Towhub

The problem

Finding a tow when you break down is a terrible experience. You call around, wait on insurance, and compare prices in a panic with no idea what a fair number looks like. Two-thirds of drivers with roadside coverage don’t use it; they search and call. And no incumbent in the industry shows a price before you commit.

The tow companies aren’t having a better time. Motor clubs pay $40–55 on a $110–125 tow, net 30 to 60 days out. Dispatch software is the system of record for the shop but brings no jobs, and it costs $49–429 a month on top.

Towhub is built for the driver on the shoulder and the company that actually shows up.

What it does

For drivers. Enter a pickup (address search or GPS), optional dropoff, and a vehicle. Scan the VIN barcode and the make, model, class, and flatbed need fill themselves from NHTSA data. A price range appears while you’re still typing. Submit, and each local company answers with one card: price including tax, ETA, rating, on-time rate over the last 90 days, truck photos, and the company’s published add-on prices for anything that changes on scene. Pick one. The company accepts, and you track the truck live on a public link with no login, get push and SMS updates, pay when the tow is done, and receive an itemized receipt. Scheduled tows, direct booking links, tipping, ratings, and a 30-day dispute window are all there. The account prompt comes after the job, never before.

For tow companies. The demand, plus the operating tools they’d otherwise pay a dispatch vendor for. Onboarding covers trucks, service areas, per-vehicle-class pricing (hook, per-mile, included miles, minimums, after-hours multipliers), roadside services, and a license and insurance upload that’s manually approved before any offers go out. Then a dispatch board with a countdown queue, one-tap status advance, and auto-assign to the nearest driver. A live map, a Kanban board, a jobs ledger with printable job sheets, a customer directory with CSV import, an impound and storage lot with signed releases, and transport orders from business accounts. Crew management with roles, schedules, clock in/out, timecards with Washington and California overtime rules, and payroll export. Truck inspections where a critical defect parks the truck. Net-to-you on every quote, exports for QuickBooks Online and Xero, and a weekly owner digest. Bring-your-own-customer phone jobs get a pay-and-track link at a lower rate.

For the crew in the truck. An installable PWA with one 56px primary action per screen, navigation, GPS ping, required condition photos on accident, impound, and police jobs, and a canvas signature. It works offline.

For businesses. Body shops, dealerships, auctions, and fleets request on behalf of an end customer, place multi-VIN transport orders that go to one company as a lot, keep preferred providers with negotiated rate cards the quote engine prices automatically, and get billed monthly through Stripe Invoicing.

Towhub takes a published 12% on marketplace jobs and 4% when a company brings its own customer, with processing absorbed and the net shown to the company on every quote.

The story

February 2025. A one-commit prototype called TowDash: Next.js Pages Router in JavaScript, MongoDB, socket.io, Tailwind, and a Google Maps key hardcoded in the page. It proved the idea (request form → vendor list with computed prices → vendor dashboard) and nothing else.

September 18, 2026. A written audit of that prototype found eight security and correctness problems, including client-supplied prices and statuses stored as-is, an unauthenticated delete endpoint, and password hashes in a public list. The decision was to keep the intent, delete the implementation, and migrate nothing.

September 18–20. The rebuild: 130 commits over three days on Next.js 16, Supabase with PostGIS and row-level security, Stripe Connect, Google Maps Platform, and CascadeDS. Business research (market, SWOT, unit economics, Washington/Oregon/California regulation) was written first and changed the roadmap. Tow company accounts moved into the MVP, a bring-your-own-customer tier was added, acceptance by SMS link without login went in, a license and insurance approval gate was added, and launch scope narrowed to Seattle.

September 19. towhub.co went live on Vercel, with separate preview and production Supabase projects, a nonce-based CSP, legal documents, and a 38-article help center.

Britton Lorentzen directed product, design, and every decision. Claude Code wrote most of the code against a written brief with hard rules and a review discipline built into the project instructions.

How it’s built

Server-authoritative everything. Pricing, fees, and status are computed on the server. React Server Components and server actions make that the default rather than a discipline to maintain.

Supabase Postgres with PostGIS. The data is relational (organizations, members, jobs, payments) and geographic. “Companies whose service area contains this point” and “nearest online driver” are native queries. Multi-tenant isolation happens in RLS policies, not app code. pg_cron handles expiry, holds, and reliability refreshes.

One state machine. transition_job() lives in Postgres, mirrored by a tested TypeScript module. Every transition is a job_events row with who, when, and where.

Quote engine as a pure function. computeQuote(rules, inputs) prices the instant estimate, the real quotes, and the company’s pricing preview from the same code, with tests on minimums, included miles, after-hours boundaries, multipliers, and negotiated rates.

Geo-lock as data. Supported regions are PostGIS boundaries in a table. Launching Oregon is a data change, not a deploy.

Stripe Connect. Checkout in setup mode, then a manual-capture PaymentIntent, then a destination charge with an application fee. Connect Express for payouts, Invoicing for business accounts, refunds with transfer reversal. The fee is stored separately from the company’s price, so the customer sees one number and the company sees net.

Real-time without a socket server. Supabase Realtime channels scoped to the job or organization, with coalesced refreshes. It runs on serverless.

Messaging behind one adapter. Every SMS, email, and web push is a notifications row whether or not a provider is wired, so nothing is lost while a provider is pending.

Security headers and rate limits. Nonce CSP with strict-dynamic, HSTS, COOP/CORP, Permissions-Policy, and per-user and per-IP rate limits on every public endpoint.

Tests where the rules live. Business rules sit in pure domain modules with no I/O. 91 Vitest units cover pricing, eligibility, the state machine, cancellation, impound, inspections, maintenance, CSV import, tax, and geo. 23 Playwright flows and a 100-check RLS audit run on top.

CascadeDS with a Towhub brand layer. Asphalt and amber, tinted cards, a night-styled hero map. Barlow Condensed for display, Barlow for body, JetBrains Mono for identifiers, all on the CDS size ramp. Every status in the product maps to one StatusBadge. No Tailwind.

Where it stands

Towhub is built and live at towhub.co, and pre-launch. Production has the schema and the admin, and every flow above runs end to end on the preview environment with a seeded demo market. There are no real tow companies, customers, or jobs yet. The next gates are external: SMS carrier registration is in progress with Twilio, Stripe is moving from test mode to live, and the first Seattle tow companies are being onboarded. Oregon and California follow, as data changes.