Croe

Croe: AI-powered escrow for social media commerce. Buyer pays, we hold funds until delivery. Disputes resolved by AI in seconds. Safe trade for Africa.

Comment

Inspiration

In Ghana, over \$2 billion flows through social commerce annually. People buy clothes, phones, and gadgets from strangers on WhatsApp, Instagram, and TikTok. The transaction looks like this: a vendor posts a product photo, a buyer sends Mobile Money (MoMo), and then hopes the item shows up. There is no receipt, no buyer protection, no recourse.

We've lived this. Friends scammed out of GHS 500 for sneakers that never arrived. Vendors who shipped inventory only to get ghosted on payment. Every social seller we talked to had a scam story. The trust infrastructure that Western e-commerce takes for granted (chargebacks, buyer protection, dispute centers) simply doesn't exist for MoMo-based social commerce.

We asked: what if every WhatsApp transaction had a neutral third party holding the money until the buyer confirms delivery, and what if AI could resolve the disputes that inevitably arise, fairly and in seconds?

What it does

Croe is a mobile-first escrow service for social commerce in emerging markets. The flow is simple:

  1. Vendor creates a payment link (item, price, delivery terms)
  2. Buyer pays via Mobile Money, and funds are held in escrow
  3. Vendor ships → Buyer confirms delivery → vendor gets paid (minus a small commission)
  4. If there's a problem → AI resolves the dispute

The dispute resolution is where the AI magic happens, a Three-Tier Forensic Triage System:

Tier What it does Speed
SQL Heuristics Catches recycled scam photos (SHA-256 matching), Sybil attacks (velocity checks), and burner accounts < 50ms
Local LLM Arbitrator Self-hosted open-weights model evaluates evidence and context, then outputs a structured JSON verdict < 5s
Human Reviewer Only genuinely ambiguous cases reach a human, with full forensic context pre-assembled Minutes

The AI arbitrator only acts autonomously when confidence $\geq 0.900$. Below that, it escalates. Fast and safe.

How we built it

Backend: Node.js 20 + TypeScript (strict) + Express + PostgreSQL 16 + Redis 7.2

Frontend: React Native (Expo SDK 54) + TanStack Query + Zustand

AI: Self-hosted open-weights LLM via Ollama. User data never leaves our infrastructure.

We followed an 8-phase build with strict phase gates. No phase started until the previous was tested and complete:

Phase What Tests
1. Data & Ledger 13-table PostgreSQL schema, append-only ledger, CHECK constraints Schema validated
2. Core API Escrow lifecycle state machine (14 states), CustodyProvider abstraction 54
3. Webhooks & Payments HMAC verification, replay defense, idempotency, commission math 73
4. Evidence & Heuristics SHA-256 on-the-fly hashing, recycled evidence detection, SQL fraud tripwires 87
5. AI Triage LLM integration, schema validation, confidence gating, prompt-injection hardening 111
6. Identity & Admin OTP auth, JWT sessions, KYC tiers, trust scoring, admin RBAC 174
7. Frontend 12 screens, forensic interceptor, design system, E2E tests 42 + 37 E2E
8. Ops & Hardening Structured logging, reconciliation, rate limiting, Docker, CI 275 total

The AI arbitrator outputs structured JSON: reasoning steps, a confidence score, and a recommended action. Code validates the schema, checks the confidence threshold, and only then executes money movement. The LLM never directly touches the database or payment rails.

Challenges we ran into

Race conditions in webhook processing. Mobile Money webhooks can arrive multiple times for the same payment. Our deposit handler initially processed duplicates. We engineered a three-layer dedup defense (Redis SETNX fast gate → SELECT FOR UPDATE row lock → partial unique index) and proved it with a 50-concurrent-webhook stress test.

Keeping the AI honest. LLMs hallucinate. They output malformed JSON. They confidently recommend actions with weak evidence. We learned to cage the AI: strict schema validation (malformed → retry → escalate), prompt-injection hardening (user claims isolated in JSON fields, never concatenated into instructions), and the $\geq 0.900$ confidence gate so the model is only autonomous when it's very sure.

Regulatory complexity. Ghana's payment ecosystem requires specific licenses from the Bank of Ghana. We couldn't just move money. Our solution: a phased custody model (P0→P3) where the architecture abstracts custody behind a CustodyProvider interface. Swapping from sandbox to a licensed partner is a config change, not a rewrite.

Designing for trust, not fear. Our first UI drafts used red badges and urgent language for disputes. User testing showed this increased anxiety. We rebuilt the design system around "calm over confrontation": slate blues, warm amber, empathetic micro-copy. No crimson anywhere.

Accomplishments that we're proud of

  • 275 backend tests + 79 frontend tests, all passing, including a 50-concurrent-webhook race test that proves exactly one deposit is recorded no matter how many duplicates arrive
  • Zero floating-point arithmetic anywhere in the money path. All amounts are NUMERIC(15,2) in the database and decimal strings in the API, with exact commission math: $\text{vendor_payout} + \text{commission} = \text{escrow_amount}$
  • The AI never touches money directly. It recommends; code decides. This separation means we can deploy AI dispute resolution with genuine financial safety
  • Full escrow lifecycle from link creation to payout, with 14 states, an append-only forensic ledger, and cryptographic evidence hashing. Not a demo, a production-grade system
  • Privacy-first AI. The LLM is self-hosted, dispute data never leaves our infrastructure, and we built prompt-injection defenses from day one
  • A design system built on empathy. Calm dispute screens, reassurance banners during payment holds, micro-empathy copy throughout. Trust is a feeling, not a feature

What we learned

  1. Financial software is a different beast. You can't UPDATE a ledger row. You can't use floats for money. You can't skip the row lock. Every shortcut in fintech creates a vulnerability.

  2. AI works best as a middle tier, not a decision maker. Deterministic checks first, AI judgment second, human review as safety net. The LLM handles the genuinely ambiguous ~20% of cases, where it actually adds value.

  3. The hardest problem in emerging markets isn't code, it's infrastructure. MoMo webhooks are unreliable, connectivity is variable, and regulatory frameworks are evolving. You design for unreliability as a first-class concern.

  4. Calm design earns trust faster than features. User testing consistently showed that how information was presented mattered more than what. A calm dispute screen with clear next steps converted more users than a feature-rich dashboard.

What's next for Croe

  • P1 Pilot: Go live with a licensed payment aggregator and 50 real vendors in Accra
  • Multi-country expansion: Nigeria (NGN) and Kenya (KES). The PaymentRail abstraction makes adding countries a plug-in operation
  • Trust network effects: As vendor trust scores accumulate, buyers get confidence signals before they pay, turning transaction history into a competitive moat
  • Smarter AI: Fine-tune the arbitrator on real dispute data to push autonomous resolution above 80%, reducing the need for human reviewers

Built With

Share this project:

Updates

Submission history