Inspiration
Tourism runs on trust. A tourist exploring a new city has no quick way to know whether the person offering to guide them is actually licensed, qualified, and safe to go with. At the same time, genuine, hardworking guides have no easy way to prove their credentials, and licensing authorities are stuck with paper applications, counter payments, and complaints that arrive through scattered phone calls and letters.
We wanted to build something that fixes both sides of this problem at once: a digital front door for tourists to verify a guide instantly, and a back office for licensing authorities to manage applications, renewals, and complaints fairly and transparently.
What it does
Our platform is a role-based portal for four kinds of users:
- Tourists can verify any guide by name, license ID, or QR code, and file complaints with evidence if something goes wrong.
- Tour guides can apply for a license online, pay the application fee through Razorpay, track their application status in real time, download their digital license certificate, and renew before expiry.
- Licensing officers review applications, inspect uploaded documents, and investigate complaints using an automated severity-scoring engine that flags high-risk guides for review.
- Administrators get a full analytics dashboard — revenue trends, application funnels, complaint heatmaps, officer performance, and exportable CSV reports.
Every status change triggers real-time alerts over email, SMS, and WebSockets, and a daily scheduled job reminds guides before their license expires.
How we built it
- Frontend: React 18 + Vite, Tailwind CSS, Zustand for state, React Router v7, Recharts for analytics, and Socket.io-client for live notifications.
- Backend: Node.js + Express 5, with JWT-based role authentication and bcrypt password hashing.
- Database: PostgreSQL, with an in-memory fallback (
pg-mem) so the app runs instantly with zero setup. - Payments: Razorpay, with HMAC-SHA256 signature verification on the server before any transaction is trusted.
- Notifications: Nodemailer for email, an SMS gateway, and Socket.io for real-time in-app alerts, all scheduled and tracked through
node-cronand a notification log. - Complaint Severity Engine: a transparent, weighted formula — category (40%), frequency (30%), time decay (15%), evidence (10%), plus a keyword bonus — that produces a 0–10 severity score and a priority band, with officers able to override the score and log their reasoning.
We designed the scoring engine to be explainable by design: instead of a black-box model, every score comes with a visible breakdown so officers (and tourists) can see exactly why a complaint was prioritized the way it was.
Challenges we ran into
- Keeping auto-flagging fair. We didn't want the system to auto-suspend a guide purely on an algorithm's output, so high-severity guides are flagged for review rather than suspended automatically — a human officer always makes the final call.
- Payment verification. Making sure the Razorpay signature check happens only on the server, never trusting anything the client reports, took careful handling to avoid a security gap.
- Avoiding duplicate reminders. The expiry-reminder cron job needed to track exactly which 30/15/7-day alerts had already gone out, so a server restart wouldn't spam guides with repeat notifications.
- Zero-config startup. Getting PostgreSQL and the
pg-memin-memory fallback to behave identically so the demo always works out of the box, even without a real database connection. - Designing a transparent scoring formula. Balancing category, frequency, recency, and evidence into a single bounded score that still made intuitive sense to a human reviewer took several iterations.
What we learned
- How to design a role-based system that cleanly separates four very different user journeys without duplicating logic.
- The importance of explainable automation — especially when a scoring system affects someone's livelihood, every score needs a visible "why."
- Practical experience securing payment flows end-to-end, including signature verification and receipt generation.
- How to coordinate multi-channel notifications (email, SMS, WebSockets) so that users are kept informed through whichever channel reaches them fastest.
What's next
- Verified tourist reviews and a Guide Reputation Index, combining ratings with complaint history and license status.
- Tamper-proof QR-based digital badges with mobile camera scanning for faster on-the-spot verification.
- Multi-language support (English, Hindi, Tamil, and more) so the platform is usable by tourists and guides across regions.
- Document OCR-assisted verification to help officers cross-check uploaded credentials faster.
Built With
- bcrypt
- cors
- csv
- express.js
- helmet
- html5-qrcode
- javascript
- jwt
- multer
- node-cron
- node.js
- nodemailer
- pg-mem
- postgresql
- razorpay
- react
- react-router
- recharts
- rest-api
- socket.io
- tailwindcss
- twilio
- vite
- zustand
Log in or sign up for Devpost to join the conversation.