Software that does the unglamorous work your business runs on.

The constraint that shaped the build

The obvious design was "Sign in with Rippling." That turned out to be unavailable: Rippling only offers OAuth to App Shop partner apps, and SAML requires an Identity & Access Management package most small operators don't buy. Discovering that late would have been expensive.

So sign-in became an emailed one-time code checked against active worker records, and all payroll writes moved to a single company-level API token held by the backend. A side benefit: the phone never holds a payroll credential at all. If a device is lost, there is nothing on it to revoke beyond its own session.

Treating an NFC tag as untrusted input

A sticker on a wall is a public object. Anyone can photograph it or walk off with it. The tags are NTAG 424 DNA running SUN messaging, so every tap produces a fresh encrypted payload and a message authentication code tied to that specific tag's key. The server decrypts the payload, confirms the code, and refuses to process the same tap counter twice.

Then we removed the tap

Version 1.1 added two quieter ways in. If an advisor has a published shift in payroll, arriving at the studio clocks them in by itself. If they don't, a push notification a few minutes after arrival asks once — capped per day, and never while they're already clocked in. The tag is still there for everyone else and for anyone who'd rather be explicit.

Each shift records which route opened it — tag, prompt, or schedule — because they aren't equally strong evidence. A tag tap is physical proof of presence; a location-based clock-in trusts the phone's GPS. Storing the difference means that distinction survives into the payroll record instead of being quietly averaged away.

Security and session handling

• Sign-in codes are HMAC'd, bound to the sign-in attempt, expire in ten minutes and lock after five wrong tries.
• An email that matches no worker still records a decoy, so responses never reveal who does or doesn't work there.
• Fifteen-minute access tokens with rotating ninety-day refresh tokens: staff sign in once per phone, and a replayed refresh token revokes the session.
• Sessions re-verify against payroll at most daily and disable anyone no longer active — but an unreachable payroll API never locks the whole team out mid-shift.

What it runs on

Fastify and TypeScript on AWS ECS, PostgreSQL on RDS with daily backups, and a React Native app built with Expo for both platforms. The HTTP contract is defined in OpenAPI and the backend's own test suite validates its responses against that contract, so the app and server cannot quietly drift apart.

The whole production footprint costs roughly $55 a month to operate. That number is deliberate: a small operator should not need a platform team or a four-figure monthly cloud bill to solve a four-figure annual payroll problem.

Pick a winner for each thing, not for everything

The tempting design is bidirectional sync. It is also how you get two systems writing over each other at 6am. Instead each entity has exactly one owner: Rippling owns the roster, Mindbody owns the schedule. Data moves one way per entity, which makes every conflict a question with an answer rather than a race.

The join problem nobody budgets for

Mindbody and Rippling share no identifier. Matching a person across them is the entire integration, and getting it wrong means paying the wrong instructor. The fix is a mapping record per instructor, keyed on the Mindbody staff id for constant-time lookup and deduplication, with the Rippling employee id written into Mindbody's own staff field as a backstop. If the mapping is ever lost it can be rebuilt from either side.

Let payroll do the arithmetic

Attendance commission is piece rate: so many dollars per attendee. The integration could have multiplied that out and written a dollar figure. It doesn't. It writes the units — how many people attended — onto the time entry, and Rippling's own piece-rate policy computes the money.

Two gates in front of the money

• The planner is a pure function. It reads classes and attendance and returns a plan, including a reason for every line it refuses to pay. It cannot write anything.
• Applying that plan requires both an explicit apply request and a separate server-side setting to be switched on. Either one missing and the run reports BLOCKED instead of paying.
• A standalone verifier compares pay rates in Mindbody against Rippling, and a second audits the schedule in both systems independently of the sync that produced it.

No servers

The whole connector runs as Rippling Functions triggered by Workflow Studio — there is no box to patch, no host to pay for, and no long-lived credential sitting anywhere: each run mints a short-lived Mindbody token and discards it.

Status: v0.1.0 — every flow proven end-to-end against Mindbody and Rippling sandbox environments, with attendance-commission writes deliberately gated off until rates are signed off. Built for the same operator as the Clock Out deployment above; see the disclosure there.