Runtime · API
Bun + Hono
One fast monolith, five bounded modules. Extraction-ready, no microservice theatre at pilot scale.
Personal security · Bali · panic-to-response
Press once.
Help is already routing.
Jaga turns a single press into a dispatched response. Your location and profile fan out to the nearest on-duty guards from every security company we onboard. First to accept, first to arrive — with a human dispatcher on the line the entire time.
SIGNAL SENT · LOCATING UNITS
GOJEK FOR PERSONAL SECURITY·asset-light — no BUJP, no in-house guards·nearest unit wins·first arrival 2.000.000 IDR·backup 1.000.000 IDR·24/7 human dispatch·live evidence capture·zone-gated launch·
GOJEK FOR PERSONAL SECURITY·asset-light — no BUJP, no in-house guards·nearest unit wins·first arrival 2.000.000 IDR·backup 1.000.000 IDR·24/7 human dispatch·live evidence capture·zone-gated launch·
01 — THE JOURNEY
From a thumb on a button to someone at your gate.
Three moments, minutes apart. This is what a night looks like when it goes wrong — and how Jaga answers.
01 · PRESS
The moment
Something feels wrong. One press — a 30-second PIN window guards against accidents — and the phone quietly starts capturing audio & location.
t = 0s
02 · DISPATCH
Units converge
The alert fans out to the nearest on-shift units across every onboarded org. First to accept is primary, second is backup. A dispatcher is already listening.
visible to dispatch ≤ 5s
03 · ARRIVE
“JAGA!”
They reach you with your photo & name, and call it out — so you know, instantly, the people arriving are yours. Proof-of-arrival is GPS, time & photo.
first arrival paid
“JAGA! — [your name]” the arrival shout is the brand. It turns a stranger running toward you into an unmistakable signal of safety.
01 · PRESS
Panic + PIN cancel
t = 0s
02 · FAN-OUT
Nearest units offered
dispatch ≤ 5s
03 · ACCEPT
Atomic primary + backup
offer ≤ 10s
04 · ARRIVE
Proof-of-arrival
2jt / 1jt IDR
05 · OVERSIGHT
Human dispatcher
the whole time
02 — ARCHITECTURE
Built like a life-safety system, not a CRUD app.
A panic button earns trust by what it does when the network, the push service, or the console fails at 3am. Every hop has a fallback. Nothing on the critical path is a single point of failure.
The panic path must survive the failure of everything that is not the panic path.
Redundant delivery — every hop, a fallback
Button → backend
HTTPS→retry + backoff→auto phone-call
→ Dispatcher
realtime WS→push→SMS→dead-man call
→ Responder
FCM / APNs→app poll 10s→WhatsApp→SMS
Total outage
degrades to a GSM call to the 24/7 line — never silence
SOURCE OF TRUTH
Append-only event log
Every trigger, offer, accept, arrival & dispatcher action is an immutable, GPS-stamped event — the legal record, the payout justification and the fraud trail in one, and the replay source a reconnecting console reads so a dropped socket never loses an alert.
CORRECTNESS
Atomic primary / backup
A row-locked Postgres function assigns exactly one primary and one backup under any race. Two-slot caps kill the contention that broke naive broadcast dispatch at scale.
TRUST
Anti-fraud by design
2jt per arrival gets probed — so arrival is geofenced, timestamped & photographed, checked against the unit's heartbeat trail for impossible travel, with a dispatcher witnessing every incident.
03 — THE STACK
One monolith we own end-to-end. No black boxes on the golden path.
For a system whose failure modes we enumerate hop-by-hop, owning the middle tier beats renting it. TypeScript top to bottom, one shared contract package across four surfaces.
Data
Drizzle ORM
SQL-first, so PostGIS matching & FOR UPDATE locking stay legible and auditable.
Database
Postgres 17 · PostGIS
Nearest-unit is one indexed ST_DWithin query. The append-only event log lives here too.
Realtime
Valkey pub/sub
Live-nudge layer over the durable log. Reconnect replays from Postgres — pub/sub is never the source of truth.
Mobile
Expo · direct FCM/APNs
Customer & responder apps. iOS Critical Alerts pierce mute & DND — a panic alert is heard.
Web · Edge
React · Astro · DO
Dispatcher console (CSR) + public site (SSG), DigitalOcean Singapore — the closest region to Bali.
03.1 — THE CALLS WE MADE
The non-obvious decisions.
Where we diverged from the defaults — each validated against a life-safety bar, not convenience.
// POSTGRES 17, NOT 18
Because PostGIS
PostGIS isn't GA on managed Postgres 18. We pin 17 and take UUIDv7 from an extension — the geo engine is non-negotiable, the version isn't.
// DIRECT FCM, NOT EXPO PUSH
Because best-effort isn't enough
Convenience push ends visibility at handoff. The alert path goes straight to FCM & APNs with high-priority + Critical Alerts, and never trusts push alone.
// EVENT LOG = RESUME LAYER
Because pub/sub forgets
Valkey is fire-and-forget; a blipped console would miss an alert. Reconnect replays from the event log — turning a footgun into a non-issue.
04 — THE MODEL
Asset-light. Insurance-style. Marketplace incentives.
We don't own guards or a security licence — the two things that killed the first attempt. We own the brand, the apps, the dispatch engine and the dispatcher desk. Licensed partners bring the muscle.
2.000.000
IDR · FIRST TO ARRIVE
The primary responder's payout — strong enough that acceptance is accountable, not a favour.
1.000.000
IDR · BACKUP
Second responder locked in as backup. Redundancy is paid for, not hoped for.
monthly
SUBSCRIPTION · PRICED LIKE INSURANCE
Real-incident payouts spread across the subscriber base. Zones open only when supply & dispatch coverage exist.
Status · 2026
The MVP is being built right now.
A Bali security company, reincarnated as software. First milestone: a staged end-to-end dispatch drill in a single zone. Then the pilot.
DESIGN LOCKED
ARCHITECTURE SET
STACK VALIDATED
MILESTONE 1 · DISPATCH DRILL
PILOT ZONE
Get involved
We're building it now — and looking for the right people.
Run or know a licensed Bali security outfit? Want the pilot in your zone? Or just want to pressure-test the model? Let's talk.
niko.asta@everville.estate
SCANopen jaga.team on your phone