, pupils and expenses as spreadsheets whenever you like. No lock-in.
- Leave cleanly. You can download your data and delete your account from your settings.
- Encrypted connections only. The site will only load over a secure connection.
- A real, registered company. StagHill Software Ltd is registered with Companies House (16878671) and with the Information Commissioner's Office (ZC110096). Our privacy policy sets out what we hold and why.
How it pays for all this
Running this properly costs money, which is a fair question to ask of anything free. PassReady charges instructors no monthly fee. When a pupil pays for a lesson online, they pay a small booking fee: PassReady's 4.2% plus card processing, rounded up to the next whole pound. On a £40 lesson the pupil pays £43 and the instructor receives £40.23. Every app charges something when you take card payments; we publish ours in full, and it is the only way we earn. Cash lessons have no fee.
For everything the app does day to day, see the full tour of PassReady's features, or click through it yourself in the demo.
Look under the bonnet.
Click through every instructor and pupil screen in the demo, with sample data and no account needed. If it suits how you work, signing up takes a couple of minutes and costs nothing a month.
Open the demo