Case study
EscrowLipa
Pay strangers, get paid by strangers, safely.
A WhatsApp escrow for Tanzanian mobile-money deals, it holds the buyer's payment in trust until both sides confirm the deal is done, so people can trade with strangers without anyone running off with the money.
- Role
- Full-stack · WhatsApp
- Client
- EscrowLipa
- Year
- 2026
- Status
- Live (v0.1)
The product.
Buying or selling with someone you don't know usually means one side has to trust first, and that's where deals fall apart. EscrowLipa fixes it inside WhatsApp: the buyer pays into a segregated trust account, the funds lock, the seller delivers, both confirm, and only then does the money release, in full, to the seller's mobile-money or bank account.
It runs entirely in a WhatsApp chat, bilingual in English and Kiswahili, across 5 mobile-money networks (M-Pesa, Airtel Money, Mixx by Yas, HaloPesa, T-Pesa) plus Visa/Mastercard. The buyer pays a small 2% service fee; the seller receives the full amount, untouched. Disputes go to an admin team, and funds auto-release 48 hours after delivery if no one objects.
Under the hood, every shilling is double-entered in an append-only ledger, money never moves without two matched entries, history is never edited (only compensated), and the books reconcile with each provider nightly. Average deal: 42 minutes from open to released.
What I did
Built across the whole stack.
The WhatsApp escrow bot
The end-to-end conversational flow, language choice, deal setup, dispute-policy signing, payment, delivery confirmation and release, that runs the whole escrow inside a WhatsApp chat.
Mobile-money & payments
Integration across 5 mobile-money networks plus Visa/Mastercard: pay-in that locks funds into a trust account, and payouts to the seller's chosen account with no skim.
The double-entry ledger
An append-only, double-entry ledger where money never moves without two matched entries, every transition is logged (actor, timestamp, IP), and books reconcile nightly.
Dispute & release engine
The state machine behind FUNDS_HELD → delivered → released, 48-hour auto-release on silence, and admin dispute arbitration.
Frontend & backend
The marketing site and trust-desk UI plus the services behind them, built end to end.
Screens
From the live product.
