KeyProof
The proof layer for UK car hire, and the software that runs the whole hire on top of it. Bygild is the build partner: designed, built and governed end to end.
KeyProof is built for independent UK car hire firms, the kind that take bookings over Instagram and WhatsApp. It started as a proof layer: before a handover the hirer opens one link, verifies who they are, and the car's condition is documented at both ends, so a damage dispute is never the operator's word against the hirer's. It has since grown into the software that runs the whole hire on top of that proof: bookings, an availability calendar, the money owed on each hire, fines, and a record of every customer. Bygild is the build partner behind all of it: the brand, the marketing site, the operator portal, the founders' HQ and the governance work were designed and built by the studio. The site is live at keyproof.co.uk and the product is pre-launch, opening to a founding cohort of five firms. The operating company, KeyProof Ltd (company no. 17333773), was incorporated in July 2026 and is registered with the ICO (ZC195906); the founders' legal agreement is still to be drawn up and signed, and no client money moves until it is.
The design system
The interface is styled like the thing the product produces: an evidence document. The shell is white paper and near-black ink, with a single stamp-blue accent carrying anything verified and a green tick on every check that passes. The document objects, the record card, the signed agreement, the hirer's own phone screen, sit on the page like paper on a desk: plain white cards with hairline borders and sharp corners, while the app's own controls stay rounded. The record card leads the homepage, headed by a VERIFIED BY KeyProof seal and reading top to bottom as one hire, identity through deposit. No template, no component library.
The proof
Three links carry a hire. Before arrival the hirer proves who they are with Stripe Identity, photo ID matched one-to-one against a live selfie. They generate a free DVLA licence share code at gov.uk, which KeyProof passes to the firm: the firm runs the check itself on gov.uk, so KeyProof never contacts the DVLA and never holds a driving record. They sign the operator's own agreement on their phone, and the deposit goes up before arrival as a hold on the firm's own Stripe. At handover, and again at return, the car's condition is photographed and timestamped, so before and after sit side by side. Identity documents are never stored: the operator sees a verified result, not a folder of passports. Anyone can walk the whole hirer flow themselves in the public demo, a safe simulation where nothing is saved.
The sealed record
Everything the hire produces converges on one thing: a dated, sealed record an insurer can actually read. It opens with a completeness register that states its own gaps, what this record contains and what it does not, so nobody has to take the firm's word for what was captured. The VERIFIED BY KeyProof seal is printed off that register and off nothing an operator can fill in, so a hire cannot be dressed up after the fact to earn it. And the record states what happened without ruling on who is at fault: the operator decides what counts as damage, KeyProof holds the evidence and never judges.
The operator product
Behind the proof sits the software a firm actually runs on, an operator portal that installs to the phone's home screen. It carries the day's work: bookings with an availability calendar per car and a warning before the same car goes out to two hirers, the hire price and balance recorded against each booking (deposits and payments settle to the firm's own bank through its own Stripe; KeyProof never holds the money), a fines and liability tool that ties a parking or speeding notice weeks later back to the exact hirer who had the car, a condition history per vehicle, and a private record of every customer, exportable to the firm at any time. A separate founders' HQ, also an installable app, runs the business behind the business: a pipeline board, lead capture from the public forms, shared tasks, ledgers feeding a live cash view, and a daily morning-brief email.
The build
Next.js 15 on Vercel, written in TypeScript, on a serverless Postgres database with authenticated access on both apps. Lead and check-in forms run through serverless functions with rate limiting, a honeypot and a time trap, and email is delivered from a dedicated sending subdomain. CI is the only path to production: nothing reaches the live site except through a passing run, and the suite does far more than a typecheck. It stands up a real Postgres database and proves the tenant boundary by exercising it, so multi-tenancy is not merely coded on every read and write but tested, a booking belonging to one firm reads as not found to another, checked server-side, and an operator only ever sees their own firm.
Security and data protection
A verification product asks people to trust it with identity documents, so the governance was designed before the product. The architecture holds less by design: verification outcomes get stored, never copies of documents, and the operator sees a result, not a folder of passports. Retention is a promise with code behind it: the privacy notice's deletion windows are enforced by a scheduled job, not by someone remembering. The email list is built on versioned PECR consent records (wording version, timestamp, IP), with unsubscribe handling wired into the founders' HQ. The highest-risk checks are designed to sit with specialist regulated providers, and no verification flow touches real hirer data until its data protection impact assessment is done, in that order deliberately.
Under it all: a strict per-route Content-Security-Policy and full security-header set, input caps and validation on every write, attribute-safe escaping in generated email, rate limiting on every public form, and an Article 28 data-processing schedule drafted into the operator agreement before the first client signs. The paperwork exists before the data does. The build is tracked against a live control register mapping it to UK GDPR and information-security controls, encrypted off-provider backups are rehearsed rather than assumed, and the operating company carries professional indemnity and cyber insurance.
The content layer
A hub of operator guides covers the questions hire firms actually search for, from checking a hirer's driving licence to handling a damage dispute, organised as the operator's journey and backed by buyer-intent solution pages, including dedicated landers for prestige and supercar hire. A free, fully in-browser rental-agreement generator (nothing typed is ever sent or stored) rounds out the hub. The whole site ships machine-readable definitions of the product, down to a Companies House identifier in the structured data, so search engines and AI assistants describe it accurately.
