KeyProof
The proof layer for UK car hire, and the software that runs the whole hire on top of it. Bygild is the build partner: designed, built and governed end to end.
KeyProof is built for independent UK car hire firms, the kind that take bookings over Instagram and WhatsApp. It started as a proof layer: before a handover the renter opens one link, verifies who they are, and the car's condition is documented at both ends, so a damage dispute is never the operator's word against the renter's. It has since grown into the software that runs the whole hire on top of that proof: bookings, an availability calendar, the money owed on each hire, fines, and a record of every customer. Bygild is the build partner behind all of it: the brand, the marketing site, the operator portal, the founders' HQ and the governance work were designed and built by the studio. The site is live at keyproof.co.uk and the product is pre-launch, opening to a small founding group of firms. The operating company, KeyProof Ltd (company no. 17333773), was incorporated in July 2026 and is registered with the ICO (ZC195906), with the founders' legal structure solicitor-drafted and signed before any money moves.
The design system
The interface is styled like the thing the product produces: an evidence document. The shell is bone paper and printed ink with a single stamp-blue accent for anything verified, and the real manila is kept for the document objects themselves, the condition record, the signed agreement, the renter's own phone screen, which sit on the page like paper on a desk. Document objects keep sharp corners; the app's controls are rounded. Headlines set their accent phrase in a serif italic, and the record card on the homepage assembles itself as the page loads. No template, no component library.
The proof
Three links carry a hire. Before arrival the renter verifies their identity and driving licence and signs the operator's own agreement on their phone. At handover, and again at return, the car's condition is photographed and timestamped, so before and after sit side by side. The operator decides what counts as damage; KeyProof holds the evidence and never judges. Identity documents are never stored: the operator sees a verified result, not a folder of passports.
The operator product
Behind the proof sits the software a firm actually runs on, an operator portal that installs to the phone's home screen. It carries the day's work: bookings with an availability calendar per car and a warning before the same car goes out to two renters, the hire price and balance recorded against each booking (money the operator still takes their own way, never through KeyProof), a fines and liability tool that ties a parking or speeding notice weeks later back to the exact renter who had the car, a condition history per vehicle, and a private record of every customer, exportable to the firm at any time. A separate founders' HQ, also an installable app, runs the business behind the business: a pipeline board, lead capture from the public forms, shared tasks, ledgers feeding a live cash view, and a daily morning-brief email.
The build
Next.js 15 on Vercel, written in TypeScript, on a serverless Postgres database with authenticated access on both apps. Lead and check-in forms run through serverless functions with rate limiting, a honeypot and a time trap, email is delivered from a dedicated sending subdomain, and every push runs typecheck and build in CI before it deploys. Multi-tenancy is enforced on every read and write: an operator only ever sees their own firm, checked server-side, so a booking belonging to another firm simply reads as not found.
Security and data protection
A verification product asks people to trust it with identity documents, so the governance was designed before the product. The architecture holds less by design: verification outcomes get stored, never copies of documents, and the operator sees a result, not a folder of passports. Retention is a promise with code behind it: the privacy notice's deletion windows are enforced by a scheduled job, not by someone remembering. The email list is built on versioned PECR consent records (wording version, timestamp, IP), with unsubscribe handling wired into the founders' HQ. The highest-risk checks are designed to sit with specialist regulated providers, and no verification flow touches real renter data until its data protection impact assessment is done, in that order deliberately.
Under it all: a strict per-route Content-Security-Policy and full security-header set, input caps and validation on every write, attribute-safe escaping in generated email, rate limiting on every public form, and an Article 28 data-processing schedule drafted into the operator agreement before the first client signs. The paperwork exists before the data does.
The content layer
Eleven operator guides cover the questions hire firms actually search for, from checking a renter's driving licence to handling a damage dispute, organised as the operator's journey and backed by six solution pages targeting buyer-intent searches. A free, fully in-browser rental-agreement generator (nothing typed is ever sent or stored) rounds out the hub. The whole site ships machine-readable definitions of the product, down to a Companies House identifier in the structured data, so search engines and AI assistants describe it accurately.
