GenuProof

Anti-counterfeiting for brands that can't afford $50K enterprise solutions. One QR scan verifies any product. $99/mo, powered by DynamoDB single-table design and AI threat detection.

Comment

Inspiration

Global counterfeit goods trade is $2T annually. The brands hurt most are small: independent watchmakers, DTC skincare, streetwear labels. Enterprise authentication platforms require $50K+ implementations. We built GenuProof to deliver the same cryptographic protection at $99/month, self-serve, powered by DynamoDB's single-table design for sub-10ms verification at any scale.

What it does

GenuProof is a B2B anti-counterfeiting platform. Brands register products and receive SHA-256 hash certificates with HMAC-SHA256 signatures. Supply chain handoffs are recorded as hash-chained provenance events in DynamoDB. Tamper with one event and every subsequent hash breaks. Consumers verify in one QR scan.

The platform detects tag cloning, the dominant counterfeiting attack, with 5 detection layers: device fingerprint lock, scan velocity, burst detection, geographic anomaly (3+ countries/24h), and consumer dispute flow.

Real-time threat intelligence runs on DynamoDB Streams > Lambda > Gemini 2.5 Flash. Every scan triggers anomaly checks; Gemini classifies threats with severity, attack vector, confidence score, and narrative. Alerts push to the brand dashboard via Server-Sent Events.

How we built it

DynamoDB is the entire backend: single-table design with 13 PK/SK access patterns and 1 GSI serving 37 API endpoints through one table. PAY_PER_REQUEST billing, Streams enabled for the Lambda pipeline. Key patterns:

  • PRODUCT#id / META product records with SHA-256 hash and HMAC signature
  • PRODUCT#id / EVENT#ts#type hash-chained provenance events
  • PRODUCT#id / SCAN#ts verification scan log (feeds anomaly detection)
  • THREAT#brand#YYYY-MM / ALERT#ts AI-classified threat alerts (monthly-bucketed to prevent write-hot-spotting)
  • OPS_LOG#YYYY-MM-DD / ts#agent Gemini AI operations telemetry (daily-bucketed)
  • VERIFY#code / META O(1) verification code lookup
  • BRAND_INDEX / BRAND#ts#id collection key for no-Scan brand listing
  • PRODUCT_INDEX / PRODUCT#ts#id collection key for no-Scan product gallery

Zero full-table Scans on any data path. 17 access patterns, all served by Query or GetItem.

Vercel hosts the Next.js 16 frontend with 37 serverless API routes. Auto-deploy on git push.

Why DynamoDB: Verification must be fast. Consumers scan a QR and expect instant results. DynamoDB's single-digit-ms reads on the VERIFY#code > PRODUCT#id > chain walk pattern deliver sub-100ms end-to-end verification. The single-table design eliminates joins. Streams enable the real-time threat pipeline without polling. PAY_PER_REQUEST means zero cost at zero traffic, linear scaling to any volume. Time-bucketed partition sharding on THREAT (monthly) and OPS_LOG (daily) prevents write-hot-spotting at scale.

Challenges we ran into

Single-table design required upfront access pattern planning: 13 partition key patterns serving 37 endpoints through one table with zero joins. We initially had a hot partition on PK: "OPS_LOG" (every AI operation landing on one key), which we fixed by sharding to daily-bucketed OPS_LOG#YYYY-MM-DD partitions with scatter-gather reads. The anti-tag-cloning system needed 5 independent detection layers because no single signal catches the attack. The Gemini integration in Lambda had to be critical-path while staying within the DynamoDB Streams retry window.

Accomplishments that we're proud of

  • 5 cryptographic primitives in production (hash, HMAC, chain, fingerprint, email privacy)
  • Anti-tag-cloning detection for the dominant real-world counterfeiting attack
  • DynamoDB single-table design: 13 PK/SK patterns, 1 GSI, zero Scans, time-bucketed sharding
  • 37 API endpoints, 15 pages, 155 Playwright e2e tests passing
  • 44-tool MCP server for AI assistant integration
  • EU DPP compliance export (ESPR-2024/1781)
  • Live Stripe checkout with 3 subscription tiers

What we learned

DynamoDB's single-table design forces you to think about access patterns before writing code, the opposite of relational modeling. The payoff: every query is a single partition read, Streams give you a free event pipeline, and PAY_PER_REQUEST means the platform costs nothing until customers show up. The hot-partition fix (sharding OPS_LOG daily and THREAT monthly) was 8 lines in the Lambda writer and 15 lines in the API reader, no table migration, no downtime. For a B2B SaaS, this is the ideal database architecture.

What's next for GenuProof

  • Shopify app directory listing for SMB brand acquisition
  • Email alerts on CRITICAL threats
  • NFC tag integration for luxury goods
  • EU DPP registry direct submission

Built With

Share this project:

Updates