Buyers look for this. In Google Keyword Planner, “3d animation services”, “3d rendering services” and “website for manufacturers” each get 1,000 to 10,000 searches a month across the US, the UK, the UAE and Saudi Arabia (my pull, 18 October 2026). Top-of-page bids for “industrial marketing agency” and “manufacturing marketing agency” run $54 and $66 a click.

I built the whole set for an industrial process-equipment distributor serving plants across the Gulf: Blender films, seven interactive equipment families, a TEMA type explorer, an AR model, and 40 product pages in English and Arabic. Here is what each piece is, what it costs on the market, and how to keep it fast on a phone.

What is 3D product animation for industrial equipment?

It is engineering-accurate 3D, lit and filmed like a product shoot, then cut three ways: films, stills and real-time models.

The centrepiece for the client is E-101, a TEMA AES shell-and-tube exchanger I modelled in Blender: 1,148 copper-nickel tubes, class 300 flanges, a cover davit, saddles on concrete piers and a stencilled tag. Its 240-frame film walks up to the unit at night, unbolts the channel, swings it clear, draws the tube bundle onto timber cribs and runs an eddy current probe down the tubes. On the client’s site it plays as you scroll, with labels that track the parts.

Open the interactive diagram on tawfik.tv

What is technical animation: cutaways, exploded views and how it works?

Technical animation (also called mechanical or equipment animation) explains a machine instead of selling a mood. Three moves do most of the work:

• Cutaway. Slice the unit to show what a photo hides. I cut a reformer furnace open to show the tubes glowing inside, and cut a three-phase separator in half so gas, oil and water separate in front of you.
• Exploded view. Take it apart in order. The plate exchanger’s nuts spin off, the pressure plate rolls back and 40 plates unfurl.
• How it works. Show the physics. In the reverse osmosis rack, the membrane layers turn sea green as water reaches them.

Every family on the client’s site has its own control, and no two repeat. Pick one:

Open the interactive diagram on tawfik.tv

3D animation services or 3D rendering services: which do you need?

3D rendering gives you still images: datasheet covers, tender documents, catalogue pages. 3D animation gives you motion: a how-it-works film, a cutaway, a trade show loop. Real-time 3D runs in the browser and the visitor controls it.

You rarely need to choose. The model is the expensive part, so build it to an engineering standard once and render stills, films and web versions from the same file. Every image on this page comes from one set of Blender scenes.

What is a 3D product viewer, and when do you need a product configurator?

A 3D product viewer puts a model on the page that buyers can turn and zoom. A product configurator goes further: each choice changes the product, and the page shows the result and the spec. I wrote up the tools behind both in three.js website.

For the client I built a TEMA type explorer in three.js: pick a front head, shell and rear head and an X-ray bundle model redraws, then the choice fills the enquiry form. Here is a lighter version as a general arrangement drawing. Its quote button carries your spec.

Open the interactive diagram on tawfik.tv

For building products, I built a 3D building product configurator where you tap a part of a building and get the products that fit, the spec and the quantities.

What is web AR, and can a buyer see the unit in their own yard?

Web AR opens the phone’s camera from a link and stands a 3D model in the room or the yard, at real size, with no app. On Android it runs through Scene Viewer, on iPhone through AR Quick Look. Google’s free model-viewer puts both behind one button.

E-101 ships as a 1.2 MB glTF file with Draco-compressed meshes. Nothing loads until you ask:

Open the interactive diagram on tawfik.tv

Can you turn BIM or CAD files into an interactive 3D product or plant?

Yes. BIM to 3D is how I won SEVEN Al Hamra in Riyadh: I took the construction team’s Revit, IFC and Navisworks models, about 650 MB, and turned them into a real-time replica people walked through before the building opened. The browser version is a 74 MB download. People search for Revit to web or an IFC viewer online; a viewer shows the file as it is, while I rebuild it for speed.

Equipment works the same way from STEP or IGES CAD, GA drawings and datasheets. Standard equipment needs no CAD: E-101 is built from standard dimensions. If you want the model tied to live plant data, that is a digital twin.

What should a website for manufacturers and distributors do?

Answer the engineer first, then let the 3D sell. The rules I used for the client’s site:

1. Text first, 3D beside it. Each product page opens with a two-line answer, specs at a glance and the scope, with the film beside it on a laptop and after the facts on a phone.
2. A product finder. Search all 40 products from one box.
3. A quote button on every product, which carries the product name into the enquiry.
4. Client letters tied to products. Each reference letter shows on the product pages it talks about, not on a testimonial wall.
5. One URL per product, line and service, with a sitemap, unique titles and real HTML text that search engines can read.
6. Bilingual Arabic and English. Arabic pages live under /ar/ with hreflang pointing each page at its twin. The Arabic is formal Modern Standard Arabic, the register the sector writes in, with industry terms checked one by one.

Where do industrial companies use 3D, and what do you get?

Where it earns its keep: tenders and bid packs, trade shows on a screen or tablet, distributor and sales rep enablement, operator training, maintenance and shutdown planning, and LinkedIn.

What you receive: a master film rendered at the size you need, 4K included; LinkedIn cuts in 9:16 and 4:5; web-embeddable 3D; GLB and USDZ files for AR; interactive product pages; English and Arabic versions.

What I need from you: GA drawings, STEP or IGES CAD, BIM models (Revit, IFC, Navisworks), datasheets and photos of the real unit. For standard equipment, no CAD at all.

Can the same 3D make product demo videos for LinkedIn?

Yes, and they cost little once the model exists. From the client’s renders I cut 16 social clips of 21 seconds, with callouts that ride the parts and one instrument per product, such as a torque trace, an eddy current scope or a pressure dial.

How do you make industrial 3D load fast on a phone?

A scroll film is hundreds of pictures, so the trick is deciding which ones to send:

• AVIF frames. The phone film is 7.6 MB of AVIF at 720 by 1280, against 13.9 MB for the desktop set at 1920 by 1080.
• A skeleton first. The opening sends five landing frames and every eighth frame, then only frames near where you are. On data saver it sends every other frame.
• Load on approach. three.js and the AR viewer load only when their section comes within one and a half screens.

The phone’s first screen fell from 9.5 MB to 2.4 MB. Frames decode ahead of the playhead, and the live test showed zero janky frames on phone and desktop at four times CPU throttle. More on budgets in Unity WebGL on mobile and Gaussian splatting on a website.

What does 3D product animation cost?

Published market figures, not my prices:

• Animation. $5,000 to $50,000+ per finished minute, with about $10,000 as a mid-tier baseline. A 30-second product animation runs $5,000 to $15,000 basic, and $20,000 to $50,000+ for a technical version with exploded views (Framesixty, 10 September 2026). 4K rendering adds 20 to 40% and rush delivery 25 to 50% (Vidico, 18 September 2026).
• Rendering. $50 to $150 per image for basic items, $150 to $500 mid-range, $1,200 to $3,000+ for complex products (Framesixty, 29 July 2026).
• Configurators. Custom builds from $4,000 to $10,000 for one product, $10,000 to $30,000 with pricing logic, $30,000 to $150,000+ with ERP integration (Framesixty, 1 September 2026).
• The website. Web projects on Clutch typically cost under $10,000; the average agency project is $66,499.09 (Clutch, updated 21 September 2026).

The model is the biggest line. Reuse it everywhere and every later piece gets cheaper. I price each project after a first call.

How long does it take?

Framesixty puts mid-tier product animation at 4 to 8 weeks and custom three.js configurators at 2 to 4 months. SEVEN Al Hamra took me just under 12 weeks from first file to sign-off, by hand. With AI in my workflow now, the client’s seven families went from first model to live page in days.

Questions people ask

How much does 3D product animation cost?

Published 2026 guides put it at $5,000 to $50,000+ per finished minute, with 30-second product films from $5,000. A technical film with exploded views sits higher.

Do I need CAD files for 3D animation?

No. CAD, BIM or GA drawings save modelling time and make the model exact, but standard equipment can be built from datasheets and photos.

Can buyers view a 3D model in AR without an app?

Yes. A GLB file with model-viewer opens AR through the phone’s own viewer on Android and iPhone, from a link.

Does 3D on a product page slow the site down?

Only if it loads up front. Put the text first, show a still, and load frames or the model as the visitor reaches them.

Can you build a bilingual Arabic and English website?

Yes. Separate /ar/ pages with hreflang, right-to-left layout and formal Arabic, so each language ranks on its own.

What is the difference between 3D rendering and 3D animation?

Rendering makes still images, animation makes moving film. Both come from the same model.

If you sell equipment and want films, interactive 3D or a site that wins enquiries, see industrial 3D and web or write to me at m@tawfik.tv.

Buyers want tours more than agents supply them. In the National Association of Realtors’ 2025 Home Buyers and Sellers Generational Trends report, 41% of buyers who searched online rated virtual tours “very useful”. Only 16% of sellers who used an agent said the agent marketed their home with one.

I’m Mo Tawfik Khalifa. I build real-time 3D worlds: my Hermès virtual store, the TAG Heuer showroom I built at Napster, Virtual Expo Dubai with my team of 12, and SEVEN Al Hamra, a building you could walk through before it was built. Here is what each kind of tour costs, takes and is good for. Every price comes from the maker’s own page, checked in October 2026. None of them are my prices.

What is the difference between a 360 virtual tour and a 3D tour?

There are three kinds, and the names get mixed up.

1. 360 photo tour. A 360 camera takes one spherical photo per room. Software links the photos, and visitors jump from spot to spot and turn on the spot.
2. Scanned 3D tour. A scanning camera, or a phone, captures the rooms. Matterport is the name most people know. Visitors step between scan points, pull back to a dollhouse view, read a floor plan and measure rooms.
3. Real-time 3D. The place is drawn live by a game engine, so visitors walk anywhere, like a video game. It can be built from construction drawings, as I did for SEVEN Al Hamra, or scanned from a real place as a Gaussian splat.

So “360 virtual tour vs 3D” comes down to how people move: a 360 tour jumps, a scanned tour steps, real-time 3D walks.

How much does a virtual tour cost?

360 photo tour. You buy the camera once and the rest can be free.

• Camera: the Insta360 X5 lists at $549.99 and the Ricoh Theta X at $599.95.
• Software: Marzipano is free and open source, and its tool exports a web app you can put up as it is. 3DVista Virtual Tour Pro is 499 € once, with hosting from 99 € a year.

Scanned 3D tour. You pay per home, or you pay a subscription and scan it yourself.

• Done for you: HomeJab lists a Matterport-powered 3D tour at $319 for homes up to 4,000 sq ft and $459 at 6,000 to 8,000 sq ft, in most of the US. Matterport’s own capture service delivers in as fast as 24 to 48 hours.
• Yourself: Matterport’s free plan keeps one tour live and works with a phone or a 360 camera. The Professional plan is $108 a month for 10 tours, or $90 a month paid yearly. The Pro3 camera starts at $3,995.

Real-time 3D from drawings. I found no published price list worth quoting, because every building is a different job. The cost is the build. SEVEN Al Hamra took me just under 12 weeks by hand, from first access to the construction models to sign-off. For market ranges on 3D web builds, see what a 3D website costs.

Gaussian splat. Scaniverse scans on iOS and Android and makes the splat on the phone. Spark shows it in a browser and is open source under the MIT licence. You pay in time and a web host.

Switch the flat below between built and off-plan, then flip through the three tours. The quote sheet uses the numbers above.

Open the interactive diagram on tawfik.tv

Which virtual tour is best for real estate?

It depends on one question: does the place exist yet?

• Selling or letting a finished flat. A scanned tour. Buyers get the layout, the floor plan and the measurements, and $319 is a small line on a sale. If the budget is one camera, a 360 photo tour shows every room.
• Pre-selling a building that is not built. Real-time 3D from the drawings, because there is nothing to photograph or scan. SEVEN Al Hamra was still a construction site. I turned its Revit, IFC and Navisworks models into a building people explored floor by floor, by day and by night, and SEVEN signed it off as the first of six destinations for its 3D portal. Walk through it.
• A branded experience. Real-time 3D again, because you control every surface, light and product, and every room can end in an action. That is how I build virtual stores, and why the Expo 2020 twin is still open after the Expo closed.
• One real room with atmosphere. A Gaussian splat keeps the real light and texture of a place in a small file. My window demo runs Spark’s own sample scene, and I explain the method in Gaussian splatting on a website.

How do you make a 3D virtual tour?

1. Decide what people must do inside. See every room, measure rooms, or walk a building that does not exist yet. That picks the kind.
2. Check what you start from. A finished place can be photographed or scanned. An unbuilt one starts from the construction models: Revit, IFC or Navisworks.
3. Capture. One 360 photo per room, or a scan at every step through the space, or the 3D views exported from the building model.
4. Build. Link the photos in the tour editor, let Matterport process the scans, or strip, optimise and light the model in a game engine. For SEVEN Al Hamra I left out 758 hidden objects, like cable trays and ducts, that no visitor would ever see.
5. Host it. A subscription for scanned tours, or plain files on a web host for the rest.
6. Test on the weakest phone your buyers use, on mobile data, before anyone sees it.
7. Put it where buyers look: the listing, the portal and the agent’s own site.

What does a virtual tour cost to keep online?

• Scanned tours live on the subscription. Stop paying and archive one, and Matterport says the tour can’t be viewed until you reactivate it.
• 360 tours, splats and WebGL builds are plain files. Any web host serves them, with one download per visitor.
• Streamed real-time 3D renders on a cloud GPU for each viewer, at about $0.53 an hour each on AWS. That is why I build for the browser unless the visuals are worth the bill.

Will a virtual tour work on a phone?

The more freedom a tour gives, the more it weighs.

• 360 photo tour: the Marzipano viewer is 55 KB gzipped, then the photos. The lightest of the three.
• Gaussian splat: the scene in my window demo is 4.4 MB, about 5.5 MB with the renderer. Spark says it renders fast even on low-powered mobile devices.
• Real-time 3D: the SEVEN Al Hamra web build is a 74 MB download, drawing about 700,000 triangles at 60 fps on a laptop graphics chip. On phones it plays a short video first and loads the 3D when you ask.

Questions people ask

How much does a virtual tour cost?

From a $549.99 camera and free software for a 360 photo tour, to $319 for a scanned tour of a home done for you, to a quoted custom build for real-time 3D. Scanned tours also need a subscription to stay online.

Is a 360 tour the same as a 3D tour?

No. A 360 tour is linked photos you jump between. A scanned 3D tour adds depth, so you get a dollhouse, a floor plan and measurements. Real-time 3D lets you walk anywhere.

Do I need a Matterport camera?

No. Matterport’s free plan works with a phone or a 360 camera. The Pro3 camera, from $3,995, is for people who scan for a living.

Can you make a virtual tour of a building that is not built yet?

Yes, as real-time 3D built from the construction models. Photos and scans need finished rooms. SEVEN Al Hamra is one I built while the venue was still a site.

What is the best virtual tour software?

The best one depends on the kind. For 360 tours, Marzipano is free and 3DVista is a one-off licence. For scanned tours, Matterport. For real-time 3D, a game engine such as Unity or Unreal. For splats, a scan app such as Scaniverse and a renderer such as Spark.

If you need a tour or a walkable building made, write to m@tawfik.tv, or see how I take on 3D web projects.

I ship with AI at every step, and I built a live app on my own with AI doing the typing. This is what I have learned about the gap between the vibe and production.

What is vibe coding?

Andrej Karpathy coined the term in a post on 2 February 2025: a new kind of coding where you “forget that the code even exists”. He accepted every change without reading the diffs, pasted error messages straight back to the AI, and said it was fine for throwaway weekend projects. Nine months later, Collins named vibe coding its Word of the Year 2025.

Most professional developers keep their distance. In the Stack Overflow 2025 Developer Survey (July 2025), 72% of respondents said vibe coding is not part of their professional development work and another 5% said so emphatically, while 84% use or plan to use AI tools. The difference is ownership: AI-assisted engineering means someone reads the code, tests it and answers for it. Vibe coding means nobody does.

What tools do people use for vibe coding?

Two kinds, and many people use both.

• App builders in the browser. Lovable, Bolt, Replit and v0. You describe the app in a chat and get a running app, often with hosting and a database wired in.
• AI code editors and coding agents. Cursor, Claude Code, Codex, Gemini CLI and GitHub Copilot. They work in a real code repository on your machine and can run commands.

Underneath, most vibe-coded apps land on the same few services: a hosted database such as Supabase or Firebase, a host such as Vercel or Netlify, and Stripe for payments. That matters, because those services are where the production rules live.

What is vibe coding good for?

• Prototypes that customers or investors can press and break, in days.
• Internal tools for a handful of people you trust.
• One-off apps for an event, where the stakes and the lifetime are short.
• Testing a product idea before you spend on a team.

I built Laqtaa, a shared wedding photo app, on my own for a friend’s wedding: one shared camera for your event. About 100 guests used it on the day and nothing broke. Before any code I wrote a 780-line brief with a hard deadline. Even so, on the first day, a couple of hours after 6 milestones were built and deployed in 53 minutes, the next commit read “resolve all critical runtime bugs”. Over 5 weeks it took 188 commits, 93 of them fixes. The full story is in can one person with AI do a whole team’s work.

Where do vibe-coded apps break in production?

In the parts a demo never touches: other people, other people’s data and money.

• Sign-in and roles. The login works, but the check for who is staff sits in the browser or reads a field users can edit.
• Data rules. The database answers anyone holding the public key. In Supabase that means Row Level Security is off or too loose; my Supabase security checklist has the SQL.
• Secrets. A secret key ends up in the JavaScript every visitor downloads, or in git history. The vibe coding security checklist covers secrets and the other 12 checks to run before launch.
• Payments. The app marks an order paid when the customer lands on the “thank you” page, or trusts any message sent to its payment webhook. Stripe warns that without signature verification “an attacker could send fake webhook events” to trigger actions like fulfilling orders, and that endpoints can receive the same event more than once (Stripe webhooks).
• Scale. Ten testers work fine. Two hundred people at your busiest moment run out of database connections, and two of them book the same table. Supabase tells you to use its transaction mode pooler for serverless functions, which “open many short-lived connections” (Supabase docs).
• Nobody understands the code. Karpathy wrote that his code grew beyond his usual comprehension. With no tests and no notes, each new prompt fixes one thing and breaks another, and nobody can say why.
• The agent itself. The AI that wrote the app has a shell and your keys. It can delete your database.

The payment fix is short once you know it. Verify the signature on the raw body, and skip events you have already handled:

// app/api/stripe-webhook/route.ts (Next.js)
import Stripe from 'stripe';
const stripe = new Stripe(process.env.STRIPE_SECRET_KEY!);

export async function POST(req: Request) {
  const body = await req.text();   // the raw body, not parsed JSON
  let event: Stripe.Event;
  try {
    event = stripe.webhooks.constructEvent(
      body, req.headers.get('stripe-signature')!, process.env.STRIPE_WEBHOOK_SECRET!);
  } catch {
    return new Response('bad signature', { status: 400 });
  }
  // store event.id; if you have seen it before, return 200 and do nothing
  return new Response('ok');
}

And the double booking is one line of SQL, so the database refuses the second guest whatever the browser thinks:

alter table bookings
  add constraint one_booking_per_slot unique (table_id, slot_start);

What stands between a prototype and production?

Gates. Below is a release pipeline for a made-up restaurant booking app, built over a weekend with an AI app builder. Each gate runs a real kind of check and fails the way vibe-coded apps fail. Pick a fix and re-run the gate: some fixes look right and still fail. The last three gates are where an engineer earns their fee.

Open the interactive diagram on tawfik.tv

How do you take a vibe-coded app to production?

This is the order I work in when I take a prototype to production as a forward deployed engineer. I come from coding and design, and I use AI at every step; the steps are what the AI does not do on its own.

1. Write down what the prototype does. The three or four flows that matter, who uses them and what must never happen. The prototype is now the spec.
2. Get the code into a repository you own, with separate development and production databases and keys.
3. Run the security pass. The 13 checks take an afternoon for a small app.
4. Rebuild the risky paths properly: sign-in, payments and anything that writes data, each with tests.
5. Load test your busiest moment, then fix what falls over, in the database, not the browser.
6. Put a guard on the coding agent. I built GVNR, a free and source-available guard that runs on your own machine and works with Claude Code, Cursor, Codex, Gemini CLI and any MCP client. Before each action it decides allow, deny or ask a person, and it keeps a hash-chained record of every decision.
7. Ship with a way back: a backup you have restored once, the previous release ready to roll back to, and alerts when errors spike.
8. Name an owner, with a one-page note on how the app runs and deploys.

When should you bring in an engineer?

Before the app does any of these:

• Takes money, including deposits and subscriptions.
• Stores other people’s personal data, or anything regulated such as health or financial records.
• Opens to people you do not know, at a launch, a sale or a busy hour.
• Breaks somewhere new every time you fix something.

You do not need a team for this. You need one person who reads the code, hardens the parts that carry risk and hands it back with tests and notes. That is the work I do as a fractional CPO and forward deployed engineer: prototypes in days, then the hardening that gets them to production.

Questions people ask

Who coined the term vibe coding?

Andrej Karpathy, a founding member of OpenAI and former Director of AI at Tesla, in a post on X on 2 February 2025. Collins Dictionary named it Word of the Year 2025.

Is vibe coding bad?

No. It is the fastest way to a working prototype. It becomes a problem when a prototype goes live with real users, data or payments and nobody has read the code.

Can a vibe-coded app go to production?

Yes, after it passes the gates: secrets, sign-in and data rules, payments, load and handover. Keep what works, rebuild only what fails.

Do I need to know how to code to vibe code?

Not to build a prototype. To ship it safely, someone on the project needs to read code, or you need to bring that person in before launch.

What is the difference between vibe coding and AI-assisted coding?

Who owns the code. In AI-assisted coding a person reads, tests and answers for every change. In vibe coding the AI’s output goes in unread.

If you have a vibe-coded app that needs to reach production, write to me at m@tawfik.tv.

The token is a new way to keep the share register. It does not replace the land registry, the valuation, the tenancy or securities law.

The market is small today and forecast to grow fast. In April 2025 the Deloitte Center for Financial Services predicted that US$4 trillion of real estate will be tokenized by 2035, up from less than US$0.3 trillion in 2024. Dubai’s land department projects tokenized property at AED 60 billion by 2033, 7% of the emirate’s real estate transactions.

What is real estate tokenization, explained simply?

A token is an entry on a shared ledger that says who owns what. In real estate it usually stands for a share in the SPV that owns a building, or a slice of a loan secured on it. Selling the token sells the share. The house itself never moves onto a blockchain.

Regulators read it the same way. On 28 January 2026, three divisions of the US SEC published a statement on tokenized securities: the federal securities laws apply whatever format a security is issued in. The UK FCA’s policy statement PS26/7, published on 30 April 2026, defines tokenisation as representing an asset, or ownership of one, using distributed ledger technology.

I have worked on this from the inside. As a forward deployed engineer at Instruxi, I worked with a client who turns rented homes into tokens that back a loan. I built a prototype that reads their live test network and follows each step: house, token, vault, loan, rent. It has four break-it gates (title check, valuation, rent feed and holder check) and the client’s own yield formula as sliders. The full story is in four AI and fintech builds. Everything below comes from that work and from the primary sources linked.

How do you tokenize a property, step by step?

1. Set up the SPV. One company per property, owning that property and nothing else. In the UK, registering a company online with Companies House costs £100, plus a £50 online confirmation statement each year.
2. Put the title in the SPV’s name. The land register names the SPV as owner. Token holders own the company, so a token sale never touches the register, and only the SPV can sell the house.
3. Get an independent valuation. Tokens times price should land near it. Price far above it and buyers overpay from day one. Keep it fresh, because a stale valuation is the number lenders and buyers lean on.
4. Pick the legal route for the offer. In the US, tokens sold privately under Regulation D are restricted securities, and Rule 144 holds them for six months if the issuer files reports with the SEC, one year if it does not. In Dubai, the land department’s pilot sells through a licensed platform, with VARA, the virtual assets regulator, as a partner.
5. Issue a token with transfer rules built in. It checks every buyer before it moves. More on standards below.
6. Decide who holds the keys. The token contract has admin keys that can freeze a wallet or move tokens after a lost key or a court order. A regulated custodian or transfer agent should hold them, under written rules.
7. Wire up the rent. A letting agent collects it off chain, costs come off the top, and the rest is paid per token to each holder’s wallet.
8. Plan the exit. Holders need somewhere to sell, and buyers who pass the same checks. Without a venue and a lock-up schedule, “liquid” is a promise.

Try it: a deal room for one London house

Set the number of tokens and the price, collect rent, make the tenant move out, then try to sell tokens to a buyer who should be refused. Every number is a sample.

Open the interactive diagram on tawfik.tv

Which token standard is best for real estate?

Use a permissioned security token, not a plain ERC-20. A plain token moves to any wallet, so the SPV loses track of who its shareholders are.

ERC-3643 is a final Ethereum standard for permissioned tokens. Before any transfer it checks the buyer against an identity registry, then runs compliance rules such as caps per country or per investor. It also supports frozen wallets, pausing, and recovery when an investor loses their keys. ERC-1400 solves the same problem, adding transfer checks that return reason codes and documents attached to the token, but it never became a final standard.

The check order, as ERC-3643 lays it out:

before transfer(from, to, amount):
  token paused?                               refuse
  from or to wallet frozen?                   refuse
  identityRegistry.isVerified(to) is false?   refuse   # buyer has no checked identity
  compliance.canTransfer(from, to, amount)?   refuse   # country, holder caps, lock-ups
  move the tokens, then tell compliance it happened

The identity check is the same idea as proving your age once and showing a signed yes afterwards, which I cover in prove you’re over 18 without showing your ID.

How do token holders get paid rent?

The tenant pays the letting agent in pounds, dollars or dirhams. The agent takes its fee, the SPV tops up its repairs reserve and pays insurance and accounts, and what is left is divided by the number of tokens. That figure per token goes to each wallet, usually in a stablecoin or straight to a bank account. If the payout runs on stablecoins, how a bank issues its own stablecoin covers the money side.

The rent feed is the weak point. The blockchain only knows what the agent reports. In the prototype, the rent feed is one of the four gates: switch it off and you see what fails without it.

Where is real estate tokenization actually live?

Dubai is the clearest government-run example. The Dubai Land Department launched its tokenization pilot on 19 March 2025 with VARA and the Dubai Future Foundation, the first registration body in the Middle East to tokenize title deeds. Its first licensed platform opened on 25 May 2025: from AED 2,000, ready properties only, UAE ID holders only, and dirhams only during the pilot.

In the UK, the Property (Digital Assets etc) Act 2025 received Royal Assent on 2 December 2025. It confirms that crypto-tokens can be property in law, which matters when a token holder goes bust or a court needs to trace a token.

What breaks?

These are the failures I built gates for, plus the ones every deal room should test:

• Title mismatch. The token says one house, the register says another owner, or a charge nobody disclosed.
• Stale valuation. The price per token still reflects last year’s number.
• Rent feed down or wrong. Payouts stop, or worse, pay on rent that never arrived.
• Holder check off. A token reaches a wallet nobody has verified, and the SPV has a shareholder it cannot name.
• Lost or misused admin keys. Whoever can freeze and move tokens is the real control point.
• No buyers. A token you can send but cannot sell is not liquid.

What does it cost to tokenize a property?

The fixed government fees are small: £100 online to register the UK SPV and £50 a year for its confirmation statement, per Companies House. The real money goes on lawyers for the offering, the valuation, a transfer agent or custodian, a smart contract audit and the platform’s fees. I have not found published prices for those that I would trust, so get written quotes for each before you commit.

Questions people ask

Is tokenized real estate legal?

Yes, where it follows the securities and property laws that already apply. The SEC says a tokenized security is still a security, and Dubai runs a licensed pilot through its land department.

Do token holders own the house?

No. They own shares in the SPV, and the SPV owns the house. The land register names the SPV.

Can I tokenize my own house?

You can put it in a company and issue the shares as tokens. Selling those tokens to other people is a securities offering, so you need a lawyer and the right exemption or licence where your buyers live.

What does an RWA tokenization platform do?

An RWA (real world asset) tokenization platform sets up the SPV, checks investors’ identity, issues the token with its transfer rules, keeps the register in step with the company’s records, and pays out income. Ask who holds the admin keys before you sign.

Can I sell real estate tokens any time?

Only to buyers who pass the token’s checks, and only after any lock-up. US private placements fall under Rule 144’s six-month or one-year holding period.

Which blockchain is best for real estate tokens?

The one your investors, custodian and transfer agent already support. The token standard and its rules matter more than the chain.

If you need a tokenization product scoped, prototyped or explained to investors, write to m@tawfik.tv, or see how I work as a fractional CPO.

The idea has been in mainstream use for years. In a February 2019 survey of 599 organisations implementing the Internet of Things, Gartner found 13 percent already used digital twins and another 62 percent were setting them up or planned to within a year.

I build the 3D side of them. For the FIFA World Cup in Qatar, Expo 2020 and SEVEN, I turned engineering models into live Unreal and Unity environments. What one costs is in how much a digital twin costs. This page covers what one is.

What is a digital twin?

The Digital Twin Consortium defines it as “an integrated data-driven virtual representation of real-world entities and processes, with synchronized interaction at a specified frequency and fidelity.”

In plain words, a twin has three parts:

1. The copy. A model of the thing: its shape, its parts and how they connect.
2. The real thing. A machine, a room, a crowd, a road network.
3. The link. Data that keeps the copy in step with the real thing. “Frequency” is how often it updates: every second for a queue, once a day for a lease plan. “Fidelity” is how much detail it carries.

Take the link away and you have a model. That is the whole test.

The Consortium also names a stage before that: a digital twin prototype, which models and simulates the future before it is linked to the real thing. A building modelled before it is built is one.

What is the difference between a digital twin, a 3D model and a simulation?

• A 3D model copies the shape. It is frozen: when the real pump stops, the model does not know.
• A simulation is maths that predicts what would happen, usually from assumptions typed in by hand.
• A digital twin is a model plus the live link. When it also runs a simulation on the live readings, it becomes a twin that predicts.

Pick a pump, a shop or a stadium gate below and step through the four levels. Only the last two are twins.

Open the interactive diagram on tawfik.tv

How does digital twin technology work?

Every twin I have seen is built from the same four layers. You add them in this order, and many projects stop after the first one.

1. Model. The shape, from CAD drawings, BIM files or a laser scan. For people to walk through it, it goes into a real-time engine: Unity, Unreal or WebGL in the browser. On SEVEN Al Hamra I started from the Revit, IFC and Navisworks construction models, the same files the builders used.
2. Sensors and data. Readings from the real thing: flow and vibration on a pump, door counts and till data in a shop, ticket scans at a gate, energy meters in a building. Most of it already exists somewhere; the work is getting it out.
3. Platform. Software that holds the model and the data and keeps them in step. Azure Digital Twins, AWS IoT TwinMaker and Autodesk Tandem are the common ones; I compare their prices in digital twin cost.
4. Simulation. The maths that turns readings into a forecast. The interactive uses three real ones: the pump affinity laws, where power follows the cube of speed, so slowing a pump by 20% cuts its power by about half (US Department of Energy); the Erlang C queueing formula for tills; and the Green Guide’s 660 people an hour per turnstile for stadium gates.

Under the hood, the platform stores each real thing as a typed record. This is a pump in DTDL, the modelling language Azure Digital Twins uses: telemetry is what the sensors send, a property is a setting you can change, a relationship links it to other twins.

{
  "@context": "dtmi:dtdl:context;3",
  "@id": "dtmi:com:example:Pump;1",
  "@type": "Interface",
  "displayName": "Pump",
  "contents": [
    { "@type": "Telemetry", "name": "flow", "schema": "double" },
    { "@type": "Telemetry", "name": "vibration", "schema": "double" },
    { "@type": "Property", "name": "speedPercent", "schema": "double", "writable": true },
    { "@type": "Relationship", "name": "feeds", "target": "dtmi:com:example:Tank;1" }
  ]
}

What are some digital twin examples?

Buildings

I turned SEVEN’s construction models for Al Hamra in Riyadh into a building you can walk through in a browser, before it was built. It took just under 12 weeks from first access to sign-off, by hand. By the Consortium’s definition it is a digital twin prototype: the copy came first, so people could explore floors and units of a venue that did not exist yet.

Factories

BMW Group says its Debrecen plant in Hungary is its first plant planned and validated completely virtually (March 2023), with vehicle production running in the twin more than two years before series production. Gartner’s survey gives the smaller version: in a power plant, each valve, pump and generator can have its own twin, plus one twin that combines them.

Cities

Helsinki calls its 3D city models the city’s digital twin. Its Energy and Climate Atlas shows energy and renovation information building by building, and its Kalasatama project ran on the rule “design, test and build digitally first.”

Events

OnePlan says its browser-based VenueTwin was used across 49 venues by 46 functional areas to plan the Paris 2024 Games. Temporary venues such as the Eiffel Tower Arena existed only in the twin before they were built.

At Expo 2020 Dubai my team of 12 worked on Virtual Expo Dubai, the whole site in real-time 3D. The Expo closed. The twin is still live. How an event twin earns its keep before, during and after the event is in virtual stores, live shows and 3D worlds.

The same engines also run virtual places where people meet. With Napster, DMCC launched its Crypto Centre metaverse in Dubai: walk into a boardroom where avatars meet, or join the treasure hunt, in a desktop browser. I led a 24-person team at Napster. A world like that becomes a twin only when it is linked to live data from a real place.

Is a 3D virtual tour a digital twin?

No. A 360 tour is photos you click between, and a scan-based 3D tour is a model of how a place looked on the day it was scanned. Both sit at level two or below in the interactive: a copy with no live link. The differences and prices are in how much a 3D virtual tour costs.

How do you start a digital twin?

Start from a decision, not from the technology.

1. Write down the one decision the twin should help with. How many lanes to open at 6 pm. Which pump to service first. Whether a lease plan works on floor two.
2. Pick the lowest level that answers it. If people only need to see and walk the place, a 3D model is enough and costs far less. SEVEN needed exactly that before opening.
3. List what already exists. Drawings, BIM, the building management system, ticketing, till and maintenance data. Every file you have is one nobody models by hand.
4. Set the frequency and the fidelity. Every second or once a day; every bolt or just the rooms. This choice drives the cost more than any platform.
5. Choose where people will open it. A control room screen, a laptop browser, a phone. The weakest device sets the budget for the model.
6. Twin one asset end to end first. One pump, one shop, one gate, from data to screen, then copy the pattern.

Questions people ask

What is a digital twin in simple terms?

A live copy of something real. It looks like the real thing, it updates when the real thing changes, and you can try changes on the copy first.

What is digital twin software?

Two kinds of software working together: a platform that holds the data and keeps it in step, such as Azure Digital Twins, AWS IoT TwinMaker or Autodesk Tandem, and an engine that shows it in 3D, such as Unity, Unreal or three.js in the browser.

Is a BIM model a digital twin?

Not on its own. BIM is the model layer. It becomes a twin when live data from the finished building is linked to it.

What are digital twins used for?

Planning a building, plant or venue before it exists, watching it while it runs, finding faults before they cause a failure, and testing changes such as layouts, staffing or machine settings on the copy first.

How much does a digital twin cost?

It depends on the levels you need. I break a building twin down line by line, from the 3D model to sensors, platform and simulation, in how much a digital twin costs.

If you have the drawings or the BIM and want a twin people can open from a link, see how I take on 3D web projects or write to m@tawfik.tv.

It happens at scale. In May 2025, Matt Palmer scanned 1,645 apps from Lovable’s public showcase and found 170 whose Supabase tables anyone could read or write, through 303 endpoints, because RLS was missing or wrong (his statement; filed as CVE-2025-48757, which Lovable disputes). In February 2026, Wiz found Moltbook’s Supabase database open with RLS disabled: 1.5 million API tokens, 35,000 email addresses and thousands of private messages, readable and writable with the key sitting in the site’s JavaScript (Wiz, 2 February 2026).

I have moved apps onto Supabase and fixed database security on live ones. The same settings come up every time. Here they are in the order I check them, with SQL you can paste.

Is the Supabase anon key safe to expose?

Yes, when RLS is on and your policies are right. The anon key, now called the publishable key (sb_publishable_...), is built to sit in your web or mobile app. Supabase lists it as safe to expose in web pages, apps and source code, and says RLS decides what that client can reach (API keys). When data leaks through it, the cause is a missing or loose policy.

The secret key (sb_secret_..., or the legacy service_role key) is the dangerous one. In Supabase’s words, it “bypasses every Row Level Security policy you have”. It lives on your server and nowhere else. Search your built JavaScript for sb_secret_, and decode the middle part of any legacy key that starts with eyJ: it must say "role":"anon". If a secret key has shipped, rotate it today.

Who can read your table?

With RLS off, anyone holding your publishable key can read and change every row. With RLS on and no policy, nobody can. An owner-only policy gives each signed-in user their own rows, and a view created without security_invoker skips all of it. Try each one below. I checked every combination against real Postgres with Supabase’s anon and authenticated roles.

Open the interactive diagram on tawfik.tv

The Supabase security checklist

1. Turn on RLS on every table the API can see. Tables you create in the dashboard get RLS automatically. Tables created in SQL or by a migration start with it off, and by default Supabase has granted visitors and signed-in users access to new tables in public, a default it is moving to opt-in (hardening the Data API). Find the gaps:

-- tables in public with RLS off
select tablename from pg_tables
where schemaname = 'public' and not rowsecurity;

-- turn it on, one line per table
alter table public.orders enable row level security;

With RLS on and no policy, the API returns nothing (Row Level Security). That is the safe way to fail. If your app never uses the Supabase client libraries, you can turn the Data API off altogether.

2. Never use using (true) on private data. A policy with no to clause applies to every role, PUBLIC in Postgres terms, and true lets every row through. That includes visitors who never signed in. Name the role and check the owner:

create policy "Read own orders" on public.orders
  for select to authenticated
  using ((select auth.uid()) = user_id);

create policy "Edit own orders" on public.orders
  for update to authenticated
  using ((select auth.uid()) = user_id)
  with check ((select auth.uid()) = user_id);

3. Pair every update policy with a select policy. Supabase needs a matching SELECT policy before an UPDATE can work. using decides which rows a user may change, with check decides what the row may look like afterwards. Postgres reuses using when you leave with check out; write both so the rule is visible.

4. Check roles from app_metadata, never user_metadata. Signed-in users can edit their own user_metadata, so a policy that trusts it lets anyone promote themselves. Put roles in app_metadata, which only your server can set:

create policy "Owners or admins read" on public.orders
  for select to authenticated
  using (
    (select auth.uid()) = user_id
    or (select auth.jwt() -> 'app_metadata' ->> 'role') = 'admin'
  );

5. Make every view security_invoker. Supabase’s docs say it plainly: views bypass RLS by default, because the postgres user usually creates them. Postgres checks a view’s tables against the view owner unless security_invoker is set (CREATE VIEW). On Postgres 15 and later:

alter view public.order_list set (security_invoker = true);

Materialized views and foreign tables cannot be protected by RLS at all, so keep them out of exposed schemas.

6. Lock down security definer functions. They run with their creator’s rights and can return rows the caller is not allowed to read (database functions). Prefer security invoker, the default. Where you need definer, pin the search path and take execute away from roles that should not call it:

alter function public.is_admin() set search_path = '';
revoke execute on function public.is_admin() from public, anon;

7. Keep secret keys on the server. Edge Functions, your backend, CI secrets: fine. The browser, a mobile app, a public repo: never. If one leaked, create a new key, swap it in everywhere, then delete the old one.

8. Write storage policies per folder. Storage refuses uploads until a policy allows them, and files in a public bucket can be read by anyone with the URL (storage access control). Give each user a folder named after their ID:

create policy "Upload to own folder" on storage.objects
  for insert to authenticated
  with check (
    bucket_id = 'uploads'
    and (storage.foldername(name))[1] = (select auth.jwt() ->> 'sub')
  );

9. Tighten Auth. From Supabase’s production checklist: turn on email confirmations, set one-time password expiry to 3,600 seconds or lower, use your own SMTP server (the built-in one is limited to 2 emails an hour), and switch on CAPTCHA for sign-up, sign-in and password reset. On Pro and above, turn on leaked password protection, and keep the minimum password length at 8 or more. Protect your own Supabase account with MFA.

10. Restrict direct database connections. Network restrictions and SSL enforcement cover Postgres and the connection pooler. They do not cover the HTTPS APIs, which always use SSL, so they sit alongside RLS rather than replacing it.

supabase network-restrictions update --project-ref YOUR_REF --db-allow-cidr 203.0.113.10/32
supabase ssl-enforcement update --project-ref YOUR_REF --enable-db-ssl-enforcement --experimental

11. Keep a backup you have restored. Free projects get no automatic daily backups, so run supabase db dump on a schedule. Pro keeps 7 days, Team 14, Enterprise up to 30. Supabase recommends point-in-time recovery once a database passes 4 GB, and it needs at least the Small compute add-on. Files in Storage are not in database backups (backups).

12. Run the Security Advisor before every release. It sits in the dashboard under Advisors and flags most of this list by name: “Table Publicly Accessible”, “View Bypasses Row-Level Security”, “Security Policy Allows Unrestricted Access”, “Security Policy Relies on User-Editable Data” and “SECURITY DEFINER Function Callable Without Sign-In” (database advisors). Clear every security warning before you ship.

If an AI coding agent works on your project, give it a read-only role and keep the secret key out of its reach. The MCP security checklist and how to stop an agent deleting your database cover that side.

How do I fix slow Supabase queries caused by RLS?

A policy runs against every row the query touches, so a slow policy makes every read slow. Supabase’s own benchmarks show the size of the wins (RLS performance and best practices): an index on user_id took a query from 171 ms to under 0.1 ms, wrapping auth.uid() in a select took one from 179 ms to 9 ms, and adding to authenticated cut a visitor’s request from 170 ms to under 0.1 ms.

-- 1. index every column a policy filters on
create index orders_user_id_idx on public.orders using btree (user_id);

-- 2. slow: calls auth.uid() for every row
using (auth.uid() = user_id)

-- 2. fast: Postgres runs it once per query
using ((select auth.uid()) = user_id)

-- 3. filter in the query too, not only in the policy
supabase.from('orders').select('*').eq('user_id', userId)

The Performance Advisor flags the second one as “Slow Security Policy Detected”, along with foreign keys that have no index.

Moving from Firebase? The rules model is different, and moving from Firebase to Supabase shows how security rules turn into policies.

Questions people ask

Is the Supabase anon key safe to expose?

Yes. It is designed to be public. RLS and your policies decide what it can reach, so it is only as safe as the policies on every exposed table.

What happens if RLS is on but there are no policies?

The API returns nothing for that table, to anyone using the publishable key, including your signed-in users. Add a policy to open it up.

Does the service_role key bypass RLS?

Yes. The service_role key and new secret keys skip every policy. Use them only on a server you control.

Why can my users read rows but not update them?

An update needs both an update policy and a select policy on the same table. Check that the update policy’s using and with check both match the owner.

Do Supabase views respect RLS?

Not by default. A view runs as its owner, usually postgres, which skips RLS. Set security_invoker = true on Postgres 15 or later.

How do I check my Supabase project for leaks?

Open the Security Advisor, run the RLS query in step 1, and check your built JavaScript for secret keys. Then sign out and call your tables with only the publishable key.

If you need a Supabase project checked and fixed before launch, write to me at m@tawfik.tv.

The pressure to act is in the deposits. On 15 December 2025 ICBA, the community bankers’ trade body, estimated that letting crypto firms pay interest on stablecoins would pull $1.3 trillion of deposits out of community banks and cut their lending by $850 billion.

I’m Mo Tawfik Khalifa, chief product officer and forward deployed engineer at Instruxi. I have built the customer side of this twice: dollars, stablecoins and tokenized gold in one balance, with a checkpoint in front of every move. This is what the law allows, the four ways in, the part a bank has to build itself, and a 90-day pilot.

What does the GENIUS Act allow banks to do?

The parts of the law’s text a bank needs first:

• Who may issue. Only a “permitted payment stablecoin issuer” can issue a payment stablecoin in the US. For a bank, that means a subsidiary approved under section 5. Nonbank issuers get a federal or state licence instead.
• A clock on approval. The regulator has to decide within 120 days of receiving a substantially complete application.
• One for one reserves. Every coin is backed at least one to one by cash, deposits at insured banks, Treasury bills of 93 days or less, and a short list of similar assets.
• Monthly disclosure. The issuer publishes the size and makeup of its reserves every month, an accounting firm examines the report, and the CEO and CFO certify it.
• No interest. An issuer may not pay holders interest or yield just for holding the coin.
• No deposit insurance. Stablecoins are not insured, and saying they are is unlawful.
• Full anti-money laundering duties. The issuer counts as a financial institution under the Bank Secrecy Act: customer identification, a sanctions programme, suspicious activity reporting, and the technical ability to block, freeze and reject transactions.
• Timely redemption. The issuer must publish clear redemption procedures, and only regulators can put discretionary limits on redemption.
• Tokenized deposits are separate. The definition of a payment stablecoin excludes a deposit, “including a deposit recorded using distributed ledger technology”. Section 16 keeps a bank’s power to issue digital assets that represent its deposits.

When it starts. The Act takes effect on the earlier of 18 January 2027, 18 months after signing, or 120 days after the regulators issue final rules. The OCC proposed its rule on 25 February 2026, the FDIC on 7 April 2026 and the Federal Reserve on 24 September 2026. On 19 August 2026 the Comptroller said the OCC would have a final rule out by November.

What is allowed already. On 7 March 2025 the OCC confirmed that crypto custody and certain stablecoin activities are permissible for national banks. On 28 March 2025 the FDIC said the banks it supervises may do permissible crypto activities without asking first, as long as they manage the risks.

What are the four ways a bank can offer stablecoins?

From the most work to the least.

1. Issue. The bank sets up a subsidiary, applies to its federal regulator, holds the reserve, publishes it monthly and runs the full compliance programme. A bank that wants a digital dollar without a new subsidiary can tokenize its own deposits instead, and those stay deposits under the law.
2. Partner. A white-label stablecoin: an issuer that is already permitted issues the coin, and the bank puts its brand and its customers on it. The law is clear that the issuer of record must be a permitted issuer, so the contract decides who answers for what.
3. Distribute. The bank lets customers buy, hold and send existing stablecoins and tokenized gold inside the app they already use. Section 16 says regulated banks may act “as a principal or agent” with any payment stablecoin. From 18 July 2028, three years after signing, a digital asset service provider may only offer US customers stablecoins from permitted issuers, with narrow exceptions for some foreign issuers, so choose the coin with that date in mind.
4. Hold. The bank safeguards coins and keys for customers, which section 16 confirms banks may do. It can also hold another issuer’s reserves as deposits, since cash at an insured bank is an eligible reserve asset. That one brings deposits back in.

A bank does not have to pick one. Distributing and holding can start now, and issuing can wait for the final rules.

Tokenized gold sits outside the GENIUS Act. A payment stablecoin has to be redeemable for “a fixed amount of monetary value”. A gold token is redeemable for a weight of metal, so it does not meet that definition. Its rules come from elsewhere, and the bank’s counsel should map them before launch.

What does a bank have to build that it cannot buy?

Access is easy to buy. Large providers already resell custody and stablecoin payments to thousands of banks. What a bank cannot buy off the shelf is the decision: who passed identity checks, who may send, mint or redeem, up to what limit, checked before the money moves, and written into a record an examiner will accept. Those rules are the bank’s, so the layer that applies them has to be the bank’s too.

The first build was a bank-in-a-box for a listed gold company: a white-label app where a bank’s customers hold dollars, stablecoins and tokenized gold in one balance. Every send or purchase goes through a checkpoint of 11 ordered rules with three outcomes: allowed, held, or unavailable when a fact the checkpoint needs, such as the gold price, has gone stale. The second was a partner-bank app: customers keep the keys to their own wallet, the bank chooses what is on the menu, and every move is checked before it happens. The full story is in forward deployed engineer: four AI and fintech builds.

The rules that matter, in the order a checkpoint should read them:

• Identity. Has this person passed the bank’s identity check? I wrote about proving who someone is without exposing their whole file in how to prove who someone is.
• Sanctions. A match freezes the money and goes to a person. The app never clears it on its own.
• Funds and limits. The balance is there and the bank’s daily limit is respected, except on redemption, where the law gives that power to regulators only.
• Fresh facts. A stale price makes the answer “unavailable”. The checkpoint does not guess.
• Reserve. No new coin is issued unless every coin already out is covered one for one.
• The record. Every decision is written down, including the ones that stopped, with the rule that stopped it.

Try it below. Pick an action, switch facts off, and watch where the money stops.

Open the interactive diagram on tawfik.tv

The order is part of the rule. If the sanctions screen runs after the limit check, a sanctioned customer gets a polite “held for approval” when the money should be frozen and reported. Compliance sets the order once, in plain English, and the checkpoint follows it every time.

What does a 90-day stablecoin pilot look like?

How I would run it: small, measured, and easy to stop.

1. Days 1 to 15: pick one route and one use. For example: distribute one permitted stablecoin to staff accounts only. Write the rules in plain English with the compliance officer, in order, with the outcome for each.
2. Days 16 to 45: wire the checkpoint. Connect it to the identity check, the sanctions screen and the core ledger the bank already runs. Nothing gets ripped out. Every rule gets a test that breaks it on purpose.
3. Days 46 to 75: go live with low limits. Staff first, then a small group of customers. Track holds, refusals and time to decide weekly.
4. Days 76 to 90: review and decide. Walk compliance through the record, then widen, change the rules or stop, with the numbers in front of you.

Ship a test with every claim on the screen, so what the customer sees never drifts from the rules behind it.

Questions people ask

Can a community bank issue its own stablecoin?

Yes, through a subsidiary approved by its federal regulator under the GENIUS Act. The regulator has 120 days to decide on a complete application. The detailed rules are still being finalised, so distributing or holding stablecoins is the faster start.

Is a tokenized deposit the same as a stablecoin?

No. The Act excludes deposits from the definition, including deposits recorded on a blockchain. The FDIC’s April 2026 proposal says deposit insurance does not depend on the technology used to record a deposit. Stablecoins cannot be insured.

What is a white-label stablecoin?

A coin that carries the bank’s brand while a permitted issuer issues it and holds the reserve. The bank brings customers and the decision layer. The contract sets who handles redemption, disclosure and compliance.

Is tokenized gold a stablecoin?

Not under the GENIUS Act. A gold token redeems for metal, and the definition needs a fixed amount of money. A bank can still offer it, with the same checkpoint in front of every purchase.

When does the GENIUS Act take effect?

On 18 January 2027 at the latest, or 120 days after the regulators issue final rules if that comes first.

If you need this built, write to m@tawfik.tv, or see how I work as a fractional CPO.

The best public number I know comes from Clutch. Across mobile app projects reviewed on its platform, the most common cost is $10,000 to $49,999, the average is $90,780.11 and the typical timeline is about 11 months (figures on the page as updated on 21 September 2026).

I’m Mo Tawfik Khalifa, chief product officer and forward deployed engineer at Instruxi. I built and shipped Laqtaa, a shared wedding photo app, on my own with AI, and I scope app builds for clients. I don’t publish my own prices here. Every dollar below comes from a cited source.

How much does it cost to build an app?

It depends on three things: how much the app does, how many platforms it runs on, and who builds it at what hourly rate. Clutch’s numbers give the market picture:

• Most common project: $10,000 to $49,999.
• Average project: $90,780.11, spread over about 11 months, which Clutch puts at $8,188.44 a month.
• Hourly rates by company location: $25 to $49 in the United States, Spain and Ukraine, $50 to $99 in Canada and Poland, $100 to $149 in Australia.

For comparison with an in-house hire: the U.S. Bureau of Labor Statistics puts the median software developer wage at $135,980 a year in May 2025, before benefits, laptops and management time.

Build your own estimate below. Pick the app type, platforms, features, who builds it and a rate band. You get a cost range, a timeline and the monthly bill. The weeks are my planning assumptions, shown so you can check the sum. The rates and fees are cited market data.

Open the interactive diagram on tawfik.tv

Where does the money go when you build an app?

Into nine pieces of work.

1. Discovery and design. Who the app is for, the screens, the flows, what is out of scope.
2. The backend. The database, the server logic and the APIs every screen talks to.
3. Login and accounts. Sign-up, password resets, social sign-in, deleting an account, and rules for who can see whose data. Get those rules wrong and one user reads another user’s records. My Supabase security checklist covers the common holes.
4. Payments. Checkout is quick. Refunds, failed cards and webhooks that arrive twice take the time.
5. An admin screen. Someone on your team will need to look up a customer, fix an order or ban a spammer without a developer.
6. QA on real phones. The cheap Android, the old iPhone, a phone call arriving mid-upload, bad signal.
7. Store release. Apple’s developer program costs $99 a year, Google Play charges a $25 one-time registration fee, and both stores review your app before it goes live.
8. Hosting. The servers and database the app runs on, every month.
9. Maintenance. Operating systems update, store rules change and users find bugs. I haven’t found a primary survey that puts a reliable yearly percentage on it, so budget it as monthly hours.

How much does an MVP app cost?

An MVP, a minimum viable product, is the smallest version that proves people want the thing. For most MVPs, that means one platform or a web app, login, one core flow and an admin screen.

On the market numbers above, a focused MVP usually lands in Clutch’s most common band, $10,000 to $49,999. It moves up fast with two native apps, chat, offline mode or anything that touches money. A web app that opens from a link skips the app store fees and review, which is why I start most MVPs in the browser.

Get two or three quotes against the same written scope, or the numbers won’t be comparable. This is the one-page scope I send:

App: one sentence on who it is for and the one job it does
Platforms: web / iPhone / Android (and one codebase or two)
Must have at launch: login, [core flow], admin screen
Not at launch: [list what you are cutting]
Payments: none / one-off / subscriptions / payouts to sellers
Data rules: who can see what, how long you keep it, how users delete it
Testing: which real phones, and who signs off
Release: who owns the Apple and Google developer accounts
After launch: hours per month for fixes and OS updates
Quote as: design / build / hardening and QA / release / monthly running costs

The last line matters most: it shows where each vendor is cheap and what they left out.

How much does it cost to build an app with AI?

Less for the first version, about the same for everything after it.

The evidence goes both ways, and both results match what I see. In a controlled experiment, developers with an AI assistant finished a contained coding task 55.8% faster than developers without one. In a later trial on mature code, 16 experienced developers took 19% longer with AI across 246 real tasks, even though they expected it to make them 24% faster (METR, July 2025).

A new app starts as a contained task, and then it turns into mature code. Laqtaa went exactly that way. I wrote a 780-line brief first. On day one, 6 milestones were built and deployed in 53 minutes. A couple of hours later the next commit read “resolve all critical runtime bugs”. Over 5 weeks that became 188 commits, and 93 of them were fixes against 69 features. About 100 wedding guests used it on the day and nothing broke. The full story is here.

So in the estimate builder, “one builder with AI” halves the build weeks, trims design by a quarter and leaves hardening untouched. That split is my assumption, and it is the same pattern I describe in four AI and fintech builds: a prototype takes days, and identity, permissions, limits and an audit trail are the real work. AI makes a cheap first version possible. It doesn’t make the security review, the payment edge cases or the testing on real phones optional.

How much does an app cost to run each month?

For a typical small app, before heavy usage:

• Database, sign-in and file storage: Supabase Pro from $25 a month, including 100,000 monthly active users and 100 GB of files.
• Hosting: Vercel Pro at $20 a month per developer seat.
• Apple Developer Program: $99 a year if you ship on iPhone.
• Card payments: Stripe charges 2.9% + 30¢ per successful US domestic card payment. Digital goods sold inside an iPhone app pay Apple’s commission instead, 15% under the Small Business Program for developers earning up to $1 million a year.
• Maps: Google’s Maps SDK for phone apps is free, and web maps get 10,000 free loads a month, then $7 per 1,000.
• AI features: billed per use by the model provider. Set a monthly cap before launch.

Laqtaa costs me about $46 a month: $20 for Vercel Pro, $25 for Supabase Pro and about $1 for the domain, and those two plans also carry my other projects.

Should you hire an agency, a freelancer or one developer with AI?

Match the choice to what you can manage yourself.

• Agency. A designer, developers, QA and a project manager in one contract. The highest total in the estimate, because project management and QA hours sit on top, and the fastest on the calendar because people work in parallel. Pick it when nobody on your side can run the project.
• Freelancer. One developer, at the same market rates without the overhead. Slower on the calendar, and you become the project manager, the tester and the person who says no.
• One builder with AI. The cheapest first version and the fastest route to something you can tap. The hardening still takes the same weeks, so ask how they will test, secure and release it before you sign.

Whichever you pick, ask for references from apps that are live in the stores, own your Apple and Google developer accounts yourself, and get the source code in your own repository from day one.

Questions people ask

How much does it cost to build an app?

On Clutch, the most common mobile app project costs $10,000 to $49,999 and the average is $90,780, over about 11 months. More features, more platforms and higher hourly rates push it up.

How much does an MVP app cost?

A focused MVP with login, one core flow and an admin screen usually fits Clutch’s most common band, $10,000 to $49,999. A web app avoids app store fees and review.

Is it cheaper to build an app with AI?

The first version, yes: in one controlled study, developers with AI finished a contained coding task 55.8% faster. Hardening costs about the same, and a study on mature code found experienced developers 19% slower with AI.

What are the monthly costs of running an app?

For a small app, about $45 a month for a database plan and hosting, plus $99 a year for Apple, plus payment and usage fees. Budget developer hours for fixes and OS updates on top.

How do I hire an app developer?

Write a one-page scope, get two or three quotes split into design, build, hardening, release and running costs, check live apps they shipped, and keep the developer accounts and source code in your name.

Can you build my app?

Yes. I scope, build and ship apps with AI in the loop, and I can run the product side too, as a fractional CPO. For booking apps with Apple and Google Wallet loyalty cards, see booking and loyalty. If you need this built, write to m@tawfik.tv.

It is the default way to put 3D on the web. The three package was downloaded 21.4 million times from npm in the week of 6 to 12 October 2026. The current release is r186, published on 24 September 2026, under the MIT licence.

I build 3D for the browser. My GVNR Survivors game is three.js, and my splat window demo renders a Gaussian splat with Spark, a splat renderer for three.js. Here is what you need, code you can copy, how to keep it fast on a phone, and what a build costs.

What is three.js?

three.js describes itself as an “easy-to-use, lightweight, cross-browser, general-purpose 3D library” (README). It does the hard parts for you: the maths of cameras and perspective, the shader code the graphics chip runs, loading 3D files, lights, shadows and materials.

• Two renderers. WebGLRenderer draws with WebGL. WebGPURenderer uses WebGPU and, the docs say, falls back to a WebGL 2 backend where the browser has no WebGPU.
• Small for what it does. I bundled the scene below with esbuild: three.js r186 with the glTF loader and orbit controls comes to about 159 KB gzipped for WebGL, and about 270 KB with WebGPURenderer.
• Examples with source. The official three.js examples page lists more than 600 demos, each with its code: materials, loaders, physics, post-processing, WebXR and WebGPU. There is also a three.js editor that runs in the browser.

What do you need to build a 3D website?

The three.js manual puts it in one line: to display anything you need a scene, a camera and a renderer. For a real site you add two more.

1. A scene. The container. Everything you want drawn gets added to it.
2. A camera. Usually a PerspectiveCamera, set by field of view, aspect ratio and the near and far distances it can see.
3. A renderer. It draws the scene from the camera into a <canvas> on your page, once per screen refresh.
4. Models in glTF. The manual recommends glTF, as .glb or .gltf, because it is built for fast delivery and carries meshes, materials, textures, animations and cameras. Blender exports it.
5. Lights. A MeshStandardMaterial is physically based, so with no light it renders black. A HemisphereLight gives soft light from the sky and cannot cast shadows. A DirectionalLight behaves like the sun and can. A MeshBasicMaterial ignores light altogether.

Build one below. Add or remove each part, change its settings, and watch the preview, the code and a phone budget move together. Remove every light to see the black.

Open the interactive diagram on tawfik.tv

A minimal three.js scene you can copy

This is a complete page: a camera, two lights, a floor and a glTF model you can orbit. It follows the manual’s installation and first-scene guides, with the version pinned, and I checked it against r186. Serve the folder from a local server, not by double-clicking the file.

<!doctype html>
<style> body { margin: 0; } </style>
<script type="importmap">
{ "imports": {
    "three": "https://cdn.jsdelivr.net/npm/three@0.186.1/build/three.module.js",
    "three/addons/": "https://cdn.jsdelivr.net/npm/three@0.186.1/examples/jsm/" } }
</script>
<script type="module">
import * as THREE from 'three';
import { OrbitControls } from 'three/addons/controls/OrbitControls.js';
import { GLTFLoader } from 'three/addons/loaders/GLTFLoader.js';

const scene = new THREE.Scene();
scene.background = new THREE.Color(0xeeeeee);

const camera = new THREE.PerspectiveCamera(50, innerWidth / innerHeight, 0.1, 100);
camera.position.set(2.5, 2, 3.5);

const renderer = new THREE.WebGLRenderer({ antialias: true });
renderer.setPixelRatio(Math.min(devicePixelRatio, 2)); // a 3x phone screen is not worth the cost
renderer.setSize(innerWidth, innerHeight);
document.body.appendChild(renderer.domElement);

scene.add(new THREE.HemisphereLight(0xffffff, 0x8d7c6a, 1.5));
const sun = new THREE.DirectionalLight(0xffffff, 2.5);
sun.position.set(3, 6, 3);
scene.add(sun);

const floor = new THREE.Mesh(new THREE.PlaneGeometry(8, 8), new THREE.MeshStandardMaterial({ color: 0xb9b4ab }));
floor.rotation.x = -Math.PI / 2;
scene.add(floor);

const model = await new GLTFLoader().loadAsync('/models/chair.glb');
scene.add(model.scene);

const controls = new OrbitControls(camera, renderer.domElement);
controls.target.set(0, 0.5, 0);

addEventListener('resize', () => {
  camera.aspect = innerWidth / innerHeight;
  camera.updateProjectionMatrix();
  renderer.setSize(innerWidth, innerHeight);
});

renderer.setAnimationLoop(() => {
  controls.update();
  renderer.render(scene, camera);
});
</script>

For production, the manual recommends installing three from npm and building with a tool such as Vite, so you ship only what you use. Keep every three.js file on the same version: the manual warns that mixing versions can break the app.

How do you keep a three.js site fast on a phone?

Four numbers decide it. You can read the first two from renderer.info while the page runs.

• Draw calls. Every mesh with its own material is at least one draw call, and each call costs processor time before the graphics chip draws a thing. Fifty copies of a chair with two materials is 100 calls. As an InstancedMesh it is 2. Shadows draw every shadow caster a second time.
• Texture memory. A PNG or JPEG is unpacked on the GPU to 4 bytes a pixel, so one 2048 by 2048 texture takes 16 MB, plus a third more for its smaller mipmap copies. JPEG makes the download smaller, not the memory. KTX2 textures stay compressed on the GPU, at about 1 byte a pixel in formats such as ASTC 4x4 and BC7, and three.js’s KTX2Loader picks the format each device supports.
• Pixels. A phone screen of 390 by 844 points at 3x is 2.96 million pixels a frame. Capped at 2x it is 1.32 million, less than half. GVNR Survivors draws at most 1.75 pixels per screen point. My window demo goes further: when 60 frames average slower than 25 ms, it lowers the resolution a step.
• The first download. Compress meshes with Draco and load the first room first. In my virtual stores the meshes were Draco-compressed and the textures KTX2, streamed from a CDN while the customer looked around. GVNR Survivors is about 4 MB with its 3D models.

I go through draw calls, levels of detail, texture formats and memory in more depth, with the three.js names for each fix, in Unity WebGL on mobile. The rules are the same in both engines.

three.js, Unity WebGL or a splat viewer?

• three.js when the page must open fast from a link, especially on phones: stores, product configurators, branded games, a 3D hero on a marketing site. You write JavaScript, and the library is one of the smallest parts of the download.
• Unity for the web when the model is heavy or the same project also ships as an app. It brings an editor, baked lighting and a bigger first download. My route from a 650 MB construction model to a 74 MB browser build is in Unity WebGL on mobile.
• A Gaussian splat viewer when you want a real place or object exactly as the camera saw it, scanned from photos instead of modelled. Spark draws splats inside a three.js scene, so you can mix both. How to capture and publish one is in Gaussian splatting on a website.

There is a fourth route, streaming a game engine from a cloud GPU, for when the visuals cannot be cut down to fit a phone. It costs a GPU per viewer for as long as they stay, which is why I build for the browser first.

What does a three.js website cost?

The library is free. Its MIT licence allows commercial use, as long as you keep the copyright notice. A three.js site is static files on a CDN: each visitor downloads it once, and there is no server rendering frames per viewer.

The build is custom web work. Clutch’s web development pricing guide, updated 21 September 2026, says web development projects on its platform typically cost less than $10,000, puts the average agency project at $66,499.09, and says most agencies charge $25 to $49 an hour. A 3D site sits in the same market with extra work on top: models built or cleaned to a budget, lighting, and testing on real phones.

Four things set the price and the timeline: how many products or rooms are rebuilt in 3D, how real they must look, how many people are in it at once, and whether it runs once live or stays open. Bring the 3D files you already have: a clean CAD or glTF model to start from saves modelling time.

Questions people ask

Is three.js free for commercial use?

Yes. It is MIT licensed, so you can use it in paid and closed-source work. Keep the licence notice with the code.

What is the difference between three.js and WebGL?

WebGL is the browser’s low-level graphics interface. three.js sits on top of it, and on WebGPU, and gives you scenes, cameras, lights, materials and model loaders, so you write far less code than WebGL alone needs.

Do I need React to use three.js?

No. three.js is plain JavaScript and works on any page. If your site is already React, React Three Fiber is a React renderer for three.js, also MIT licensed.

Where can I find three.js examples?

On threejs.org/examples, with source for every demo. To see one on a phone, play GVNR Survivors or open my window demo.

Does three.js work on iPhone and Android?

Yes, in the browser, through WebGL 2, and through WebGPU where the browser supports it. Whether it runs well depends on draw calls, textures and pixel ratio, so test on a real mid-range phone.

If you want a 3D store, configurator, game or product page built in three.js, see 3D web experiences or write to me at m@tawfik.tv.

Most small businesses have not done it yet. The US Census Bureau reported in May 2026 that between 17% and 20% of US businesses used AI from December 2025 to May 2026, and fewer than 20% of firms with four or fewer employees.

I set up an AI help desk for a fintech platform: I bought the agent instead of building one, and wrote the help centre it answers from. I’m chief product officer and forward deployed engineer at Instruxi, where the job is making AI work inside a client’s own systems. This note is for the owner choosing a chatbot for a website. If your real question is a support inbox, read AI customer service agent: what it can safely do instead.

How do you add an AI chatbot to your website?

Pick a route, then do the same four steps whichever you choose.

1. A help desk widget. A live chat vendor sells an AI agent as an add-on to its chat box and inbox. You get the widget, the inbox your team answers handovers in, and a bill per AI conversation.
2. A no-code builder. You upload files or point it at your website, it builds the bot, and you paste one script tag. You pay a monthly plan with a set number of message credits.
3. Custom, on a model API. A developer writes the chat, stores your documents in a database, and calls a model such as Claude through its API. You pay for hosting and the tokens you use, plus the build.

Then, on any route:

1. Collect the documents: your pages, price list, opening hours, payment rules, and what to do in an emergency.
2. Write the instructions: answer only from those documents, say which one it used, and hand over when nothing matches.
3. Test it with the questions customers really ask, including the awkward ones.
4. Paste the script into your site and read the first week of chats.

Try the three routes on a made-up London dental practice. Switch the route, take documents away, turn guessing on, and watch the answers, the sources, the handovers and the monthly bill.

Open the interactive diagram on tawfik.tv

How much does an AI chatbot for a website cost?

From about $45 a month to several hundred, depending on the route and how many people chat. US list prices, checked on each pricing page on 15 October 2026:

• Help desk widget, Tidio. The free plan includes 50 AI conversations with its Lyro agent, once. Lyro starts at $32.50 a month for 50 conversations paid yearly; billed monthly, the page lists $75 for 100, $210 for 300 and $700 for 1,000. The Starter plan for the inbox is $24.17 a month paid yearly. Any conversation with at least one AI reply counts, solved or not. The bigger help desks charge per resolution; I priced them in the customer service agent note.
• No-code builder, Chatbase. Hobby is $40 a month (or $32 paid yearly) for 700 message credits and 10 MB of training content. Standard is $150 a month (or $120 yearly) for 4,000 credits. Extra credits are $40 per 1,000, and removing its branding is $1,188 a year. Its FAQ says most models use 1 credit per reply and premium models 2 to 5.
• Custom, on a model API. Claude Haiku 5.5 costs $0.10 per million input tokens and $0.50 per million output tokens for prompts up to 100,000 tokens; Sonnet 5.5 is $2 and $10. Hosting on Vercel Pro is $20 a month, and a Supabase Pro database is from $25 a month.

A worked example: 300 chats a month, 3 replies each. The widget is $210 plus $24.17 for the inbox. The builder uses 900 credits: Hobby plus one top-up, $80. The custom bot sends about 3,000 tokens in and 250 out per reply: 2.7 million input tokens cost $0.27 and 225,000 output tokens $0.11 on Haiku 5.5, so $45.38 with hosting. On Sonnet 5.5 the tokens come to $7.65.

The custom route is cheapest to run and the only one with a build cost: a developer’s time, and someone to look after it. That trade is what decides most cases. For the cost of the website around it, see how much a small business website costs.

How does a chatbot learn your website’s content?

It does not memorise your site. Every time someone asks a question, it looks up the right passage and reads it. The technical name is retrieval.

1. Split. Your pages and files are cut into short passages: a paragraph of the price list, one row of opening hours.
2. Index. Each passage is stored so it can be found by meaning, as well as by its words. On a custom build that can be Postgres with pgvector.
3. Find. The customer’s question is matched against the index, and the closest three or four passages come back.
4. Answer. Those passages go to the model with your instructions, and it writes a reply from them and names the source.

If the right passage is missing, the model fills the gap with something that sounds right. That is why the documents come first. The instructions for the dental practice fit on one screen:

You are the website assistant for Larkspur Dental, Islington, London.
Answer ONLY from the passages below. Name the document you used.
If no passage answers the question, say so and offer to pass it to reception.
Say you are an AI if anyone asks, and at the start of every chat.
Never:
  - give medical advice, or suggest any medicine or dose
  - quote a price, time or policy that is not in a passage
  - ask for or accept card details
  - book, move or cancel an appointment; link to the booking page
If someone mentions swelling, bleeding, a knocked-out tooth or severe pain:
  tell them to call 020 7946 0321, NHS 111 out of hours,
  and 999 or A&E if swelling affects breathing or vision.

Passages:
{the 3 or 4 passages the search found}

The emergency line follows the NHS’s own advice on urgent dental care, which sends severe swelling that affects breathing or vision to 999 or A&E.

What should a website chatbot never do?

• Guess. In March 2024 The Markup found that New York City’s MyCity chatbot told business owners they could take a cut of their workers’ tips and go cashless, both against city law. Answer only from your documents, and hand over when nothing matches.
• Advise on health, money or law beyond what your documents say. Send people to a person or the right service.
• Promise what it cannot do: a price, a refund, a slot it has not checked.
• Take card details in chat. Send people to your payment page or reception.
• Pretend to be a person. The rules and the handover are in the customer service agent note.
• Go quiet. On a credit plan, a bot that runs out shows a message that it is unavailable. Set a top-up or an alert.

How do you know if the chatbot is working?

Read chats, not the dashboard. Every week:

1. Share answered with a source. Every unsourced answer is a possible wrong one.
2. Handovers, by reason. Each repeat reason is a missing page or a missing rule.
3. Wrong answers, from 20 chats read in full. The target is zero.
4. What chats led to: booking clicks, enquiries, calls.
5. Cost per useful chat: the monthly bill divided by chats that answered the question or started a booking.

A chatbot answers. An AI agent takes actions, which needs a different set of controls, covered in what agentic AI is.

Which route should you pick?

• Help desk widget if people already answer chats and you want one inbox for the bot and the team.
• No-code builder if you want it live this week, your documents are in good shape, and volume is modest.
• Custom if the bot needs to read your own systems, such as free appointment times, if volume is high, or if you want the data and the instructions in your own hands.

Questions people ask

Can I add ChatGPT to my website?

Not the ChatGPT app itself. The builders and the custom route use the same kind of model through an API, answering from your documents instead of the open web.

Is there a free AI chatbot for a website?

Tidio’s free plan includes 50 AI conversations, once. That is enough to test with your own questions before you pay.

Do I need a developer?

Not for a help desk widget or a builder: both give you a script to paste. You need one for the custom route, and for anything that reads your booking system or customer records.

How long does it take to set up?

The writing takes longest: the price list, hours and rules in plain words. With those ready, a widget or builder can be live the same day. A custom build takes days, with time to test it on real questions.

If you want an AI chatbot or help desk built and set up properly, write to me at m@tawfik.tv.

Then reshape Firestore documents into tables, copy Storage, switch on row level security before anyone can reach the API, and cut over with either a short write freeze or a dual-write window.

People are making this move toward a database they like. In the Stack Overflow 2025 Developer Survey (July 2025), 47.2% of developers who used Supabase wanted to keep using it, against 40.1% for Cloud Firestore. PostgreSQL, which Supabase is built on, topped the list at 65.5%.

I have moved apps onto Supabase and fixed database security on live ones. This is the order I use, with the commands, checked against Supabase’s migration guides and its firebase-to-supabase tools.

What should you inventory before you migrate?

Write down everything the app touches in Firebase before you write any SQL. The list decides your plan.

• Users by sign-in method: email and password, Google, Apple, phone.
• Custom claims such as admin or role.
• Collections and subcollections. The Supabase script lists only top-level collections, so walk the subcollections yourself.
• Storage buckets and the folder pattern, usually users/{uid}/....
• Security rules, because every rule becomes a Postgres policy.
• Cloud Functions, triggers and onSnapshot listeners. Push messaging can stay on Firebase Cloud Messaging.

git clone https://github.com/supabase-community/firebase-to-supabase.git
cd firebase-to-supabase/firestore
# add firebase-service.json (Firebase console > Project settings > Service accounts)
node collections.js

Set your app’s shape below to get the plan in order, with what goes wrong at each step.

Open the interactive diagram on tawfik.tv

How do you turn Firestore documents into Postgres tables?

Design the tables first, as a migration, then load data into them. Firestore rewards copying data into every document that shows it. Postgres rewards storing each fact once and joining.

1. One table per collection. Keep the document ID in a firestore_id text unique column so every row traces back.
2. Subcollections become child tables with a foreign key to the parent.
3. Arrays of objects become child tables. Arrays of plain values can stay as text[].
4. Maps you filter on become columns. Maps you only display can stay jsonb.
5. Denormalised copies, such as the author’s name on every post, get dropped and replaced by a join.
6. Firebase user IDs are free-form strings and Supabase user IDs are UUIDs, so keep firebase_uid on the profile and remap every reference through it.

supabase link --project-ref your-project-ref
supabase migration new firebase_schema

-- supabase/migrations/<timestamp>_firebase_schema.sql
create table public.profiles (
  id uuid primary key references auth.users on delete cascade,
  firebase_uid text unique not null,
  display_name text
);
create table public.orders (
  id bigint generated always as identity primary key,
  firestore_id text unique not null,
  user_id uuid not null references public.profiles (id),
  status text not null,
  total_pence integer not null,
  created_at timestamptz not null
);
create table public.order_items (  -- was the items array inside each order
  order_id bigint not null references public.orders (id) on delete cascade,
  sku text not null,
  qty integer not null check (qty > 0)
);
create index on public.orders (user_id);

-- RLS goes in the same migration as the tables, never later
alter table public.profiles enable row level security;
alter table public.orders enable row level security;
alter table public.order_items enable row level security;
revoke all on public.profiles, public.orders, public.order_items from anon, authenticated;
grant select on public.profiles, public.orders, public.order_items to authenticated;
create policy "own profile" on public.profiles for select to authenticated
  using ((select auth.uid()) = id);
create policy "own orders" on public.orders for select to authenticated
  using ((select auth.uid()) = user_id);
create policy "own items" on public.order_items for select to authenticated
  using (exists (select 1 from public.orders o
                 where o.id = order_id and o.user_id = (select auth.uid())));

supabase db push --dry-run
supabase db push

How do you migrate Firebase Auth users without resetting passwords?

1. In the Firebase console, open Authentication, then Users, then the three-dot menu, then Password hash parameters. Copy base64_signer_key, base64_salt_separator, rounds and mem_cost. Treat them like a password.
2. Export the users with the Firebase CLI. Its auth:export writes each user’s passwordHash and salt in standard base64, plus customAttributes, which holds custom claims. Users Firebase imported from elsewhere with another hash come out with an empty hash and will need a reset.
3. Create each user through the admin API with a password_hash in Supabase’s Firebase format. The supabase-js types say password_hash supports bcrypt, Firebase scrypt and argon2.

firebase auth:export users.json --format=json --project your-firebase-project
npm i @supabase/supabase-js

// import-users.mjs   run: node import-users.mjs users.json
import { readFileSync } from 'node:fs';
import { createClient } from '@supabase/supabase-js';

const e = process.env; // SUPABASE_URL, SUPABASE_SECRET_KEY, FB_SIGNER_KEY, FB_SALT_SEPARATOR, FB_ROUNDS, FB_MEM_COST
const sb = createClient(e.SUPABASE_URL, e.SUPABASE_SECRET_KEY, { auth: { persistSession: false } });
const { users } = JSON.parse(readFileSync(process.argv[2], 'utf8'));

for (const u of users) {
  const hash = u.passwordHash &&
    `$fbscrypt$v=1,n=${e.FB_MEM_COST},r=${e.FB_ROUNDS},p=1,ss=${e.FB_SALT_SEPARATOR},sk=${e.FB_SIGNER_KEY}$${u.salt}$${u.passwordHash}`;
  const { error } = await sb.auth.admin.createUser({
    email: u.email,
    phone: u.phoneNumber,
    email_confirm: !!u.emailVerified,
    phone_confirm: !!u.phoneNumber,
    ...(hash && { password_hash: hash }),
    app_metadata: { firebase_uid: u.localId, ...JSON.parse(u.customAttributes || '{}') },
    user_metadata: { name: u.displayName, avatar_url: u.photoUrl },
  });
  if (error) console.error(u.localId, error.message);
}

Four things catch people here.

• Custom claims go in app_metadata. Users cannot edit it, so policies can trust it through auth.jwt() -> 'app_metadata'. Supabase’s RLS guide warns that user_metadata can be changed by the signed-in user.
• Google and Apple users need no password. Supabase links identities automatically when the email matches, so their next Google or Apple sign-in lands on the imported account. Set up those providers in Supabase first.
• The older community import script is not the one to use. import_users.js writes an empty password and copies the whole Firebase record, hash and salt included, into raw_user_meta_data. Users would need a password reset or a separate checking server.
• Then fill the profiles table from auth.users, so every Firebase ID has a Supabase ID to map to.

insert into public.profiles (id, firebase_uid, display_name)
select id, raw_app_meta_data ->> 'firebase_uid', raw_user_meta_data ->> 'name'
from auth.users;

How do you move the Firestore data itself?

Export each collection to JSON, load it raw into a holding table, then reshape it with SQL. Two warnings from reading the export script. It pages with offset, and Firestore charges a read for every skipped document, so the bill grows with the square of a large collection. And it writes timestamps as {"_seconds": ..., "_nanoseconds": ...} objects. For anything big, export with a cursor and convert as you go.

// export.mjs   run: node export.mjs orders   (writes orders_raw.json)
import { readFileSync, createWriteStream } from 'node:fs';
import { initializeApp, cert } from 'firebase-admin/app';
import { getFirestore, FieldPath, Timestamp, DocumentReference } from 'firebase-admin/firestore';

initializeApp({ credential: cert(JSON.parse(readFileSync('firebase-service.json', 'utf8'))) });
const plain = v => v instanceof Timestamp ? v.toDate().toISOString()
  : v instanceof DocumentReference ? v.path
  : Array.isArray(v) ? v.map(plain)
  : v && v.constructor === Object ? Object.fromEntries(Object.entries(v).map(([k, x]) => [k, plain(x)]))
  : v;
const name = process.argv[2], out = createWriteStream(`${name}_raw.json`);
let last, n = 0;
out.write('[');
for (;;) {
  let q = getFirestore().collection(name).orderBy(FieldPath.documentId()).limit(1000);
  if (last) q = q.startAfter(last);
  const snap = await q.get();
  if (snap.empty) break;
  for (const d of snap.docs) out.write((n++ ? ',\n' : '\n') + JSON.stringify({ firestore_id: d.id, ...plain(d.data()) }));
  last = snap.docs.at(-1);
}
out.end('\n]\n');
console.log(n, 'documents');

Load it with the Supabase tool, which creates a table named after the file in public with RLS off. Move it out of the API’s reach straight away, reshape, then compare counts.

node json2supabase.js ./orders_raw.json

create schema if not exists staging;
alter table public.orders_raw set schema staging;

insert into public.orders (firestore_id, user_id, status, total_pence, created_at)
select r.firestore_id, p.id, r.status, round(r.total * 100), r.created_at::timestamptz
from staging.orders_raw r
join public.profiles p on p.firebase_uid = r.uid;

insert into public.order_items (order_id, sku, qty)
select o.id, i ->> 'sku', (i ->> 'qty')::int
from staging.orders_raw r
join public.orders o using (firestore_id)
cross join jsonb_array_elements(r.items) i;

select (select count(*) from staging.orders_raw) as firestore,
       (select count(*) from public.orders) as postgres;

If the two counts differ, the join dropped rows, usually orders whose user no longer exists. Find them before cutover, not after. The functions used are in the Postgres JSON docs.

How do you move Firebase Storage?

node download.js "" downloads pulls the bucket to disk and node upload.js "" downloads avatars pushes it to a Supabase bucket, which the tool creates as private. Two follow-ups: rewrite any firebasestorage.googleapis.com links saved inside your documents, and write storage policies. If your paths look like users/{uid}/... with the Firebase user ID, match the folder against the ID you imported.

create policy "read own files" on storage.objects for select to authenticated
using (bucket_id = 'avatars'
  and (storage.foldername(name))[2] = (select auth.jwt() -> 'app_metadata' ->> 'firebase_uid'));

Why must row level security be on before go-live?

Firebase blocks a client that has no matching rule. Supabase works the other way round. Its RLS guide says a table in an exposed schema without RLS is readable and writable by any role with a grant on it, and the publishable key shipped in your app makes requests as the anon role, which on many projects still holds those grants. In March 2025 a researcher scanned 1,645 apps featured by the Lovable app builder and found 170 of them exposing data through insufficient RLS (his write-up, filed as CVE-2025-48757). Write a policy test with supabase test db, and run the Supabase security checklist before the switch.

If you used onSnapshot, add each table to the supabase_realtime publication. Supabase’s Realtime docs say RLS is not applied to delete events, and suggest Broadcast past about 3,000 subscribers on the same changes.

Freeze-and-cut or dual-write?

Freeze-and-cut suits most apps that can take an hour of maintenance. Announce it, make Firestore read-only with rules (allow write: if false;), pause Cloud Functions too because the Admin SDK ignores rules, export the final state, import, check counts, ship the app config that points at Supabase, reopen.

Dual-write is for apps that cannot stop, and for mobile apps where old versions keep talking to Firebase for weeks. New code writes to both, a backfill copies history, a nightly job compares counts, reads switch once the numbers match, and Firebase writes stop last. It costs more code and every write path has to be found.

Rollback. Keep the Firebase project untouched and read-only for at least a month. Keep the previous app build ready to point back. Anyone who signs up or changes their password after cutover exists only in Supabase, so export them before you roll back.

How do you fix a broken Supabase migration history?

It breaks when someone changes the schema in the dashboard, renames a migration file, or a push fails halfway. supabase db push then stops with “Remote migration versions not found in local migrations directory.” The CLI reference fix: compare, mark, pull.

supabase migration list                       # LOCAL vs REMOTE, by timestamp

# remote has a version you don't have locally: drop it from the history
supabase migration repair 20260101120000 --status reverted
supabase db pull                              # capture the real schema as a new file

# you ran a local file by hand: record it as applied without running it again
supabase migration repair 20260102090000 --status applied

supabase db push --dry-run

repair only edits the history table, supabase_migrations.schema_migrations. It never changes your schema, which is why it is safe and why it is not a fix on its own.

Questions people ask

Can I migrate Firebase Auth to Supabase without password resets?

Yes. Export users with firebase auth:export, then create them with auth.admin.createUser and a password_hash in the $fbscrypt$ format built from your project’s hash parameters.

How long does a Firebase to Supabase migration take?

It depends on the number of collections and write paths more than on the number of users. A full rehearsal on a staging project tells you the real cutover time.

Do I keep my Firebase user IDs?

Not as the primary key, because Supabase user IDs are UUIDs. Keep the old ID in app_metadata and on the profiles table, and remap references through it.

What is supabase migration repair for?

Fixing the migration history table when it no longer matches your migration files. It marks versions applied or reverted without running any SQL.

Do I need a database migration consultant or database migration services?

For a small app, this page is enough. For live payments, many write paths, or a mobile app that cannot stop, an outside review of the cutover and the policies is cheap insurance. More on how I work as a forward deployed engineer, and on keeping AI agents away from your production database.

If you need a migration like this planned or done, write to me at m@tawfik.tv.

Days per week set most of the bill, and somewhere between two and four days a week a full-time hire becomes the cheaper option.

Those ranges come from a fractional executive marketplace’s April 2026 rate guide. The open contract market can sit lower: UK contract CTO roles advertised in the six months to 15 October 2026 had a median day rate of £635, down from £900 a year earlier, from a small sample of 13 quoted rates (IT Jobs Watch).

I’m Mo Tawfik Khalifa, chief product officer and forward deployed engineer at Instruxi. I have been a CTO, and I take fractional work. Everything below is published market data, not my rates.

Fractional CTO vs fractional CPO vs head of product: what is the difference?

• Fractional CTO. Owns how the product is built and run: the architecture, the stack, security basics, delivery and the first engineering hires.
• Fractional CPO. Owns what gets built and why: the one number the product has to move, the roadmap and its no list, and how the product team ships.
• Fractional head of product. Runs the backlog and discovery day to day: specs, customer interviews and priorities with engineering, usually reporting to a founder.

Early teams often need parts of the first two at once. I cover the CPO work fully and the CTO parts an early team needs: more on my fractional CPO page.

How much does a fractional CTO cost in the UK, US and Gulf?

United Kingdom

• Senior fractional executives: £1,200 to £3,000 a day (Fractionus, April 2026).
• Fractional CTO retainers: £6,000 to £16,000 a month (same guide).
• Contract CTO roles: median £635 a day, six months to 15 October 2026 (IT Jobs Watch).
• Contract head of product management roles: median £1,038 a day, from only 4 quoted rates (IT Jobs Watch).

United States

• Senior fractional executives: $1,500 to $4,000 a day (Fractionus, April 2026).
• Fractional CTO retainers: $9,000 to $22,000 a month (same guide).
• Average day rate on one marketplace’s bench, as of 15 October 2026: $1,615 for a fractional CTO across 79 rates (CTO rate index) and $1,576 for a fractional CPO across 60 rates (CPO rate index).

The Gulf

• I found no published day-rate benchmark for fractional CTOs or CPOs in the Gulf that I could verify.
• A UAE fractional firm told Consultancy-me in July 2026 that fractional leadership typically costs 30% to 60% less than the full-time equivalent. That is a seller’s estimate, not market data.
• For the full-time side: a CTO in the UAE averages AED 426,758 a year in base salary, from 48 salary profiles updated January 2026 (Payscale).

A warning on comparing guides: a “CPO” retainer in some rate tables is a chief people officer, the HR role. Check which one a number is for before you use it.

Draft it: what does your engagement cost?

Pick the role, the days a week, the region and the term. The statement of work below fills in the scope, the fees from the published rates above, the cost of the same person full time, and where the two cross.

Open the interactive diagram on tawfik.tv

What do fractional CTO services include at one, two, three or four days a week?

Most fractional engagements run one to three days a week, which a marketplace counts as roughly four to twelve days a month (Fractionus). Here is what each step buys, from how I run my own engagements.

1. One day a week: direction. A weekly review, the decisions written down with the reason, the roadmap or technical plan on one page, and help with the key hire. Someone else runs the work day to day.
2. Two days a week: ownership. The roadmap or the release process becomes theirs. Add customer discovery for a CPO, or environments, CI and an incident routine for a CTO, and a prototype of the first slice.
3. Three days a week: hands on. Building the hardest part with the team, running planning, and managing the first hires until a full-time lead arrives.
4. Four days a week: price a full-time hire too. At this load you are paying for most of a job. The break-even below usually says so.

When is a full-time hire cheaper than a fractional one?

Work out the full cost of the full-time hire, then divide it by what the fractional lead charges for the same days.

break-even days a week = full-time cost a year ÷ (day rate × 48)

UK CTO: £100,000 salary + £14,250 employer NI + £1,321 pension = £115,571
        £115,571 ÷ (£1,200 × 48) = 2.0 days a week

US CTO: $175,140 salary ÷ 0.70 (benefits are 30% of employer cost) = $250,200
        $250,200 ÷ ($1,500 × 48) = 3.5 days a week
        $250,200 ÷ ($4,000 × 48) = 1.3 days a week

The 48 is one day a week at about four days a month for 12 months. The inputs:

• UK salary: the median advertised CTO salary was £100,000 in the six months to 15 October 2026, from 58 salaries (IT Jobs Watch). For product leaders, product director roles had a median of £130,000 from 31 salaries (IT Jobs Watch).
• UK employer costs: National Insurance at 15% above £5,000 a year for 2026 to 2027 (GOV.UK), and a pension of at least 3% on earnings from £6,240 to £50,270 (GOV.UK).
• US salary: the median for computer and information systems managers, a group that includes CTOs, was $175,140 in May 2025 (BLS). Heads of product had a median advertised salary of $250,000 across 178 job postings in June 2026 (Recruiting from Scratch).
• US employer costs: benefits were 30.0% of private-industry employer compensation costs in June 2026 (BLS).
• UAE employer costs: end-of-service gratuity of 21 days’ basic pay for each of the first five years of service, under Federal Decree-Law No. 33 of 2021 (Morgan Lewis).

This leaves out recruiter fees, equity and the months a search takes, which favour fractional, and what a full-time person learns by being there every day, which favours full time.

Do fractional CTOs and CPOs take equity?

Some do, usually a small grant alongside a lower cash fee. I found no reliable published benchmark for the size, so I give no number. If you offer equity, make it a separate grant that vests over the engagement.

How long does a fractional engagement last?

Fractional work is part time and ongoing, over months. An interim CPO is different: full time and temporary, usually covering an empty seat for four to sixteen months (Fractionus).

Mine follow one shape: a one-page brief in week one, a working prototype on real data in month one, hardening and shipping in months two and three, then month to month until a date we set at the start, with a handover.

How do you evaluate a fractional CTO or CPO?

1. Ask for something they shipped that you can open. A live product, a demo you can press, a repo. I keep mine on what a forward deployed engineer does.
2. Ask who writes the code. Some only advise. If you need a first version built, check they build.
3. Ask for the week-one output. A good one can tell you what you will hold after five days: a one-page brief, the one number, what to cut.
4. Ask how it ends. The answer should name a handover and the hire who takes over.
5. Call two founders they worked for. Ask what changed, and what broke after they left.
6. Start with a short, fixed scope. A few weeks with a clear output tells you more than any interview.

What are the red flags?

• A day rate with no scope behind it.
• A long minimum term before you have seen any work.
• Asking for production admin keys in week one. Access should grow with trust, and AI tools need the same limits as people: your AI coding agent can delete your database.
• No written handover plan.
• Four or five days a week, sold as fractional. That is a full-time job at contractor rates.

Questions people ask

How much does a fractional CTO cost per month?

In April 2026 market data, fractional CTO retainers ran about £6,000 to £16,000 a month in the UK and $9,000 to $22,000 a month in the US. Days per week drive most of the difference.

What does a fractional head of product cost?

UK contract head of product management roles had a median of £1,038 a day in the six months to 15 October 2026, from a small sample of 4 rates. I found no reliable US figure.

Fractional CTO vs full time: which is cheaper?

Fractional is usually cheaper at one or two days a week. In the UK, at £1,200 a day, a full-time CTO at the median salary becomes cheaper from about two days a week. At US rates of $1,500 to $4,000 a day, the crossover sits between about 1.3 and 3.5 days.

Can one person be your fractional CTO and CPO?

For an early team, often yes: one person sets what to build and how, and builds the first version. For a large engineering organisation, hire a full-time CTO. I wrote about how far one person with AI can go in can one person with AI do a whole team’s work.

If you need a product led and built part time, write to m@tawfik.tv or start at the fractional CPO page.

The UK is now running this at scale. Ofcom’s report to Parliament, published 16 July 2026, counted over 69 million age checks between July and December 2025 across the 32 services it analysed, a 23-fold jump on the six months before. Facial age estimation was the method most offered, then photo ID matching.

Most of those checks still move far more than one fact. I’ve built identity products three times around one rule: prove the fact, not the person. The long version, with the three builds, is in How to prove who someone is without seeing who they are. This is the short one for age.

How does age verification work in the UK?

The Online Safety Act makes two groups of services check age.

1. Sites that publish porn themselves. Their duty to use age checks came into force on 17 January 2025.
2. Sites and apps where users share content that children are likely to use. Since July 2025, if they allow porn or content about suicide, self-harm or eating disorders, they must keep children away from it. Ofcom says most of the services it studied switched age checks on around 25 July 2025.

The check has to be “highly effective”. Ofcom judges that on four things: technical accuracy, robustness, reliability and fairness. Ticking a box that says “I’m 18” does not count. Services that get it wrong can be fined up to £18 million or 10% of their qualifying worldwide revenue, whichever is greater.

What age verification methods does Ofcom accept?

Ofcom lists seven methods it considers capable of being highly effective. The list is not closed, and each one still has to be done well. Here they are, with what leaves your phone.

1. Open banking. You log in to your bank and agree to share details with an age checking company, which tells the site yes or no.
2. Photo ID matching. You upload a passport or driving licence and a selfie. The whole ID page goes.
3. Facial age estimation. Software guesses your age from a selfie. Your face goes, unless the guess runs on your phone.
4. Mobile network checks. Your mobile network says whether your account belongs to an adult. The site gets a yes or no.
5. Credit card checks. Only adults can get a UK credit card, so a valid one is the signal.
6. Email-based age estimation. Software looks at where your email address has been used before, such as with banks, and estimates your age from that.
7. Digital identity services. A wallet or app that already checked you sends the answer. This is where selective disclosure and zero-knowledge proofs live.

Privacy is part of the job too. Ofcom’s report says services must follow UK data protection law, and found many delete the data straight away. Others keep it for a while: one third-party face check kept face images and ID documents for up to an hour. Two social media services ran the face check on the phone, so only a pass or fail left it.

What does each method give away?

The answer changes with the question: a face can say “probably over 18”, never where you live. You are the website.

Open the interactive diagram on tawfik.tv

The pattern matches my longer piece. A photo of your ID sends everything printed on it, and anything stored can leak: Discord said about 70,000 users may have had government ID photos exposed through a customer service vendor that used them to review age appeals. A signed credential sends one line. A zero-knowledge proof sends a proof that the line is true, and nothing else.

How does a zero-knowledge proof prove your age?

Picture a busy page with one character hidden on it. You lay a big sheet of card over the page with one small hole, right on the character. Your friend sees you found it and learns nothing about where it is on the page. That’s a zero-knowledge proof. Software does it with maths instead of card.

For age, it runs in four steps.

1. Checked once. A trusted issuer, like a government, a bank or a phone wallet provider, checks your ID one time and gives your phone a signed card.
2. The site asks one question. Over 18?
3. Your phone makes a proof. It says: “I hold a card signed by a real issuer, and it says I’m over 18.” The card itself never leaves the phone.
4. The site checks the maths. It gets yes or no. It never sees your name, birth date or card, and each proof looks new, so two sites can’t match you by it.

Google open-sourced its zero-knowledge libraries for age checks in July 2025, with the example of proving you’re over 18 “without sharing anything else at all”.

What a proof does not hide: your internet address, your device, and a site that asks for more than it needs. The EFF makes that point well.

What is selective disclosure, and how is it different?

Selective disclosure is the step before zero-knowledge. The issuer seals each line of your credential in its own envelope, mixes in a random value so nobody can guess what’s inside, and signs the list of sealed envelopes. You open only the line you need, say “over 18”, and the site checks it matches the signed list.

• SD-JWT, the internet standard RFC 9901, published November 2025, works this way.
• Mobile driving licences under ISO/IEC 18013-5 use the same salted-hash trick, so a holder can show proof of age without the rest of the licence.
• W3C Verifiable Credentials 2.0, a W3C Recommendation since May 2025, names the roles: issuer, holder, verifier.

The catch: show the same signed card to two sites and they can link you, because the signature is identical. RFC 9901 says so in section 10.1 and gives the fix: the issuer hands out a batch of fresh copies, one per site. Flip that switch in the demo above to see it.

What is the EU doing about age verification?

The EU went straight for this design. Its age verification blueprint came out in July 2025 as open-source tools. The second version, in October 2025, added passports and ID cards as a way to get a proof of age, and included zero-knowledge proofs. Denmark, France, Greece, Italy and Spain are building national apps on it, and the Commission says the proof of age carries no ID details that trace back to you.

It’s built to work with the EU Digital Identity Wallets that member states must offer their citizens by the end of 2026.

How much does age verification cost?

For most services, a few pence a check. Ofcom’s July 2026 report worked out what the services it studied paid on average per check: a median of around £0.06, most at or below £0.10, and none above £0.30, the top of the £0.05 to £0.30 range Ofcom had estimated in April 2025.

The other costs, from the same report:

• Set-up. Where services reported it, mostly tens of thousands of pounds, for IT integration, engineering, testing and user support. A few reported none, because they already had a vendor or had rolled checks out in other countries.
• Digital ID. Twelve of the services offered digital ID checks, and generally reported them as free to the service. Two reported minimal costs.
• Lost visitors. Traffic to porn services fell sharply once checks went live, and Ofcom counts the lost revenue as a cost.
• Checking the same person twice. A service that can’t recognise returning users may need to check them again, which makes the price per check matter more.

Ofcom adds that the average price per check often falls as volume grows, because vendors sell on fixed fees, subscriptions and volume tiers.

What do age and KYC verification providers charge?

A few publish their prices. These are list prices from their own pages, checked on 15 October 2026, before volume discounts.

1. Didit: age estimation from a selfie, with a liveness check, is $0.10 a check. A full ID check (document, liveness, face match) is $0.33, and the first 500 every month are free. No monthly minimum.
2. Veriff: Essential is $0.80 a verification with a $49 monthly minimum. Plus is $1.39 with a $99 minimum, and Premium $1.89 with a $209 minimum; both add specialist review.
3. Sumsub: Basic is $1.35 a verification with a $149 monthly minimum. Compliance, which adds AML screening, is $1.85 with a $299 minimum.
4. Stripe Identity: $1.50 for an ID document and selfie check, charged when the user completes it.
5. Ondato: identity verification from €1.40 down to €0.50 a check, depending on volume.

Yoti does not publish prices on its age verification page; you ask its sales team.

Most of these are full identity checks, built for KYC: they confirm who someone is. An age gate needs one fact, so running full KYC on every visitor buys more data than you need, at a higher price. Watch the minimums too: at 30 checks a month, a $149 minimum works out at about $4.97 a check.

Open the interactive diagram on tawfik.tv

Which KYC or age verification software is best?

The one that answers your question with the least data, at your volume. Five things I check before picking one.

1. Do you need to know who, or only how old? If the question is over 18, a face estimate or a digital ID answer is enough. The worked example in Ofcom and the ICO’s joint statement of 25 March 2026 collects only the information strictly necessary to confirm a user’s age or age range. Full KYC is for when you must know the person, such as when money moves.
2. What does it cost at your volume? Price per check, plus the monthly minimum, minus any free allowance. Run your own numbers in the bill above.
3. Can people come back without another check? Keep the yes on their account, as in prove the fact, not the person, or accept a reusable digital ID.
4. What does the vendor keep, and for how long? The same statement’s example tells users what is collected and how long it is stored. Get both in writing before you sign.
5. Can a wrongly blocked adult appeal? The example also gives users a prominent way to challenge a wrong age decision.

If you keep that yes in your own database, lock the table down. My Supabase security checklist is how I check access rules on tables like that.

What I’d build if your site needs age checks

I led a credential product where nurses and doctors prove their licence to employers. The licence is checked once at the source and sealed to the professional’s own key, and they tick which fields each employer gets. Unticked fields are removed before anything leaves the phone. The gap I’d close next time: the issuer signed the whole licence, so a partial share couldn’t be checked line by line. SD-JWT fixes that, so I’d start there.

At PLAYERUNKNOWN Productions I designed a zero-knowledge ID for players: the game learns a player is real, and a tag catches a second account, without learning who they are.

For age checks, the same rules carry over.

1. Ask for one fact. Over 18, not a birth date.
2. Don’t hold what you don’t need. Keep the yes, delete the rest.
3. Never call the issuer at check time. Check the signature against a published key, so the issuer never learns where you went.
4. Give fresh copies, or use proofs, so sites can’t link people.
5. Say what still shows. Internet address, device, account.

Questions people ask

Is zero-knowledge age verification allowed under the Online Safety Act?

Ofcom’s guidance is technology-neutral and lists digital identity services among the methods capable of being highly effective. A zero-knowledge proof is one way a digital identity service can deliver the answer. It still has to meet Ofcom’s four criteria: accuracy, robustness, reliability and fairness.

Do age checks keep my ID or my face?

Some do, for a while, as Ofcom found above. Before you upload, ask who keeps the photo, for how long, and which vendors see it.

What’s the difference between age verification and age estimation?

Verification checks a record: your ID, your bank, your mobile account. Estimation makes a guess, from your face or your email history. A guess is surest far from the age line. Every porn service Ofcom studied offered more than one method, three on average.

Can a website track me if I use a zero-knowledge proof?

Not through the proof, since each one looks new. It can still see your internet address, your device and your account.

Can I prove my age once and reuse it?

Yes, with a digital identity wallet, and Ofcom’s report notes reuse may cut costs. To keep it private, the wallet needs fresh copies per site or zero-knowledge proofs.

How much does an age check cost per user?

Ofcom found the services it studied paid a median of around £0.06 a check, most at or below £0.10. Public list prices run from $0.10 for a selfie age estimate to $1.50 for an ID and selfie check, and monthly minimums raise the cost per check at low volume.

Do you build an age verification service?

Yes. I design and build identity and credential products end to end, as a fractional CPO or hands on. If you need privacy-preserving age checks built, write to m@tawfik.tv.

That is the route I took with SEVEN Al Hamra: a 650 MB construction model that became a 74 MB browser build drawing about 700,000 triangles at 60 fps on a laptop graphics chip. You can walk through it now.

For scale: the median mobile home page in July 2025 weighed 2.6 MB, according to the HTTP Archive Web Almanac 2025. My finished build is still about 28 times that, so every megabyte you cut is one a visitor on mobile data does not wait for.

Why are Unity WebGL builds so big and slow on phones?

Four things stack up against you in a phone browser.

• One big download. Unity packs every scene and asset into a .data file. The browser unpacks it into memory and keeps the uncompressed data there while the content runs (Unity: memory in Unity Web). Phones have the least memory to spare.
• A heap that has to grow in one piece. Unity’s heap is one contiguous block. If the browser cannot find a big enough block when it grows, the app crashes, so Unity’s advice is to keep the heap as small as possible.
• Slow draw calls. Sending work to WebGL costs more CPU time than native OpenGL, so Unity recommends avoiding large numbers of draw calls per frame and using batching and instancing (Unity: Web performance).
• The wrong texture format. If a phone does not support the format you built with, Unity decompresses the textures in software at runtime. It still works, with more memory and a slower frame (Unity: texture compression in Web).

Construction models make all four worse. They hold everything the builders need, including what sits inside ceilings, walls and floors, at a level of detail no browser needs.

Try it: the six fixes on the Al Hamra build

The build report below starts at the 650 MB source model. Tick each fix and watch the download and the frame time move. The start and the end are real; the steps between are illustrative.

Open the interactive diagram on tawfik.tv

How do I make a Unity WebGL build smaller and faster?

This is the order I work in. Each step makes the next one cheaper.

1. Leave out what nobody sees. Sort every object by discipline and drop what is hidden. On Al Hamra the web version leaves out 758 objects: cable trays, ducts, plumbing, sprinkler pipes, plant units and emergency lights.

2. Decimate the heavy meshes. Merge parts, delete hidden faces and reduce triangles where nobody will notice, in Blender or your modelling tool. The decorative canopy on Al Hamra was about 43 million triangles in the source. The whole building in the browser today draws about 700,000 at once.

3. Add levels of detail. A LOD Group swaps a lighter mesh in as the camera moves away, so distant objects cost less.

4. Compress textures for the device. Unity’s Web build settings offer DXT, which suits desktop browsers, and ASTC and ETC2, which suit phones (Unity: Web build settings). Unity suggests making two builds, DXT for desktop and ASTC for mobile, and loading the right one. For mobile it suggests ASTC 8x8 blocks as a balance of quality and download size (Unity: optimise for mobile).

5. Bake the light. Baked lighting works out light and shadow once, ahead of time, and saves it into lightmaps, so the phone does not have to. The lightmaps add to the download; the frame gets much cheaper. Al Hamra has two baked sets, day and night, a switch between them, and reflection probes for glass and polished floors.

6. Batch the draw calls. In the Universal Render Pipeline, keep the SRP Batcher on, share materials, and use GPU instancing for repeated objects. The live Al Hamra build runs with the SRP Batcher.

7. Strip the code. Unity’s recommended Player settings for Web include Managed Stripping Level set to High, IL2CPP code generation optimised for size, and Brotli (Unity: recommended Player settings). For mobile, Unity also recommends turning off Development Build and setting Code Optimization to Disk Size with LTO. Remove packages you do not use, too: Unity names the Input System package as one that can significantly increase build size if left in (Unity: remove unused resources).

// Assets/Editor/WebRelease.cs: Unity's recommended release settings for Web
using UnityEditor;
using UnityEditor.Build;

public static class WebRelease {
  [MenuItem("Build/Apply Web release settings")]
  static void Apply() {
    PlayerSettings.WebGL.compressionFormat = WebGLCompressionFormat.Brotli;
    PlayerSettings.WebGL.dataCaching = true;
    PlayerSettings.SetManagedStrippingLevel(NamedBuildTarget.WebGL, ManagedStrippingLevel.High);
    PlayerSettings.SetIl2CppCodeGeneration(NamedBuildTarget.WebGL, Il2CppCodeGeneration.OptimizeSize);
    UnityEditor.WebGL.UserBuildSettings.codeOptimization = UnityEditor.WebGL.WasmCodeOptimization.DiskSizeLTO;
  }
}

8. Compress with Brotli and send the right headers. Brotli gives the smallest files and takes longer to build; gzip is bigger and faster. Chrome and Firefox only decompress Brotli natively over HTTPS, and Unity only compresses release builds (Unity: deploy a Web application). The server must say what it is sending: Content-Encoding: br on every .br file, and Content-Type: application/wasm on the WebAssembly so the browser can compile it while it downloads. This is the config that serves Al Hamra on Vercel:

// vercel.json
{ "headers": [
  { "source": "/worlds/rvt/Build/(.*)\\.br",
    "headers": [{ "key": "Content-Encoding", "value": "br" }] },
  { "source": "/worlds/rvt/Build/(.*)\\.wasm\\.br",
    "headers": [{ "key": "Content-Type", "value": "application/wasm" }] },
  { "source": "/worlds/rvt/Build/(.*)\\.js\\.br",
    "headers": [{ "key": "Content-Type", "value": "application/javascript" }] },
  { "source": "/worlds/rvt/Build/(.*)\\.data\\.br",
    "headers": [{ "key": "Content-Type", "value": "application/octet-stream" }] }
] }

# nginx, from Unity's server guide
location ~ .+\.wasm\.br$ {
  gzip off;
  add_header Content-Encoding br;
  default_type application/wasm;
}

Without the header, Unity’s Decompression Fallback still loads the build, with a larger loader and a less efficient loading scheme. I leave it off and fix the server instead.

9. Load on purpose. On a phone, Al Hamra plays a short video first and loads the 3D only when the visitor asks for it, so a large download never starts on mobile data unasked. Turn on Data Caching so the second visit does not download again. For bigger worlds, Unity recommends Addressables, which load assets when they are needed instead of at startup, and setting the Initial Memory Size to the app’s typical heap use on mobile.

Does Unity WebGL work on mobile browsers?

Yes. Unity 6 lists iOS Safari 15 and newer, and Chrome 58 and newer on Android (Unity: browser compatibility). Support is the easy part. Whether it runs well depends on the steps above, because a phone has less memory, a slower GPU and often a slower connection than the laptop you built on. Test on a real mid-range phone, not only the newest one.

What are the three.js equivalents?

The same rules apply in three.js; the tools have different names.

• Draw calls: every mesh is at least one request to draw, so merge static geometry (three.js manual: optimise lots of objects). Use InstancedMesh for many copies of one object and BatchedMesh for many different geometries that share a material (BatchedMesh docs).
• Detail by distance: the LOD object switches between meshes at the distances you set (LOD docs).
• Textures: ship KTX2 files with Basis Universal. KTX2Loader transcodes them to whatever compressed format the GPU supports (KTX2Loader docs), which covers desktop and phones from one file.
• Light: bake it into lightmaps in Blender and use cheap materials, as you would in Unity.
• Measure: renderer.info.render.calls and renderer.info.render.triangles give you draw calls and triangles per frame (WebGLRenderer docs).
• Memory: geometries, materials and textures are not freed on their own; call dispose() when you remove them (three.js manual: dispose of objects).

// Cap the pixel ratio: a phone at 3x draws far more pixels than at 2x
renderer.setPixelRatio(Math.min(window.devicePixelRatio, 2));

// Compressed textures that suit every GPU
const ktx2 = new KTX2Loader().setTranscoderPath('/basis/').detectSupport(renderer);
const tex = await ktx2.loadAsync('/textures/floor.ktx2');

// Watch the two numbers that matter
console.log(renderer.info.render.calls, renderer.info.render.triangles);

The live Al Hamra page caps the pixel ratio at 2 for the same reason.

When should you stream instead of building for WebGL?

Stream when the visuals cannot be cut down to fit a phone, or when the model must never leave your servers. With Unreal Pixel Streaming the 3D renders on a cloud GPU and every viewer needs their own. One streaming GPU server on AWS costs about $0.53 an hour, so 1,000 people at once is roughly $526 an hour before bandwidth. A WebGL build is one download per visitor, however many come. For a building people browse for leasing or marketing, I build for the browser. I have shipped both routes: at Napster I led a team across Unreal, Unity and WebGL, which I compare with building alone in what one person with AI can ship. I compare the routes for stores, shows and venues in Virtual stores, live shows and 3D worlds people actually use.

Questions people ask

How do I reduce Unity WebGL build size?

Leave out hidden objects, decimate heavy meshes, compress textures, strip code with Managed Stripping Level High and Disk Size with LTO, remove unused packages, and compress with Brotli.

Brotli or gzip for Unity WebGL?

Brotli gives smaller files and needs HTTPS in Chrome and Firefox. Gzip is bigger and works over HTTP and HTTPS. Either way, the server must send the matching Content-Encoding header.

Why does my Unity WebGL build fail to load after upload?

Usually the headers. Compressed files served without Content-Encoding, or the WebAssembly without Content-Type: application/wasm, will fail to load or load slowly. Check them in the browser’s network panel.

How many triangles can a phone browser draw?

There is no single number; it depends on the phone, the shaders, the lights and the draw calls. Measure on a real mid-range device with the Profiler or renderer.info. For reference, the live Al Hamra build draws about 700,000 at once and holds 60 fps on a laptop graphics chip.

If you need a 3D world that opens from a link on a phone, see 3D web experiences or write to me at m@tawfik.tv.

Most teams find their gaps the expensive way. Gartner predicts that by 2027, 40% of enterprises will demote or decommission autonomous AI agents because of governance gaps found only after production incidents (Gartner, 26 May 2026). Its advice: match controls to how much each agent can do on its own.

I lead product for GVNR at Instruxi, guardrails that decide allow, deny or ask before an agent acts. This is the framework I use, in plain words.

What is AI agent governance?

Model governance asks whether a model is fair and fit for purpose. Agent governance asks: may this agent do this, right now? An agent holds keys, calls tools and spends money, so the controls sit in front of its actions, outside the model. A line in the prompt saying “never delete anything” is a request. A permission the agent does not hold is a control.

The AI agent governance framework in nine steps

1. Inventory every agent. List each agent, the person who owns it, what it touches and how much it can do on its own. Gartner’s four autonomy levels are a useful label: observe, advise, act with approval, act autonomously. Include the ones people set up on their own laptops.

2. Give each agent its own identity. No shared API keys. Each agent gets its own credential and acts for a named person, so every action traces back to both. This is the answer to OWASP’s ASI03, Identity and Privilege Abuse, in the OWASP Top 10 for Agentic Applications (December 2025). In GVNR the agent cannot choose or change its own id.

3. Least privilege. Start read-only and add what the job proves it needs. Refunds up to a set amount, a staging database instead of production, a project folder instead of the whole disk. Separate credentials per environment.

4. Decide before the action. Put a check between the agent and its tools that answers every call with allow, deny, or stop and ask a person. Deny what should never happen, ask before what cannot be undone, allow the rest. A check that runs after the fact can only report the damage.

5. Set spend and loop limits. Two kinds: a total per agent per session or day, and a rate per minute. The rate catches runaways, the expensive incidents. Add loop detection: GVNR’s defaults stop an agent that repeats the same action four times in its last eight, and ask when spend passes $2 a minute or 75% of a $20 cap.

6. A person approves the irreversible. Deleting data, moving money, deploying, publishing and sending messages outside the company wait for a named human. Keep the list short: Gartner warns that approvals degrade under time pressure and approval fatigue.

7. Keep a tamper-evident record. Record who the agent acted for, the exact action, the tool, the model, the rule that answered, the verdict and the time, as fields you can query. Chain each line to the hash of the one before, so an edit or a deleted line breaks the chain and a single check shows where.

8. Review on a cadence. Each month the owner confirms the agent’s access and removes what it has not used. Each week someone reads the denies and asks: denies show where agents push, asks show where rules are too tight or too loose.

9. Write the incident playbook before the incident. Stop the agent, revoke its key, verify the record, work out what it touched, fix the rule that let it through, and write it up. Only a person should be able to resume a stopped agent.

Open the interactive diagram on tawfik.tv

How do I secure AI agents?

Steps 2 to 6 are the security core: identity, least privilege, a check before each action, limits, and a person on the irreversible. Those five cover the most common ways agents go wrong in the OWASP list: a hijacked goal (ASI01), misused tools (ASI02), abused identity and privileges (ASI03), unexpected code execution (ASI05) and cascading failures (ASI08). For coding agents with a shell, the step-by-step settings for Claude Code, Cursor, Codex and Gemini CLI are in my note on agents deleting databases. For agents connected to tools over MCP, start with the MCP security checklist.

How do I manage AI agent permissions?

Treat each agent like a new starter with a narrow role. Write its permissions down as scopes (what it can read, what it can change, how much it can spend), attach them to its own identity, and give it an owner who signs off each month. Make “ask a person” a permission in its own right: a finance agent can draft a payment and have it wait, rather than holding either no access or full access. When an agent changes job, change its scopes: editing the prompt changes nothing it can reach.

How do you red team AI agents?

AI red teaming means attacking your own agent before someone else does, and with an agent the thing to attack is what it can do: its tool calls, its spending, its deletes. Use the OWASP Top 10 for Agentic Applications as the test list: hide instructions in a document to hijack its goal (ASI01), push it to misuse a tool (ASI02), get it to act with someone else’s identity or privileges (ASI03), and try to make it run code it should not (ASI05). Aim each attack at the check that sits before the action, and record its verdict. Every attack that reaches a tool is a rule to write, and every one that ends in deny or ask is evidence for your review in step 8.

How does this map to NIST AI RMF, ISO/IEC 42001 and the EU AI Act?

The NIST AI Risk Management Framework 1.0 (January 2023) organises the work into four functions: Govern, Map, Measure and Manage. ISO/IEC 42001:2023 is the first international standard for an AI management system; ISO’s own summary lists responsibilities, risk management, lifecycle controls, monitoring and continual improvement among its requirements (ISO/IEC 42001 explained). The EU AI Act sets legal duties, the heaviest for high-risk uses.

For high-risk systems, Article 12 requires automatic event logs, Article 14(4)(e) a stop button or similar procedure, and Article 26 oversight by competent people and logs kept for at least six months.

When do the EU AI Act rules apply to AI agents?

The Act entered into force on 1 August 2024. Prohibited practices and the AI literacy duty applied from 2 February 2025, rules for general-purpose AI models from 2 August 2025, and the transparency rules, such as telling people they are talking to a machine, from August 2026, according to the European Commission. The Digital Omnibus, Regulation (EU) 2026/1744, moved the high-risk duties: 2 December 2027 for Annex III uses such as employment, credit, education and critical infrastructure, and 2 August 2028 for AI built into regulated products.

Most coding and research agents are not high-risk. An agent that screens job applicants or decides who gets credit is. Either way, the nine steps are the evidence an auditor or a customer’s security team will ask for.

What should an AI agent governance platform do?

Whatever you buy or build, check six things: an identity and owner per agent, a decision before each action runs, coverage of every agent whichever AI it uses, per-agent limits on spend, rate and repeats, irreversible actions routed to a named person, and a record you can verify without trusting the vendor.

That is what GVNR does on your own machine. It works with Claude Code, Cursor, Codex, Gemini CLI and any other MCP client. Where an agent offers a hook that runs before each tool call, the decision is enforced; Claude Code’s hook is wired today, and over MCP the agent has to ask. It is free and source-available under FSL-1.1-ALv2, so each release becomes Apache 2.0 two years later (code on GitHub). It does not judge whether an answer is true. It decides what an agent may do, and keeps the receipt.

The same three answers sit behind the credential and banking builds in my forward deployed work.

Questions people ask

What is AI agent governance?

The rules and controls that decide what each AI agent may do, who it acts for, and how you prove what it did.

What is an AI agent governance framework?

A repeatable set of controls applied to every agent: inventory, identity, least privilege, a check before each action, limits, human approval for the irreversible, a tamper-evident record, regular review and an incident playbook.

How do I secure AI agents?

Give each agent its own identity and the least access its job needs, check every action before it runs, cap spend and repeats, and make irreversible actions wait for a person.

How do I manage AI agent permissions?

Write them as scopes tied to the agent’s own identity, start read-only, make “ask a person” a permission, and have the owner review them monthly.

Does the EU AI Act apply to AI agents?

Yes, depending on the use. Transparency rules apply now; high-risk duties such as logging and human oversight apply from 2 December 2027 for Annex III uses.

What is the difference between AI risk management and AI compliance?

AI risk management is the ongoing work of finding, measuring and reducing what can go wrong with an AI system; the NIST AI RMF splits it into Govern, Map, Measure and Manage. AI compliance is proving you meet a specific rulebook. For EU AI Act compliance on high-risk uses, that means automatic logs (Article 12), a way to stop the system (Article 14) and logs kept for at least six months (Article 26). The nine steps above serve both: the controls cut the risk, and the record is the evidence.

If you need agent governance designed or built into your product, write to me at m@tawfik.tv.

In September 2025, researchers at Koi Security found the first malicious MCP server in the wild. The package, postmark-mcp, was downloaded about 1,500 times a week, worked cleanly for 15 versions, and from version 1.0.16 quietly copied every email it sent to its publisher (Koi Security, 25 September 2025). No agent made a mistake. The server did what its code said.

I build guardrails for AI agents at Instruxi, including a free guard that plugs into agents over MCP. This is the list I run before an agent touches anything that matters, built from the official MCP security guidance and OWASP. Tick what your setup has in the checker below and it ranks what to fix first.

What is an MCP server?

MCP is the Model Context Protocol, an open standard for connecting AI agents to tools and data. An MCP server is a small program that hands an agent a set of tools, such as “send email”, “query the database” or “read this folder”. The agent decides when to call them. That is the risk: whatever the server can reach, the agent can reach, so the server deserves the same checks as any code you install.

What are the main MCP security risks?

Six keep showing up in the advisories.

• Tool poisoning. Tool names and descriptions are text the model reads as instructions, and a server can hide orders in them. Invariant Labs showed a poisoned tool getting an agent in Cursor to read ~/.ssh/id_rsa and its own MCP config and hand them over (April 2025). A server can also change a description after you approved it, which they call a rug pull.
• Prompt injection through tool output. A crafted issue in a public repository steered an agent using GitHub’s MCP server into leaking private repository data into a public pull request (Invariant Labs, May 2025). OWASP ranks this family first, as agent goal hijack, in its Top 10 for Agentic Applications (December 2025).
• Token passthrough. A server that takes the client’s token and forwards it to the API behind it. The MCP security best practices forbid it: servers “MUST NOT accept any tokens that were not explicitly issued for the MCP server”.
• Confused deputy. An MCP proxy that talks to a third-party API with one shared client ID can let an attacker ride your earlier consent and receive the authorization code. The same page requires per-client consent before the proxy forwards anything.
• Over-broad scopes. A token granted files:* or admin:* up front turns one leak into access to everything. OWASP calls the wider pattern excessive agency: too much functionality, too much permission, too much autonomy.
• Unpinned and unpatched servers. postmark-mcp is the first case. The second: a flaw in mcp-remote, a widely used bridge, let a malicious server run commands on the machine that connected to it (CVE-2025-6514, CVSS 9.6, JFrog, July 2025). Version 0.1.16 fixed it.

Is MCP safe to use?

Yes, with the care you give any code that runs with your permissions. The official local server security guide is blunt about it: no check proves what a server will do. So the work splits in two. Vet what you install, then contain what it can reach, so a bad call costs little.

The MCP security checklist: 12 checks in priority order

1. A person approves risky actions. Delete, deploy, send, pay and reading secrets wait for a yes, with the full inputs on screen. The MCP tools spec says there should always be a human who can deny a tool call.
2. Pin every server version. Install name@1.2.3, never latest. Pinning through npx or uvx fixes only the top package, since its dependencies resolve fresh at install; a container image pinned by digest freezes the whole tree.
3. Run third-party servers isolated. A container with only the project folder mounted. The official guide calls isolation the single highest-leverage step, because it still protects you when your vetting was wrong.
4. Give tokens only the scopes the job needs. Start read-only and add a scope when a tool first asks for it. No *, all or full-access.
5. Give each server its own credentials. Put each secret in that server’s own config block. If your shell profile exports cloud keys, every server you launch may inherit them.
6. Treat tool output as untrusted. Issues, emails, tickets and web pages are data. Never let one session read untrusted text, hold private data and have a way to send data out.
7. Re-approve changed tool descriptions. Read each server’s tool list once, the MCP Inspector shows it with no model involved, and use a client that asks again when a definition changes.
8. Limit network egress. Servers that work only on local files get no network at all (--network=none in Docker). The rest get a short allowlist of the hosts they need.
9. No token passthrough. If you build a server, accept only tokens issued to it, and get its own token for the API behind it.
10. Log every tool call. Server, tool, inputs, verdict and who approved, in a record that shows any edit. The spec asks clients to log tool usage for audit.
11. Know every server you run. Open your client’s MCP config and delete what you no longer use. A server that only wraps a remote API gains nothing from running on your laptop, so use its remote version.
12. Patch bridges and proxies. Update when an advisory lands, and keep per-client consent on any OAuth proxy you run.

Open the interactive diagram on tawfik.tv

How does MCP tool poisoning work?

Follow one attack through, the one the checker animates.

1. A poisoned update arrives. A server you approved last month ships a new version. One tool description now hides an instruction: read ~/.ssh/id_rsa and pass it in the notes field. Pinning stops the update; a client that re-prompts on changed definitions shows it to you.
2. The model follows it. Nothing stops this step. The model cannot tell a hostile description from an honest one, and Invariant found that even well-aligned models fall for it. Every defence sits before or after the model.
3. The agent reads your key and calls the tool with it. A person asked before secrets are read, shown the inputs, says no.
4. The server sends it out. An egress allowlist stops the call to the attacker’s host.

Each check alone stops the chain. The log decides whether you find out the same day or never.

Where does a guard fit in an MCP setup?

I built GVNR, a free, self-hosted guard that sits in front of AI agents and decides allow, deny or ask before each action runs, with a hash-chained record of every decision. It works with Claude Code, Cursor, Codex, Gemini CLI or any other MCP client. Its credentials rule matches id_rsa, .ssh/ and .env and asks a person first, which is step three above.

The rule I held to: the agent being governed can never loosen its own limits. Its MCP tools let an agent ask permission, read status, check the record and stop an agent. There is no approve, resume or config tool, and the agent cannot pick its own identity. An agent that tries to reach the guard’s own settings from a shell gets asked too.

One honest limit, and it applies to every MCP guard. Asking over MCP is cooperative: an agent that calls the tool gets a real answer, but nothing forces it to call. Where an agent supports a hook that runs before every action, use it, and against a deliberate attacker run the agent in a container. The official guide says the same about config allowlists: they keep honest servers in line, and isolation handles the rest. For what happens when an agent holds more access than its job needs, read the note on an AI agent deleting a database. For the same checks in front of real money and records, see four AI and fintech builds.

Questions people ask

Is MCP safe?

The protocol is a way for agents to call tools. It is as safe as the servers you connect and the access you give them. Pin versions, isolate third-party servers, keep tokens narrow, and put a person on risky actions, and the risk drops to that of any other software you install.

What is tool poisoning in MCP?

Hidden instructions inside a tool’s name or description. The model reads them as part of its instructions and acts on them, often without the poisoned tool ever being called, and sometimes to misuse another server’s tools. A server can add them after you approved it.

How do I secure an MCP server?

The spec says servers must validate tool inputs, enforce access controls, rate limit tool calls and sanitise tool outputs. Accept only tokens issued to your server, offer the smallest scopes that work, use stdio for local servers or require authorization over HTTP, and use random session IDs that are never treated as authentication.

Should MCP servers run locally?

Only when they need something on your machine: your files, a local tool or hardware. A server that wraps a remote API gains nothing from running locally and takes your environment and files within reach, so prefer its remote version.

If you need this built into your agents or your product, write to m@tawfik.tv, or see how I work as a fractional CPO.

The ecosystem got big fast. By 9 December 2025 there were more than 10,000 active public MCP servers and over 97 million monthly SDK downloads across Python and TypeScript, when Anthropic donated the protocol to the Agentic AI Foundation under the Linux Foundation (Anthropic, 9 December 2025).

I lead product for GVNR at Instruxi, a free, source-available guard that plugs into agents over MCP. Designing its tool list taught me that the tool list of a server is its security design. This page covers what a server is, a working one in about 30 lines of Python, how to connect it, and how to ship it without handing an agent more than it needs.

What is an MCP server?

An MCP server is a program that exposes tools, data and prompts to AI applications over the Model Context Protocol, an open standard for connecting AI apps to the systems they work with. Anthropic introduced MCP in November 2024. There are three roles:

• The host is the AI app the person talks to: an IDE, a coding agent, a chat app.
• The client lives inside the host and speaks MCP, one client per server.
• The server is what you build. It exposes capabilities and never talks to the model directly.

Messages are JSON-RPC 2.0. The current spec is version 2026-07-28, released on 28 July 2026, and it changed how a connection starts (more on that below). If you only want the short version and the risks, my MCP security checklist has both. This page is for the person building one.

What does an MCP server expose?

Three kinds of thing. What separates them is who decides to use them, as the Python SDK’s first steps puts it:

• Tools are functions the model decides to call: search, create, send, deploy. A tool can change things.
• Resources are data the application loads into the model’s context, addressed by a URI such as notes://monday.md. Reading one changes nothing.
• Prompts are templates the user picks by name, like a slash command.

Each tool can carry annotations: readOnlyHint, destructiveHint, idempotentHint and openWorldHint. Set them honestly, but never rely on them. The spec schema calls them hints and says clients should never make tool decisions from annotations sent by an untrusted server.

Local (stdio) or remote (HTTP)?

There are two standard transports, and the choice decides your security model.

• stdio. The client launches your server as a child process and talks over its stdin and stdout, one JSON message per line. No port is open. The authorization spec says stdio servers should take credentials from the environment, not run OAuth. Anything your server prints to stdout corrupts the stream, so log to stderr.
• Streamable HTTP. Your server listens at a URL, usually ending in /mcp. This is the one you deploy so other people can use it. The transport spec says servers must check the Origin header to block DNS rebinding, should bind to 127.0.0.1 when running locally, and should authenticate every connection. Authorization is based on OAuth 2.1.

My rule: stdio when the server needs something on your machine, HTTP when other people or other machines need it.

What changed in the 2026-07-28 spec?

Most tutorials still open with an initialize handshake. The 2026-07-28 changelog removed it, along with protocol-level sessions. Every request now carries its protocol version, client identity and capabilities in _meta. Servers must answer a new server/discover request listing their versions and capabilities. The Python SDK’s v2 renamed FastMCP to MCPServer and speaks the new version while still serving older clients (What’s new in v2). If a guide imports FastMCP, it was written for v1.

How do I build an MCP server?

Here is a complete server in Python with the official SDK: one tool, one resource template and one prompt. I ran it on SDK 2.3.0, the current release, and it answered at protocol 2026-07-28. Official SDKs also exist for TypeScript, C#, Go, Rust, Ruby, Java and more (SDK list).

1. Install the SDK (Python 3.11 or later):

uv add "mcp[cli]"      # or: pip install "mcp[cli]"

2. Write server.py. It reads notes from one folder and nothing else:

from pathlib import Path

from mcp.server import MCPServer
from mcp.types import ToolAnnotations

NOTES = (Path(__file__).parent / "notes").resolve()  # the only folder it can read
mcp = MCPServer("Notes")


@mcp.tool(annotations=ToolAnnotations(read_only_hint=True, open_world_hint=False))
def search_notes(query: str) -> list[str]:
    """Return the names of notes that contain the query."""
    return [p.name for p in NOTES.glob("*.md") if query.lower() in p.read_text().lower()]


@mcp.resource("notes://{name}")
def read_note(name: str) -> str:
    """The full text of one note."""
    path = (NOTES / name).resolve()
    if path.parent != NOTES:
        raise ValueError("That file is outside the notes folder.")
    return path.read_text()


@mcp.prompt()
def weekly_review() -> str:
    """Summarise this week's notes."""
    return "Search my notes for this week and list the open actions."


if __name__ == "__main__":
    mcp.run()

The type hints become the input schema and the docstrings become the descriptions. mcp.run() with no arguments serves stdio. For HTTP, mcp.run(transport="streamable-http") serves http://127.0.0.1:8000/mcp.

3. Open it in the MCP Inspector, which lists the tools and lets you call them with no model involved:

uv run mcp dev server.py

4. Leave one check behind. The SDK’s Client can connect to the server object in memory, no process and no port, so a broken tool fails before any agent sees it:

import anyio
from mcp import Client
from server import mcp


async def main() -> None:
    async with Client(mcp) as client:
        result = await client.call_tool("search_notes", {"query": "booking"})
        assert result.structured_content == {"result": ["tuesday.md"]}
        print("ok", client.protocol_version)  # ok 2026-07-28


anyio.run(main)

On the wire, a tool call is one line of JSON from the client and one back. This is what my server returned over stdio, trimmed of _meta:

→ {"jsonrpc":"2.0","id":3,"method":"tools/call","params":{"name":"search_notes","arguments":{"query":"booking"}}}
← {"jsonrpc":"2.0","id":3,"result":{"content":[{"type":"text","text":"tuesday.md"}],"isError":false,"resultType":"complete","structuredContent":{"result":["tuesday.md"]}}}

Build it up below: add tools to the sample server, switch transports, and watch what each risky setting lets an agent reach.

Open the interactive diagram on tawfik.tv

How do I connect an MCP server to Claude Code, Cursor, Codex or Gemini CLI?

Every client needs the same thing: the command that starts your server. Use absolute paths, because the client launches it from its own working directory (Python SDK, connect to a real host).

# Claude Code
claude mcp add notes -- uv run --with "mcp[cli]" mcp run /absolute/path/to/server.py

# Codex
codex mcp add notes -- uv run --with "mcp[cli]" mcp run /absolute/path/to/server.py

# Cursor: .cursor/mcp.json   Gemini CLI: ~/.gemini/settings.json
{ "mcpServers": { "notes": {
    "command": "uv",
    "args": ["run", "--with", "mcp[cli]", "mcp", "run", "/absolute/path/to/server.py"] } } }

# A deployed HTTP server is a URL instead of a command
claude mcp add --transport http notes https://notes.example.com/mcp

Sources: Claude Code MCP, Codex MCP, Cursor MCP, Gemini CLI MCP.

How do I ship an MCP server safely?

The 12 checks for people connecting servers are in the MCP security checklist. These are the ones that sit with the builder.

1. Narrow tools, typed arguments. search_notes(query) beats run_sql(query), and both beat run_command(command). A catch-all tool makes every other limit decoration.
2. Validate every input on the server. The tools spec says servers must validate all tool inputs, enforce access controls, rate limit tool calls and sanitise outputs. The folder check in read_note above is that rule in three lines.
3. Scope what the process can reach. Point it at one folder, not your home folder. Pass only the variables it needs: a stdio server launched from your shell can inherit every key in it.
4. Read-only first. Ship a reader, then add a writer when someone needs it. Mark writes and deletes honestly so clients can ask a person first.
5. Return errors as results. A failed call should come back with isError: true and a plain message the model can act on.
6. On HTTP: check Origin, bind to 127.0.0.1 in development, require sign-in, and accept only tokens issued to your server. Never pass the client’s token through to another API.
7. Version every release. People should pin your server, so give them versions worth pinning.

Rules 1, 3 and 4 do most of the work. In the inspector above, a read-only notes server reaches one place. Add fetch_url and widen the folder, and the agent can read secrets, read untrusted pages and send data out: everything a leak needs.

Where does a guard fit around MCP servers?

Even a well-built server does exactly what the agent asks. Something has to decide whether the agent should ask. GVNR works with Claude Code, Cursor, Codex, Gemini CLI and any other MCP client, and decides allow, deny or ask before each action, with a hash-chained record of every decision. It is free and source-available under FSL-1.1-ALv2, so each release becomes Apache 2.0 two years later (code on GitHub).

Its own MCP server follows the rules above. Its tools let an agent ask permission, read status, check the record and stop an agent. There is no approve, resume or config tool, and the agent cannot pick its own identity, so the agent being governed can never loosen its own limits. One honest limit: over MCP, asking is cooperative. Where an agent offers a hook that runs before every action, use it; Claude Code’s hook is wired today.

For how this fits a wider programme of identity, limits and records, read AI agent governance. For what agents are and when they need tools at all, see agentic AI.

Questions people ask

What is an MCP server in simple terms?

A program that tells an AI app “here are the things I can do and the data I have”, in a format every MCP client understands, and then does them when asked.

What is the difference between an MCP server and an API?

An API is built for developers who read its docs. An MCP server describes itself to the model at runtime: names, descriptions and input schemas. Many MCP servers are thin wrappers around an existing API.

Does MCP still use the initialize handshake?

Not from version 2026-07-28. Each request carries its protocol version in _meta, and servers answer server/discover. Older clients still send initialize, and the official Python SDK serves both.

Should I write an MCP server in Python or TypeScript?

Whichever your team already runs. Both are Tier 1 official SDKs, alongside C#, Go, Rust and Ruby. The server’s design matters more than the language.

If you need MCP servers, agents or the guardrails around them built into your product, write to m@tawfik.tv or see how I work as a fractional CPO.

Here are four kinds of fan world from the platforms I’ve built for many artists and live events, de-branded, with the club night drawing on the PRISM shows I ran.

Open the interactive diagram on tawfik.tv

Those fans are worth knowing. In Luminate’s 2025 Year-End Music Report, published in January 2026, 20% of U.S. music listeners count as superfans: they engage with artists in at least 5 of 13 ways, from going to shows and buying merch to signing up for artist newsletters and joining fan clubs. Yet on Spotify, an artist sees totals and can’t see the names of individual followers.

I’ve built fan platforms for many artists and live events, on both sides: the app the fan plays, and the dashboard the artist and label read. Here is how I build them.

What is a fan engagement platform?

It is two products joined by one database.

• The fan side. A daily habit: check in, play, collect, buy, scan in at the show, bring a friend. Every action earns points, and points unlock rewards fans actually want: early merch, better tickets, a collectible nobody else has.
• The artist side. A dashboard that turns those actions into decisions: which cities to tour, which track to push, which merch to reprint.

Immersion is the skin. A fan platform can read as the artist through rooms, objects, voice and marks, the way a virtual show does, with Carl Cox’s set in PRISM as the example there. Underneath, the engine is data capture, points, games, rewards and merch. Skip the engine and you have a beautiful page people visit once.

Who owns fan data, the artist or the platform?

Today, mostly the platform. Streaming services and social networks hold the accounts, so an artist with millions of listeners can still have no way to email one of them. The dashboards they get show streams, listeners and top cities as totals. The people stay with the platform.

First-party fan data is data fans give the artist directly, on the artist’s own platform, with consent. That consent has rules. The UK regulator, the ICO, says consent should be unbundled from terms and conditions and granular for separate purposes, never a pre-ticked box, and easy to withdraw. GDPR Article 5 adds data minimisation: collect only what you need for the purpose.

So I design data capture as a trade, one screen at a time. The fan unlocks a collectible, and the same screen asks for their home city so they hear when the tour comes near them. One reason, one question, one tick box that starts empty.

How do you build a fan app, step by step?

1. Pick the one number. For most artists mine is fans still active on day 7. A sign-up who never comes back is a row, and that is all.
2. Design the daily habit first. A check-in streak, a short game, a drop that only lasts today. If there is no reason to open it tomorrow, nothing else matters.
3. Write the points table. What each action earns, what points unlock, and what points can never buy. It should fit on one screen.
4. Map one data point to each screen. Sign-up gets an email and an age band. The game gets a favourite track. The collectible gets a home city. The show gets a scan at the door. Write down the consent for each before anyone designs a button.
5. Put merch and tickets inside the loop. Points buy early access, purchases earn points, and every order tells the artist what sells where.
6. Make the show the peak. A scan at the venue door turns a fan into a fan who came. That is the most valuable row in the database.
7. Build the artist dashboard alongside the app. If the label cannot read the data, the fans gave it for nothing.
8. Ship to the browser, test on the cheapest phone, then watch the number. Cut what does not move it.

Play one fan’s week below. Each action shows what the fan gets, what the artist gets and under which consent. Then switch to asking for everything up front and see what happens to the list.

Open the interactive diagram on tawfik.tv

The drop-off numbers in the demo are illustrative, not measured. The rule behind them holds: ask for each thing at the moment the fan can see why.

What should an artist and label dashboard show?

Five things, and each one answers a decision.

• Fans by city. Where the people live, so tour and ad money follows them.
• Streams by track over time. Which song is pulling, and since when.
• Merch sales. What sells, where, at what price.
• Sign-ups and returning fans. Whether the list is growing and whether people come back.
• Where to tour next. A ranking that weighs the fans in each city by how often they come back and how much they buy.

I’ve built this artist and label view: fans, streams, merch and sign-ups by city. The demo below uses a fictional artist and sample data. Filter by age band, country or top track and watch the tour ranking change.

Open the interactive diagram on tawfik.tv

A city with fewer fans who come back every week and buy the hoodie can beat a bigger city full of casual listeners.

How do you keep young fans safe in a fan app?

Plan for young fans from the first sketch.

• UK. Under UK GDPR, only children aged 13 and over can consent for themselves to an online service. Under 13, a parent consents. The ICO’s Children’s code covers services likely to be used by under-18s, with 15 standards including high privacy by default, location off by default and no nudges to hand over more data.
• EU. GDPR Article 8 sets the age of digital consent at 16 and lets each country lower it, to no less than 13.
• USA. COPPA requires verifiable parental consent for children under 13. The FTC’s updated rule, finalised in January 2025, adds separate opt-in consent for targeted advertising and other disclosures to third parties, and stops companies keeping children’s data indefinitely.

In practice: ask for an age band at sign-up, send under-13s down a parent route, keep under-18s out of ad targeting, and never use a streak or points to push a young fan into sharing more. For age checks that do not collect an ID, see how to prove you’re over 18 without showing your ID. Then have a privacy lawyer read the consent map from step 4.

Does the same platform work for sports teams and live events?

Yes. Swap the track for the player and the show for the match: check-ins at the ground, predictions as the game, a matchday collectible, kit drops as merch. Same loop, same database: who the fans are, where they live, what they buy and whether they came. I’ve built it for live events as well as artists.

A fan loyalty program does not always need its own app. I’ve built digital loyalty for local service businesses as Apple Wallet and Google Wallet stamp cards: the card lives on the phone the customer already carries, and every stamp is a visit you can count.

How much does a fan app cost?

On Clutch, mobile app projects reviewed on the platform most commonly cost $10,000 to $49,999, with an average of $90,780 and a typical timeline of about 11 months (figures on the page as updated in September 2026). A fan platform sits toward the higher end once you add games, a points ledger, merch, ticket scanning and the artist dashboard. One browser codebase for every phone keeps it down.

Questions people ask

What is a fan engagement platform?

An app or website that gives fans a daily reason to come back, with points, games, collectibles, merch and show check-ins, and turns what they do into first-party data the artist owns, with consent.

How do artists own their fan data?

Give fans an account on the artist’s own platform and ask for one piece of data at a time, each with a clear reason and its own opt-in. Streaming platforms show artists totals. The artist’s own platform holds the names.

How much does a fan app cost?

Clutch puts the most common mobile app project at $10,000 to $49,999, with an average of about $90,780. Games, merch and a label dashboard push a fan platform higher.

Can a fan app run in the browser?

Yes. A web app opens from a link with no app store in the way. On iPhone, web apps added to the home screen can send push notifications since iOS 16.4, and passes can go straight into Apple Wallet or Google Wallet.

How do you keep young fans safe?

Ask for an age band, route under-13s to a parent, keep high privacy settings on by default for under-18s, keep them out of ad targeting, and never use rewards to nudge them into sharing more. The UK Children’s code, GDPR Article 8 and COPPA set the rules.

Can you build a fan platform for us?

Yes: the fan app, the 3D rooms and the artist dashboard. See 3D web experiences, or fractional CPO if you need someone to run the product. If you need this built, write to m@tawfik.tv.

The risk is measured. In July 2025, Veracode tested more than 100 AI models on 80 coding tasks: when a task could be written safely or unsafely, the models chose the unsafe way 45% of the time, and they failed to defend against cross-site scripting in 86% of cases (Veracode, 30 July 2025).

I build and ship apps with AI. I built a shared wedding photo app on my own with AI, about 100 guests used it on the day and nothing broke (the full story). I have moved apps onto Supabase and fixed database security on live ones, and I built a guard for AI coding agents. This is the list I run before anything goes live.

What are the security risks of vibe coding?

The same few mistakes, at scale. They are the top of the OWASP Top 10:2025: broken access control is number one, and software supply chain failures are number three.

• Open databases. In May 2025, Matt Palmer scanned 1,645 apps from Lovable’s public showcase and found 170 whose Supabase tables anyone could read or write, because Row Level Security was missing or wrong (his statement; filed as CVE-2025-48757, which Lovable disputes).
• Leaked keys. GitGuardian counted 28,649,024 new secrets pushed to public GitHub in 2025, up 34% in a year. Secrets for AI services alone rose 81% to 1,275,105 (State of Secrets Sprawl 2026).
• Agents with too much power. A coding agent holding your keys can delete a production database. It has happened, and I wrote up how to stop it.

What does a vibe-coded app look like to a scanner?

Like this. The repo below is made up, but every alert in it maps to one step of the checklist. Open an alert to see the exact line, press Show fix for the change, then commit it. Criticals first: the grade will not leave F until they are gone.

Open the interactive diagram on tawfik.tv

The vibe coding security checklist

Work through it in this order. The first six are where real data leaks from.

1. Get secrets out of the repo and the browser bundle. A key in git is public to everyone who can ever see the repo, and deleting the file does not remove it from history. A key in the browser bundle is public to every visitor. Next.js inlines any variable named NEXT_PUBLIC_ into the JavaScript it sends to the browser (Next.js docs), and Vite does the same with VITE_, warning that those variables “should not contain sensitive information such as API keys” (Vite docs). Check both:

# is .env tracked by git?
git ls-files | grep -E '(^|/)\.env'

# secrets anywhere in history
git log -p | grep -nE 'sb_secret_|sk_live_|sk-proj-|PRIVATE KEY'

# secrets in the built app
npm run build
grep -rlE 'sb_secret_|sk_live_|sk-proj-' .next/static dist build 2>/dev/null

Anything found: rotate the key first, then clean up. A key that has been public once is spent.

2. Lock down auth and database access. Turn on Row Level Security on every table, write owner-only policies, and never check roles against data the user can edit, such as Supabase’s user_metadata. Then sign out and call your API with only the public key: you should get nothing back. My Supabase security checklist has the SQL for each step.

3. Validate input on the server. Check type, length and format for every field, accept only the fields you expect, and refuse the rest. Checks in the browser are for the user’s convenience. Anyone can skip them.

4. Rate-limit anything that costs money or guards a door. Login, sign-up, password reset, one-time codes, anything that sends an email or a text, and anything that calls a paid AI API. Without a limit, a script can try thousands of passwords or spend your monthly budget overnight. Use your host’s firewall rules, a counter in Redis, or your auth provider’s limits.

5. Audit your dependencies. AI tools can suggest the versions in their training data, which may be out of date. A real example: Next.js versions from 14.0.0 up to 14.2.24 let a crafted request skip middleware, including login checks, rated critical at 9.1 (GitHub advisory for CVE-2025-29927).

npm audit --omit=dev
npm audit fix          # safe upgrades only
npm outdated           # what is behind

Turn on automatic dependency update pull requests in your repo host so this keeps happening without you.

6. Keep third-party API keys on your server. AI, payments, email, maps: if the browser calls the provider with your key, the key is in the page source. Move the call into your own API route, read the key there, and set a spend limit in each provider’s console. Map keys that must sit in the browser get restricted to your domain.

7. Separate development from production. Different databases, different keys. Your laptop, your test seeds and your coding agent should never be able to reach the data real users put in. A local database or a staging project does the job.

8. Stop error messages leaking data. Raw database errors and stack traces show table names, columns and file paths. Log the detail, show the user a plain message, and turn off debug mode in production.

9. Restrict file uploads. Allow only the file types you need, cap the size, store files under random names in a folder per user, and keep the bucket private. The file type the browser reports can be faked, so check the first bytes on the server too.

10. Set CORS to your own domains. An API that echoes back whichever site asks, with credentials allowed, lets other websites read its answers. List your domains. If only your own site calls the API, send no CORS headers at all.

11. Log the right things, and never the secrets. Log sign-ins, failed sign-ins, permission errors and admin actions, so you can see an attack happening. Never log passwords, tokens or whole request bodies. OWASP lists logging and alerting failures at number nine.

12. Keep a backup you have restored. A free Supabase project gets no automatic daily backups. Dump the database on a schedule and before every migration, and restore one copy into a scratch project once, so you know it works.

13. Put a guard on the coding agent itself. The agent that wrote the app has a shell and your keys. Keep approvals on, put deletes, git push and database clients on the ask list, deny reads of .env, and give it a read-only database user pointed at staging. The settings for Claude Code, Cursor, Codex and Gemini CLI are in how to stop an AI agent deleting your database. For a live check, I built GVNR, a free, source-available guard that runs on your own machine and works with Claude Code, Cursor, Codex, Gemini CLI and any other MCP client: before each action it decides allow, deny or ask a person, and it keeps a hash-chained record of every decision. If your agent connects to tools over MCP, the MCP security checklist covers that side.

Can I ask the AI to check its own code?

Yes, as a first pass. Paste this list into your coding agent and ask it to go through the repo step by step and show you the lines it changes. Then check the results yourself, the way an attacker would: sign out and call your API, search the built JavaScript for keys, upload a file you should not be allowed to. The model that wrote the hole is not the best judge of whether it is closed.

I do this kind of pre-launch pass as part of my forward deployed work.

Questions people ask

Is vibe coding safe?

It is as safe as the checks you run before launch. The code works; the gaps are in access control, keys and limits. Run the 13 checks above and you close the ones that cause most real leaks.

Is AI-generated code secure?

Often not by default. Veracode found AI models chose the insecure way to write code 45% of the time across 80 tasks. Treat AI code like code from a fast junior developer: useful, and reviewed before it ships.

What is the biggest security risk in a vibe-coded app?

Broken access control: a database anyone can read, or a secret key shipped to the browser. It is number one in the OWASP Top 10:2025 and the cause of the Lovable showcase leaks.

How long does a security check take?

An afternoon for a small app, if you go in order. Secrets, database access and dependencies take the first hour or two. The rest are settings and short code changes.

Do I need a security expert?

Not for this list. You need one before you handle payments, health data or anything regulated at scale, and a penetration test before a big launch is money well spent.

If you need an app checked and fixed before launch, write to me at m@tawfik.tv.

The bar it has to clear is not high. On 9 October 2025 the Financial Stability Board reported that a cross-border business payment cost 1.6% on average, and 1.4 points of that was the FX margin. Only 39.6% of business payment services credited the payee within one business day, and 2.2% within an hour (data as of March 2025).

I’m Mo Tawfik Khalifa, chief product officer and forward deployed engineer at Instruxi. I built a cross-border payments pitch for a network that settles between member banks in seconds: an interactive page where you switch one part off and watch the payment fail. I also built the checkpoint that sits in front of every move in a bank’s stablecoin app.

What is a stablecoin?

A stablecoin is a token on a blockchain that is built to hold the value of a normal currency, usually one US dollar. The issuer keeps reserves behind every coin and swaps coins back for dollars. Under the US GENIUS Act, a regulated issuer has to back every coin at least one to one with cash, insured bank deposits, short-dated Treasury bills and a short list of similar assets, and publish those reserves every month (what the law allows banks to do). Because the coin moves on a blockchain, it can cross a border in minutes, at any hour.

How does a stablecoin payment work?

Six steps, and only one of them is on a blockchain.

1. Onboard once. Your business passes KYB (know your business) with a licensed partner in your country: who owns it, what it does, where the money comes from. The supplier’s side needs the same at their end.
2. Pay in. You send local money to the partner on your domestic rail, for example Faster Payments in the UK or SEPA Instant in Europe, which runs 24 hours a day, every day of the year.
3. Check. The partner screens the payee against sanctions lists and attaches the sender and payee details that must travel with the transfer.
4. Convert. The partner turns your money into a dollar stablecoin such as USDC. If you started in dollars, this is one for one, less a fee.
5. Move. The coins cross the chain to the payout partner. On Ethereum a block is final after two epochs of 32 twelve-second slots, about 13 minutes. Network fees are small: $0.001 to $0.53 a transaction across chains, in a Harvard Business School study presented at the BIS annual conference on 26 June 2026.
6. Pay out. The second partner sells the coins for local money and pays the supplier on their instant rail: RTP in the US, NPP in Australia, both open around the clock.

The same study calls this the stablecoin sandwich: the partners at each end do what correspondent banks do, holding fiat, running compliance and keeping custody. Stablecoins move the middle of the trip onto a chain. They do not remove the middlemen.

The big networks already use the middle part. On 16 December 2025 Visa launched USDC settlement with US banks over Solana, with stablecoin settlement at a $3.5 billion annualized run rate as of 30 November 2025, and named seven-day availability as a reason.

How do B2B cross-border payments move over SWIFT instead?

Your bank screens the payment, converts the currency and sends a SWIFT message. The payment hops through one or more correspondent banks, each screening it again, before the payee’s bank credits the account. Every bank works to its own hours and cut-offs.

For large payments, $100,000 and up, the hops are fast: Swift data in the same FSB report shows 88.5% cross the in-flight leg within an hour. The last bank is the slow part. Only 61.7% are credited within an hour of arriving there, so 54.6% land end to end within the hour and 93.2% within a business day. Smaller business payments are the ones that wait a day or more.

Where are the real costs in a stablecoin payment?

At the two ends, not on the chain.

• FX. It is 1.4 of the 1.6 points in the FSB average. Large global banks charged about 2% to 4.7% in FX on the personal wires in the Harvard study, plus a $25 to $45 wire fee. On exchanges, stablecoin rates for major currencies track the wholesale benchmark on average, but swing: about 0.87% day to day for sterling and 0.80% for Australian dollars, one standard deviation.
• Ramp fees. Published exchange trading fees run 0 to 1% per conversion, depending on platform and volume. If neither end is dollars, you convert twice.
• Off-ramp depth. A typical day’s exchange trading of stablecoins for Australian dollars was about $4 million in the study, $7.4 million for Mexican pesos and $17.4 million for sterling. A $1 million payout is a real share of that day.
• Compliance. It moves to your partners, and they price it in.

Try it. Pick a corridor, an amount and a deadline, then switch the off-ramp off or put the payee on a sanctions list.

Open the interactive diagram on tawfik.tv

What does a business need to send stablecoin payments?

• A licensed partner at each end. In the US the GENIUS Act, signed on 18 July 2025, sets who may issue a payment stablecoin, and from 18 July 2028 a provider may only offer US customers coins from permitted issuers, with narrow exceptions. I covered the bank side in can a bank issue its own stablecoin.
• KYB and a payee check. Expect the same ownership and source-of-funds questions a bank asks. Proving facts about a business without handing over its whole file is the subject of how to prove who someone is.
• Travel rule data. The sender’s and payee’s details must move with the transfer. In the EU this applies to crypto transfers regardless of their amount since 30 December 2024. In the US the rule covers transfers of $3,000 or more, and FinCEN’s 2019 guidance applies it to virtual currency.
• Sanctions screening on both routes. OFAC’s guidance for the virtual currency industry is plain: blocked virtual currency must be frozen and reported within 10 business days, as with any blocked property.
• Treasury plumbing. Who approves a release, and how each payment reconciles to its invoice: the same job as confirming an instant payment automatically.

What are the risks of stablecoin payments?

• Depeg. In March 2023 more than $3 billion of USDC’s reserve cash was at Silicon Valley Bank when it failed. Circle’s own filing says USDC saw “a temporary price dislocation” on some markets until the funds were released. The GENIUS Act will require one for one reserves and monthly reserve reports once it takes effect, by 18 January 2027 at the latest.
• Sanctions. A hit stops both routes at the first check. Issuers can also freeze coins in a wallet, so a payment can stop after it leaves you.
• Off-ramp liquidity. If the payout partner is offline or the market is thin, your money sits as USDC with no way into the supplier’s currency. Line up a second partner per corridor.
• Money that is not quite money. The BIS Annual Economic Report 2025 says stablecoins “perform poorly” on its three tests for money: singleness, elasticity and integrity.

When does a stablecoin beat SWIFT, and when does it not?

It usually wins when:

• The payment has to land on a weekend, a holiday or after your bank’s cut-off.
• One end is already dollars, so there is one conversion, not two.
• The amount is under $100,000, where wires are slowest.
• The supplier will accept USDC, so there is no off-ramp at all.

It usually loses, or ties, when:

• Your bank already quotes you close to the wholesale rate, so there is little FX margin left to save.
• The payout currency trades thinly in stablecoins and the amount is large.
• You have no second off-ramp and the payment cannot be late.

How I would decide: run both routes side by side on one corridor for a month of real invoices, and log time to credit, all-in cost against the benchmark rate, and every hold. Put a checkpoint in front of each payment that gives a plain-English reason when it stops one. The four builds behind that approach are in forward deployed engineer: four AI and fintech builds.

Questions people ask

How do stablecoin payments work for a business?

A licensed partner takes your local money, converts it to a dollar stablecoin and sends it on a blockchain. A partner in the supplier’s country converts it back and pays out on the local rail. Both partners check identity, sanctions and travel rule data.

Are stablecoin payments faster than SWIFT?

Usually. The chain step takes minutes and the instant rails at each end run all week. Only 39.6% of business payment services credit within one business day, per the FSB.

Are stablecoin payments cheaper than a bank wire?

Sometimes. The chain fee is cents, but ramp fees run 0 to 1% per conversion. Against the 1.6% business average, it wins when one end is dollars and the payout market is deep.

What is the travel rule for stablecoin payments?

The sender’s and payee’s details must travel with the transfer, as they do with a bank wire. The EU applies it to every crypto transfer a provider handles, whatever the amount. The US applies it from $3,000.

What happens if a stablecoin loses its peg mid-payment?

The coins can trade below a dollar for a while, as USDC did in March 2023. A payment that takes minutes has little exposure. Coins waiting at a stuck off-ramp have more.

What are the main B2B cross-border payment solutions?

For most businesses, two routes: a bank wire over SWIFT through correspondent banks, or a stablecoin route, where a licensed partner at each end converts the money and pays out on the local instant rail. Some bank networks also settle between member banks directly, in seconds; I built a pitch for one. Choose per corridor: stablecoins win on weekends, after cut-offs and when one end is already dollars, while wires hold up when your bank’s FX rate is close to wholesale or the payout currency trades thinly in stablecoins. Run both side by side on one corridor for a month of real invoices before you switch.

If you need this built, write to m@tawfik.tv, or see how I work as a fractional CPO.

Low latency streaming shrinks the chunks. Low-Latency HLS and low-latency DASH bring an app down to TV’s range, a few seconds. WebRTC goes under a second, at a higher cost per viewer.

In Bitmovin’s 9th Video Developer Report (survey run July 2025), 39% of video teams reported under 5 seconds end to end, 40% sat between 10 and 30 seconds, and 21% did not measure latency at all.

I have worked at both ends of this. I was technical and transmission manager for Olympic Broadcasting Services at the PyeongChang Winter Olympics, a technical producer on live F1 race coverage, on the engineering team behind Sky Sports’ video players, and a streaming manager at Amazon, including live music streams for Amazon Music. The long version of how a goal travels from the pitch to your phone is on my broadcast workflows page. This is the engineer’s version: where the seconds go, and which protocol buys them back.

Why is my live stream delayed?

Follow one goal from the ground to a phone. Glass to glass, the seconds go here:

1. Camera and production. Cameras, the director and replays add well under a second.
2. Contribution. The feed travels from the venue to the encoder, often over SRT, which holds packets for a short window so it can resend lost ones.
3. Encode. Encoding for picture quality takes a second or two.
4. Waiting for the segment. The packager can only publish a segment once all of it is encoded. A 6-second segment is, on average, 3 seconds old when it goes out.
5. Origin and CDN. The file is copied to edge servers near the viewer.
6. The player buffer. This is the big one. The HLS spec, RFC 8216, says a player should not start less than three target durations from the end of the playlist, because “doing so can trigger playback stalls”. Three 6-second segments is 18 seconds.

So the delay sits at the end of the chain, in the packager and the player. The satellite or the internet is rarely the problem.

Set your own pipeline below, then kick off and watch the same goal reach two phones.

Open the interactive diagram on tawfik.tv

What is the lowest latency streaming protocol?

WebRTC. Each protocol has a real range and a job it suits.

• HLS and DASH, standard: 10 to 30 seconds. Segments of 2 to 6 seconds, three held in the player. Apple’s authoring spec still says target durations should be 6 seconds. Use it when reach and price matter more than seconds.
• Low-Latency HLS: TV range. Apple splits each segment into partial segments, for example 200 milliseconds each, and says that brings delay “into the range of standard television broadcasts”. Use it for sport on phones and TVs, especially where Apple devices dominate.
• Low-latency DASH: TV range. The DASH-IF guidelines aim to match broadcast, which they put at 3 to 10 seconds. The packager sends CMAF chunks while each segment is still growing, using HTTP chunked transfer, and the player nudges its playback speed to hold a target latency. CMAF is the shared file format, so one set of chunks can serve both LL-HLS and LL-DASH.
• WebRTC: under a second. Frames go out as they are encoded, with no segments. Cloudflare’s WebRTC docs quote under 500 milliseconds to the viewer. WHIP, published as RFC 9725 in March 2025, standardises the ingest: one HTTP POST, and the encoder is live. Use it when the viewer acts on what they see.
• SRT: contribution, not delivery. SRT moves the feed from the venue to your encoder over the open internet. The SRT draft describes it as ideal for sub-second video, with a 120 millisecond minimum latency and a recommended setting of 3 to 4 times the round trip.

The same Bitmovin survey shows what teams pick for low latency: LL-HLS at 26%, LL-DASH at 19%, WebRTC at 14%, and 28% use none.

HLS vs WebRTC latency: what do you give up?

Every second you cut is paid for in one of three ways.

• Scale. HLS and DASH are plain files. A CDN caches each segment once and serves it to everyone, so the cost per viewer stays low as the audience grows. WebRTC has no HTTP cache in the path: every viewer holds a live connection to a media server.
• Cost. LL-HLS keeps the CDN but multiplies requests. At 0.2-second parts, each viewer asks for five parts a second, plus playlist updates. The CDN also has to support HTTP/2 or HTTP/3 and hold blocking playlist requests, which the HLS second edition draft requires for low-latency serving. If the edge cannot, players fall back to regular latency. You pay for low latency and get the old delay.
• Resilience. A buffer is insurance. Eighteen seconds in hand rides out most network hiccups. Three seconds leaves little room, so low-latency players drop quality or speed up and slow down to stay on target, and a bad network shows up as a stall sooner.

How do I set up Low-Latency HLS?

Start with Apple’s numbers, then tune. Apple’s authoring spec recommends a 1-second part target, keyframes every 2 seconds, and a part hold-back of at least three parts. A media playlist then looks like this:

#EXTM3U
#EXT-X-TARGETDURATION:6
#EXT-X-SERVER-CONTROL:CAN-BLOCK-RELOAD=YES,PART-HOLD-BACK=3.0
#EXT-X-PART-INF:PART-TARGET=1.0
#EXT-X-PROGRAM-DATE-TIME:2026-10-17T15:42:11.000Z
#EXTINF:6.000,
seg2841.mp4
#EXT-X-PART:DURATION=1.000,URI="seg2842.0.mp4",INDEPENDENT=YES
#EXT-X-PART:DURATION=1.000,URI="seg2842.1.mp4"
#EXT-X-PRELOAD-HINT:TYPE=PART,URI="seg2842.2.mp4"

Three things to check before match day:

1. Every segment starts on a keyframe. Pick a GOP that divides the segment: 2-second GOPs for 6-second segments.
2. The CDN holds blocking requests. Ask your CDN for its LL-HLS support in writing, then test it with a real player at the edge, not the origin.
3. Measure glass to glass. Burn a clock into the picture at the venue, film it next to a phone, and compare. A dashboard number from the encoder misses the player buffer, which is the biggest stage.

For low-latency DASH, the equivalent is a target latency in the manifest and segments that are shorter than it, as the DASH-IF guidelines require:

<ServiceDescription id="0">
  <Latency target="4000"/>
</ServiceDescription>
<SegmentTemplate timescale="1" duration="2"
  availabilityTimeOffset="1.5" availabilityTimeComplete="false"
  media="v-$Number$.m4s" initialization="v-init.mp4"/>

And for the contribution link from the venue, set SRT latency to about four round trips. With an 80 millisecond round trip:

srt-live-transmit "srt://:9000?mode=listener&latency=320" udp://127.0.0.1:5000

The latency value is in milliseconds, and the default in live mode is 120.

What latency do live sports, auctions and betting need?

My rule: match the latency to the moment the viewer acts. Here is the checklist I use.

• Live sports. Match the TV, 3 to 6 seconds, with LL-HLS or LL-DASH. Fans hear the neighbours cheer and get score alerts on their phone. A stream 20 seconds behind is a spoiler machine.
• Betting. Under a second, with WebRTC. If a viewer bets on what they see, the picture must not lag the odds. Bitmovin’s survey names WebRTC as the tool of choice for auctions and sports betting.
• Auctions. Under a second, with WebRTC. Every bidder has to see the same lot at the same moment, or the late ones lose.
• Concerts. Standard HLS is often fine. Nobody at home knows the band is 20 seconds ahead, and a big buffer keeps the picture clean on bad Wi-Fi. Go low latency only when fans interact live: chat the artist reads, votes, or shout-outs.
• Interactive shows and quizzes. WebRTC for anyone on stage or on camera, LL-HLS for the audience at scale. Stamp the stream with EXT-X-PROGRAM-DATE-TIME, which the low-latency profile requires anyway, and close each viewer’s vote against their own picture, so a slower phone still gets a fair answer window.

Those last two are where live streaming meets the platforms I build now: fan engagement platforms with games and rewards timed to the show, and live shows in 3D worlds, where the audience in the room and the audience on video have to see the same beat.

Questions people ask

What is low latency streaming?

Live video delivered with a delay of a few seconds or less from the event to the screen, usually with LL-HLS, LL-DASH or WebRTC. Standard streaming runs 10 to 30 seconds behind.

What is the lowest latency streaming protocol?

WebRTC, at under a second. LL-HLS and LL-DASH reach broadcast TV’s range of a few seconds while keeping CDN scale. SRT is low latency too, but it is for contribution from the venue, not for viewers.

Why is my live stream delayed?

The player waits for about three whole segments before it plays, so 6-second segments add 18 seconds on their own. Encoding and the CDN add a few more.

Is LL-HLS better than WebRTC?

For a big audience watching, yes: it is cheaper and scales on ordinary CDNs. For viewers who bid, bet or talk back, WebRTC is better, because a second matters more than cost.

What is glass-to-glass latency?

The time from light hitting the camera lens to light leaving the viewer’s screen. Measure it with a clock in the shot and a phone beside it, because it includes the player buffer that server dashboards miss.

If you need a live stream, fan platform or interactive show built with the right latency, write to me at m@tawfik.tv.

The fix is the same for every agent: take away what it should never touch, make it ask before anything it cannot undo, cap what it can spend, and keep a record you can check afterwards.

Developers already sense the risk. In the Stack Overflow 2025 Developer Survey (July 2025), 81% of respondents said they have concerns about the security and privacy of data when using AI agents, and 87% worried about the accuracy of what agents tell them.

What has actually gone wrong?

These are first-hand reports, linked to the people who filed them.

• Replit, July 2025. SaaStr founder Jason Lemkin posted that Replit’s agent deleted his entire database during a code freeze. The agent then told him a rollback was impossible; it worked. Replit’s CEO called it “unacceptable and should never be possible” and started separating development and production databases automatically.
• Gemini CLI, July 2025. A user asked it to organise the files in a folder. A failed folder creation turned a series of moves into lost files (GitHub issue 4586). The session ran with no sandbox.
• Claude Code, October 2025. A user reported a recursive delete that started from the root and removed every file they owned in their home directory before they could interrupt it (GitHub issue 10077).
• Cursor, July 2026. A user asked the agent to clone a repository. It ran recursive delete commands that, by their account, removed hundreds of thousands of files across the C: drive (Cursor forum).

Different agents, one pattern: the agent was allowed to run the command, and nothing stood between its decision and the command.

Why doesn’t telling the agent “don’t” work?

A prompt is a request, not a control. Lemkin had told his agent to freeze the code. Agents also make ordinary mistakes at machine speed: a path variable that is empty in a new shell, a quote in the wrong place, a cleanup step aimed one folder too high. The control has to sit outside the model, in permissions, credentials and a check that runs before the action.

How do I stop an AI coding agent deleting files?

Do these today, in this order. None of them needs new software.

1. Turn on approvals and block destructive commands. Every major agent has a setting for this. Never run with approvals switched off on a machine that holds real work.

# Claude Code: .claude/settings.json in the project
{ "permissions": {
    "ask":  ["Bash(rm *)", "Bash(git push *)", "Bash(psql *)"],
    "deny": ["Read(./.env)", "Read(./.env.*)"] } }

# Cursor: Settings > Agents > Approvals & Execution
#   Run mode: Allowlist (not Run Everything)
#   Turn on File-Deletion Protection and External-File Protection

# Codex: ~/.codex/config.toml
sandbox_mode = "workspace-write"
approval_policy = "on-request"
[sandbox_workspace_write]
network_access = false

# Gemini CLI: ~/.gemini/policies/guard.toml
[[rule]]
toolName = "run_shell_command"
commandPrefix = ["rm", "git push", "psql"]
decision = "ask_user"
priority = 100

Sources: Claude Code permissions, Cursor run modes, Codex config reference, Gemini CLI policy engine.

2. Give the agent its own read-only database user. An agent that only needs to read data should not hold a password that can drop a table.

-- Postgres
CREATE ROLE agent_ro LOGIN PASSWORD 'a-long-random-one';
GRANT CONNECT ON DATABASE app TO agent_ro;
GRANT USAGE ON SCHEMA public TO agent_ro;
GRANT SELECT ON ALL TABLES IN SCHEMA public TO agent_ro;
ALTER DEFAULT PRIVILEGES IN SCHEMA public GRANT SELECT ON TABLES TO agent_ro;
ALTER ROLE agent_ro SET default_transaction_read_only = on;

3. Keep production keys out of the agent’s reach. Use separate credentials for development, keep the production ones out of the project folder, and deny reads of .env files as in step 1.

4. Point the agent at staging, never production. Separate development and production databases is the fix Replit shipped. A branch database or a nightly copy does the same job.

5. Keep backups you have restored at least once. A backup you have never restored is a guess. Run pg_dump --format=custom on a schedule, restore it into a scratch database once, and turn on point-in-time recovery if your host offers it.

6. Protect the main branch. Commit before you let an agent loose, and switch on branch protection so a force-push to main is refused by the server, whatever the agent does locally.

7. Cap the spend. Set a limit in your model provider’s console, and see the per-minute cap below.

What is an AI agent guardrail?

A guardrail is a check that runs outside the model, before the action, and gives one of three answers: allow, deny, or stop and ask a person. Steps 1 to 6 are static guardrails. I built a live one: GVNR, a free, source-available, self-hosted guard that runs on your own machine (code on GitHub; licensed FSL-1.1-ALv2, so it becomes Apache 2.0 two years after each release). It plugs into Claude Code, Cursor, Codex, Gemini CLI and any other MCP client. Where an agent offers a hook that runs before each tool call, the guard enforces the answer; it is wired for Claude Code’s hook today. Over MCP the agent has to ask, so the hook is the stronger route.

Its default rules deny piping a script from the internet into a shell, and ask before deleting a whole tree, rewriting git history, reading or writing credentials, or publishing and deploying. It stops an agent that repeats the same action four times in its last eight, and it asks when spend passes $2 a minute or 75% of the agent’s limit.

The demo below uses those exact rules and messages. Note what it does with DROP TABLE: nothing, until you add a rule. A guard only knows what you tell it.

Open the interactive diagram on tawfik.tv

To add the database rule to the guard, put a rules list in governor.config.json. It replaces the defaults, so copy the six from src/policy.mjs and add this one:

{ "name": "drop or empty a table", "tool": "",
  "match": "\\b(drop\\s+(table|database|schema)|truncate\\s+(table\\s+)?\\w)",
  "action": "ask" }

What should an AI agent audit trail record?

Enough to answer an auditor’s four questions without reading prose: who the agent acted for, what it tried to do, which rule answered, and what the answer was. My guard records the agent, the person it acts for, the tool, the model, the rule, the verdict, the reason, the spend so far and the time. Each line also carries a hash of the line before it, so editing or deleting any past line breaks the chain from that point on, and a single check shows where.

How do I cap an AI agent’s spend?

Use two kinds of limit. A total per agent or per day stops slow leaks. A per-minute limit stops runaways, which are the expensive incidents: by the time a daily cap notices, the day’s money is gone. The guard’s defaults are $20 per agent, a question at 75% of that, $2 a minute per agent and $10 a minute across all of them. Each speed alarm asks once rather than killing the work, so an overnight run pauses and waits for you.

I build these controls into products as part of my forward deployed work. If you are connecting agents to tools over MCP, the MCP security checklist covers that side.

Questions people ask

Can an AI agent delete my database?

Yes, if it holds credentials that allow it. Give the agent a read-only user, point it at staging, and keep tested backups. Then a mistake costs you an afternoon, not your data.

How do I stop Claude Code, Cursor, Codex or Gemini CLI deleting files?

Keep approvals on, put rm, git push and database clients on the ask list, block reads of .env files, and use the sandbox where the agent has one. The settings for all four are in step 1.

What is an AI agent guardrail?

A check outside the model that runs before each action and answers allow, deny or ask a person. Prompts are not guardrails, because the model can ignore them.

What should an agent audit trail record?

Who the agent acted for, the exact action, the tool, the model, the rule that answered, the verdict and the time, with each line chained to the one before so edits show.

How do I cap an AI agent’s spend?

Set a total limit in your provider’s console and a per-minute limit in front of the agent. The per-minute one catches a runaway in its first minute.

If you need guardrails like these built into your product or team, write to me at m@tawfik.tv.

Ofcom is enforcing it. Its implementation update, last revised 28 July 2026, says it had opened investigations into nearly 100 services.

I’ve built identity products three times around one rule: prove the fact, not the person. This page covers the law from a builder’s side: who’s in, what you owe, what Ofcom has fined, and what to do this month. It isn’t legal advice; for a decision that matters, ask a lawyer who knows the Act.

Does the Online Safety Act apply to my website?

Yes, if your service is one of three kinds the Act covers and it has links with the UK.

1. User-to-user services. Anything where content one user posts, uploads or shares can be seen by another: social apps, forums, marketplaces, dating apps, game chat, file sharing, group messaging. Section 3 says the feature only has to exist, however little it’s used.
2. Search services. A search engine that searches more than one website or database. Search across just your own site doesn’t count, per section 229.
3. Porn providers. Services that publish porn themselves, including porn made by their own AI tool, under Part 5.

The UK link. Section 4 counts a significant number of UK users, or the UK as a target market. It also catches any service people in the UK can use when it presents a material risk of significant harm to them. Ofcom fined an overseas suicide forum £950,000 in May 2026, noting it could still be reached from the UK without a VPN.

Who’s out. Schedule 1 exempts services where users can only share email, SMS or one-to-one voice calls, and services where users can only comment on, review, like or rate your own content. A blog with comments under your posts is usually out.

Describe your service below to get the duties that apply, their dates and a to-do list.

Open the interactive diagram on tawfik.tv

Ofcom runs its own Regulation Checker too. Use both and keep the answer in writing.

What does the Online Safety Act make you do?

Five duties carry most of the weight. Each assessment must be “suitable and sufficient”, with a written record.

1. Illegal content risk assessment (section 9, or section 26 for search). How could your features be used for illegal content such as terrorism, child sexual abuse or fraud? Then reduce those risks, take illegal content down quickly once you know about it, and say in your terms how you protect people.
2. Children’s access assessment (section 35). Can children get in, and do enough of them use it, or would it attract them? You may only answer “children can’t get in” if age verification or estimation means children are not normally able to. Repeat it at least yearly, under section 36.
3. Children’s risk assessment (section 11). If children are likely to use it, assess the risk from content harmful to them, then protect them from it.
4. Highly effective age assurance, where required. If children are likely to use it and you allow porn, or content encouraging suicide, self-harm or eating disorders, section 12 requires age checks. Porn providers must check every visitor, keep a written record and publish a summary of their checks, under section 81.
5. Report child sexual abuse content to the National Crime Agency (section 66), for user-to-user services.

One rule runs through them all: assess again before any significant change to how the service works.

Which Online Safety Act dates are already in force?

From Ofcom’s important dates page and roadmap:

• 17 January 2025: porn providers must use highly effective age assurance.
• 16 March 2025: illegal content risk assessments due. Safety duties enforced from 17 March.
• 16 April 2025: children’s access assessments due.
• 24 July 2025: children’s risk assessments due. Children’s safety codes in force from 25 July.
• 7 April 2026: user-to-user services must report child sexual abuse content to the NCA.
• 10 July 2026: Ofcom published the register of categorised services, the small group that gets extra duties.

A service launched since then has three months from launch for its first illegal content risk assessment and children’s access assessment, per Schedule 3. Next: the government plans to stop social media services offering accounts to under-16s, with regulations laid by the end of 2026 and in force in spring 2027.

What has Ofcom fined so far?

Fines can reach £18 million or 10% of qualifying worldwide revenue, whichever is greater. Actual ones, from Ofcom’s announcements:

• 4 December 2025: AVS Group Ltd, £1 million. It had what it called age verification; Ofcom didn’t consider it highly effective. Plus £50,000 for ignoring information requests.
• 17 December 2025: a file-sharing service, £20,000, for ignoring information requests.
• 23 February 2026: 8579 LLC, £1.35 million for no age checks.
• 19 March 2026: 4chan, £450,000 for no age checks, £50,000 for no illegal content risk assessment and £20,000 for its terms of service.
• 13 May 2026: a suicide forum’s provider, £950,000.
• 9 July 2026: the provider of fapello.com, £600,000 for no age checks, plus £30,000 for a late answer.

Open investigations show where it’s heading. TikTok, since 16 July 2026, over whether its age checks spot children. Aylo, Pornhub’s provider, since 23 September, over a check relying on signals from Apple: the provider stays responsible, wherever the check happens. Meta, since 6 October, over whether it risk assessed a new Instagram feature before launch.

What counts as highly effective age assurance?

Ofcom’s guidance of 16 January 2025 judges every check on four criteria: technically accurate, robust, reliable and fair. Seven kinds can meet them: open banking, photo ID matching, facial age estimation, mobile network checks, credit card checks, digital identity services and email-based age estimation.

Three can’t: users stating their age, payment methods that don’t require the user to be 18, such as debit cards, and terms saying children aren’t allowed. The check must come before any harmful content shows, and you mustn’t point children to ways round it, such as VPNs.

Which method to pick, what each gives away and what it costs is in my guide to proving age without ID.

What should you do this month?

1. Write down whether you’re in scope, and why. Date it and keep it.
2. Find your illegal content risk assessment. No record means no assessment, and 4chan paid £50,000 for that.
3. Write your children’s access assessment. If it says children can’t get in, keep evidence your age check is highly effective.
4. Gate your releases. No significant feature ships before both assessments are updated.
5. Test your age check against the four criteria, including any check a third party runs for you.
6. Name one person for Ofcom’s information requests. A missed deadline is a separate fine.
7. If users can post, register with the NCA’s reporting portal.
8. If you run anything like social media, plan for the under-16 rules.

How I’d build age checks into a product

The law asks one question, is this user a child, and most checks answer it by collecting a passport or a face. That builds the thing you least want to hold: a database of IDs.

I led a credential product where nurses and doctors prove their licences to employers: each licence is checked once at the source, sealed to the professional’s own key, and shared field by field. It’s one of the builds in my forward deployed engineer write-up. At PLAYERUNKNOWN Productions I designed a zero-knowledge ID: the game learns a player is real without learning who they are. The long version is How to prove who someone is without seeing who they are.

For an Online Safety Act build, the same rules: ask for one fact, keep the yes and delete the rest, record why you chose the method, and assess again before every change.

Questions people ask

Does the Online Safety Act apply to websites outside the UK?

Yes, if UK users are a significant number or a target market, or if people in the UK can use it and it presents a material risk of significant harm to them. Ofcom has fined providers based outside the UK.

Does the Online Safety Act apply to small websites?

Size doesn’t take you out: a small forum or app where users post or message each other is in scope. The government says duties are proportionate to risk and to each provider’s size and capacity.

Do I need age verification on my website?

If you publish porn, yes. If children are likely to use your service and you allow porn, or content encouraging suicide, self-harm or eating disorders, yes. Otherwise the assessments still apply, but age checks may not.

When did age verification start in the UK?

For sites that publish porn, 17 January 2025. For user-to-user and search services that must protect children, 25 July 2025.

What is the fine for breaking the Online Safety Act?

Up to £18 million or 10% of qualifying worldwide revenue, whichever is greater. Fines so far run from £20,000 to £1.35 million, plus daily penalties until a provider complies.

Can you help my company comply?

I design and build the product side: age checks that collect one fact, the records behind them and the release gates, as a fractional CPO or hands on. If you need this built, write to m@tawfik.tv.

The standard is settled. The W3C published Verifiable Credentials Data Model 2.0 as a Recommendation on 15 May 2025, and Europe’s member states must offer every citizen a digital identity wallet that holds credentials like these by 2026.

I’ve built identity products three times around one rule: prove the fact, not the person. The long version, with all three builds, is in How to prove who someone is without seeing who they are. This page is the plain guide to the format underneath.

What are verifiable credentials?

A verifiable credential is a set of claims about someone, such as “Hannah Clarke is a registered nurse, licence active until March 2027”, with a digital signature from the body that made those claims. Three parties are involved, and the W3C standard names them:

1. The issuer makes the claims and signs them: a nursing board, a university, a government.
2. The holder keeps the credential, usually in a wallet app, and decides when to show it: the nurse.
3. The verifier receives it and checks it: the hospital.

The verifier never has to phone the issuer. The signature carries the proof.

How does a verifiable credential work?

Four steps, from issue to check.

1. Issue. The nursing board checks Hannah’s licence against its own register, puts the facts into a credential and signs it with its private key. Only the board has that key.
2. Hold. The credential lands in a wallet on Hannah’s phone.
3. Present. A hospital asks for her licence. Her wallet shows what is asked for, and she picks the fields to send.
4. Verify. The hospital runs three checks. Is the signature valid against the board’s public key? Is the board on the list of issuers the hospital trusts? Has the board revoked the licence since?

The third check is the clever one. Under the W3C Bitstring Status List, a Recommendation since 15 May 2025, the issuer publishes one long list of bits, at least 131,072 of them, and each credential points at one position. A 0 means fine, a 1 means revoked. The verifier downloads the whole list, so the issuer never learns whose credential was checked.

The hospital finds the board’s public key through a decentralised identifier, a DID: an identifier that needs no central registry, a W3C Recommendation since 19 July 2022. did:web:nursing-board.example simply points at a file on the board’s own website.

Try it below. Pick what the hospital sees, then try to cheat: change the expiry date, sign it with your own key, or have the board suspend the licence. Each one breaks a different check.

Open the interactive diagram on tawfik.tv

What does a verifiable credential look like?

It is a small JSON file. This example comes from the W3C specification, unchanged:

{
  "@context": [
    "https://www.w3.org/ns/credentials/v2",
    "https://www.w3.org/ns/credentials/examples/v2"
  ],
  "id": "http://university.example/credentials/58473",
  "type": ["VerifiableCredential", "ExampleAlumniCredential"],
  "issuer": "did:example:2g55q912ec3476eba2l9812ecbfe",
  "validFrom": "2010-01-01T00:00:00Z",
  "credentialSubject": {
    "id": "did:example:ebfeb1f712ebc6f1c276e12ec21",
    "alumniOf": {
      "id": "did:example:c276e12ec21ebfeb1f712ebc6f1",
      "name": "Example University"
    }
  }
}

issuer is who signed it, credentialSubject is who it is about and what is claimed, and validFrom is when it starts. The signature is added on top. To make it revocable, the issuer adds a status entry, as in the Bitstring Status List spec:

"credentialStatus": {
  "id": "https://example.com/credentials/status/3#94567",
  "type": "BitstringStatusListEntry",
  "statusPurpose": "revocation",
  "statusListIndex": "94567",
  "statusListCredential": "https://example.com/credentials/status/3"
}

What is selective disclosure?

Selective disclosure lets the holder show some fields and keep the rest back, while the verifier can still check that each shown field was signed by the issuer. In the common formats, the issuer signs a list of sealed fingerprints, one per field, and the holder opens only the ones the verifier needs. That is how the hospital in the demo gets name, licence, status and expiry, and never sees the date of birth or home address.

Prove the fact, not the person has a hands-on sealed envelope demo, and how to prove you’re over 18 without showing your ID covers SD-JWT and zero-knowledge proofs, where the verifier learns only “yes”.

How is a verifiable credential different from a PDF certificate or a database lookup?

• A PDF certificate is a picture of a claim. Anyone can edit it, and the only real check is to call the issuer.
• A database lookup is accurate, but the verifier has to reach the issuer’s system every time, the issuer sees every check, and each issuer has its own website and format.
• A verifiable credential is checked by maths, in seconds, with no call to the issuer. The issuer learns nothing about where it was used. The holder carries it from job to job, and a change to any signed field makes it fail.

Verifiable credentials vs KYC software: which do you need?

KYC software and identity verification software check a person from scratch, usually with a document scan, a liveness check and a face match, priced per check: list prices for a full ID check ran from $0.33 to $1.89 when I compared vendors in the age verification guide. A verifiable credential is what can come out of a check like that: the result, signed by whoever did it, so the next verifier checks a signature instead of running the whole check again. So the two fit together. Use KYC software where you must know the person for the first time, such as when money moves, and issue or accept a credential so they do not repeat it at every stop. I build the credential side, the issuer, the wallet and the verifier; I do not sell KYC software.

Which standards matter in 2026?

• W3C Verifiable Credentials Data Model 2.0, Recommendation, 15 May 2025: the shape of the credential and the three roles.
• W3C DID 1.0, Recommendation, 19 July 2022: how a verifier finds the issuer’s public key.
• OpenID for Verifiable Credential Issuance 1.0, approved as a Final Specification, announced 16 September 2025: how an issuer delivers a credential into a wallet.
• OpenID for Verifiable Presentations 1.0, Final, 9 July 2025: how a verifier asks a wallet for credentials. It works with W3C credentials, ISO mdoc and SD-JWT VC.
• ISO/IEC 18013-5, published 30 September 2021: the mobile driving licence, a different format built on the same issuer, holder and verifier model.

Where are verifiable credentials used now?

• Education. 1EdTech’s Open Badges 3.0 aligns with the W3C Verifiable Credentials Data Model 2.0 for achievements and skills.
• Health workforce. The NHS has been building a Digital Staff Passport on the W3C data model, starting with doctors in training, so staff can move between NHS organisations without repeating the same paperwork and checks.
• Age. The EU’s age verification blueprint gives people a proof of age held on their phone, and Ofcom counts digital identity services among the methods that can be highly effective under the Online Safety Act. The Online Safety Act guide covers who must check, and the age proof guide covers how.
• Travel. Apple launched Digital ID on 12 November 2025, an ID in Apple Wallet made from a U.S. passport, rolling out first in beta at TSA checkpoints in more than 250 U.S. airports. Apple says only the information needed for a transaction is presented.
• Government ID. The EU Digital Identity Regulation entered into force on 20 May 2024. The Commission says the wallets will hold driving licences, diplomas and bank accounts, and let people choose which parts they share.

How do you build a verifiable credentials system?

1. Pick the one claim. “Licence active” or “over 18”, not a whole file. Decide who issues it and who will check it.
2. Build the issuer. It checks the facts at the source, signs the credential with a key it guards, publishes its public key (a did:web file is the simplest start), gives every credential a slot in a status list, and hands it to the wallet over OpenID4VCI.
3. Choose the wallet. Use one people already have, such as a national EU wallet, or build your own app when the credential lives in your product. Bind each credential to a key on the device, so a copied file is useless without the phone.
4. Build the verifier. It asks for named fields over OpenID4VP and runs the checks from the demo: signature, trusted issuer, status, expiry, and that the holder’s own key signed this presentation.
5. Plan the boring parts first. Revocation, re-issue when a phone is lost, rotating the issuer’s key, and what the verifier does when the status list is out of date.

I led a credential passport app for clinicians: a licence nurses and doctors share without their whole file. Licences are verified against the issuing authority, the clinician ticks which fields each employer gets, names the one recipient, and can revoke the share at any time. Before that, at PLAYERUNKNOWN Productions, I designed a zero-knowledge player ID, where the game learns a player is real and not who they are, and at NOR, where I led technology, we built a game login on Holochain that never touched the player’s keys. All three are written up in prove the fact, and the clinician app also appears in forward deployed engineer: four AI and fintech builds.

Questions people ask

Are verifiable credentials on a blockchain?

They don’t need one. Checking a credential needs the issuer’s public key and its status list, and both can sit on an ordinary website.

What is the difference between a verifiable credential and a digital ID?

A digital ID is one kind of verifiable credential: claims about who you are. A licence, a degree or a proof of age are credentials too, and one wallet can hold many.

Can verifiable credentials be used for KYB verification?

For the result, yes; the check itself still has to happen. KYB verification confirms who owns a business, what it does and where its money comes from, usually through a licensed partner or a KYB provider. Once that is done, the outcome can be issued as a credential, so the next bank or partner checks one signature instead of collecting the same documents again. Proving facts about a business without handing over its whole file is the idea behind prove the fact, not the person.

Is a mobile driving licence a verifiable credential?

In the general sense, yes: the same issuer, holder and verifier model, in the ISO mdoc format rather than the W3C one. OpenID4VP can request both.

Can a verifiable credential be revoked?

Yes. The issuer flips the credential’s bit in its published status list, and the next verifier that checks sees it. The copy in the wallet doesn’t change, which is why verifiers must check the list.

Do you build this?

Yes. I design and build credential and identity products end to end, as a fractional CPO or hands on. If you need verifiable credentials issued, held or checked, write to m@tawfik.tv.

The hype is ahead of the results. Gartner predicts that over 40% of agentic AI projects will be canceled by the end of 2027, because of escalating costs, unclear business value or inadequate risk controls (Gartner, 25 June 2025). The same release estimates that only about 130 of the thousands of agentic AI vendors are real, and warns of “agent washing”: chatbots and automation tools rebranded without real agentic capabilities.

I build agents and the guardrails around them at Instruxi. This is what I tell teams before they ship one.

What is agentic AI?

Agentic AI is an AI model running in a loop with tools. Each turn of the loop has four parts:

1. Plan. The model reads the goal and decides the next step.
2. Act. It calls a tool: look up an order, search flights, run a database query, send an email.
3. Check. It reads what the tool returned.
4. Repeat. It decides whether the job is done, or what to try next.

Compare that with what people usually mean by “AI”:

• A chatbot answers questions. You read the answer and take the action yourself.
• A single AI call takes one input and gives one output: summarise this email, classify this ticket. Your code decides what happens next.
• An agent decides what happens next itself, including which tool to call and when to stop.

There is a middle ground. Anthropic’s engineering guide separates workflows, where “LLMs and tools are orchestrated through predefined code paths”, from agents, where “LLMs dynamically direct their own processes and tool usage” (Building effective agents, December 2024). Gartner makes the same point: many use cases positioned as agentic today don’t need to be. A workflow with one or two AI steps is often enough.

What is agentic AI used for in business?

Agents earn their cost where the steps change from case to case and a person would otherwise click through several systems:

• Customer support. Read the ticket, look up the order and payments, answer or hand over. I set up an AI help desk for a fintech platform. I bought the agent instead of building one, wrote the help centre it answers from, and held one rule: the agent can read and explain, and it can never change an account. When I asked it to send a customer’s cash-out to a third party, it refused and passed the conversation to a person. The full setup is in AI customer service agent: what it can safely do.
• Back office. Match invoices to purchase orders, chase missing paperwork, prepare refunds for approval.
• Travel and expenses. Find options inside the policy, book, file the receipts.
• Software. Coding agents in a terminal: Claude Code, Cursor, Codex and Gemini CLI read the code, run commands and edit files.

How much does it cost to run an AI agent?

You pay per token, the chunks of text the model reads and writes. List prices on 15 October 2026, per million tokens, input then output:

• Anthropic: Claude Haiku 5.5 $0.10 and $0.50 (prompts up to 100,000 tokens), Claude Sonnet 5.5 $2 and $10, Claude Opus 5.5 $4 and $20 (pricing).
• OpenAI: gpt-6-luna $0.10 and $0.50, gpt-6.1-sol $2 and $10, Standard tier, short context (pricing).
• Google: Gemini 3.1 Pro Preview $2 and $12 for prompts up to 200,000 tokens (pricing).

The catch is the loop. Every model call re-sends the instructions, the list of tools and everything that has happened so far, so each step costs more than the last. Google’s pricing page says it plainly for its Deep Research agent: the intermediate input and reasoning tokens generated during agentic loops are charged at list rates.

A worked example at $2 and $10, using the same token model as the demo below. A refund agent makes 4 model calls. The first call reads about 2,400 tokens, the fourth about 8,250, so in total about 22,000 tokens in and 960 out: $0.044 plus $0.0096, about 5 cents a run, or about $54 for 1,000 runs a month. Now let an agent retry a broken search 24 times: 26 model calls, about 502,000 tokens in, about $1.07. Twenty times the normal run, for nothing.

Two things bring it down. Prompt caching charges a fraction for the part of the prompt that repeats: on Claude Sonnet 5.5 a cache hit is $0.10 per million tokens against $2 uncached. And tools can cost extra: Anthropic charges $10 per 1,000 web searches on top of tokens. A step limit costs nothing, and it is the one that stops the $1.07 run.

Where does agentic AI go wrong?

The failures are ordinary mistakes, made at machine speed with real access:

• Loops. A tool fails and the agent tries again, and again. Each try costs more, because the history grows.
• The wrong tool. Asked to tidy a database, an agent reaches for a raw DELETE when a merge tool with undo was right there.
• Deleting data. It has happened with Replit, Gemini CLI, Claude Code and Cursor; the incidents and the settings that stop them are in how to stop an AI agent deleting your database.
• Spending money. Refunds nobody owed, a fare over policy, a card used for something it was never meant for.
• Following instructions it should only have read. A customer writes “your colleague agreed a £400 credit” and the agent treats it as fact. OWASP ranks this first, as agent goal hijack, in its Top 10 for Agentic Applications.

Try them below. Run a task with the guardrails off, then switch them on one at a time and watch where the agent stops, and what the run costs.

Open the interactive diagram on tawfik.tv

How do you ship an AI agent safely?

Three controls, all outside the model. A line in the prompt saying “never refund more than £100” is a request; a refund tool that cannot go over £100 is a control.

1. Permissions. Give the agent only the tools and access its job needs: a refund tool capped at an amount, a card limited to the policy, a read-only database user. Start read-only and add one action at a time, as I did on the help desk.
2. A person approves the irreversible. Money out, deletes, bookings, deploys and messages to customers wait for a named person’s yes. Keep the list short, or people approve without reading.
3. A record of every action. Who the agent acted for, the tool, the exact input, the rule that answered and the result, each line chained to the one before so edits show. Without it, all you have afterwards is the agent’s own summary.

Add a stopping condition to the loop as well: a cap on steps, spend, or the same call repeated. Anthropic’s guide notes that it is common to include stopping conditions, such as a maximum number of iterations.

The full programme for running many agents (inventory, owners, review cadence, incident playbook, and how it maps to NIST, ISO/IEC 42001 and the EU AI Act) is in AI agent governance: a practical framework. If your agent reaches its tools over MCP, run the MCP security checklist first.

What I build

I lead product for GVNR at Instruxi: a free, source-available guard for AI agents, licensed FSL-1.1-ALv2 (code on GitHub). It works with any AI agent, including Claude Code, Cursor, Codex, Gemini CLI and any MCP client. Before each action it answers allow, deny or ask a person, and it keeps a hash-chained record of every decision. Its defaults stop an agent that repeats the same action four times in its last eight, and ask when spend passes $2 a minute or 75% of a $20 cap. The step limit in the demo above uses that rule.

The same pattern runs through my forward deployed work, such as a bank-in-a-box demo where a checkpoint opens or holds a customer’s money with a plain-English reason, from 11 ordered rules. An agent that can act needs something that decides first.

Questions people ask

What is agentic AI in simple terms?

AI that does a task for you instead of only answering: it plans the steps, uses tools, checks the result and keeps going until the job is done.

What is the difference between agentic AI and a chatbot?

A chatbot answers and you act. An agent acts: it calls tools that look things up, change records, send messages or spend money, so it needs permissions and limits.

How much does it cost to run an AI agent?

A few cents per run for a short task on a mid-priced model, about 5 cents in my example at $2 and $10 per million tokens. Loops are the risk: one runaway run in my example cost twenty times a normal one.

Is agentic AI safe for a business?

Yes, if the agent holds only the access its job needs, a person approves anything irreversible, and every action is recorded. Without those three, a mistake runs at machine speed.

If you need an agent designed and shipped with these guardrails, write to me at m@tawfik.tv.

The job it covers is large. US employers had about 947,500 receptionist jobs in 2025, 42% of them in healthcare and social assistance, and the Bureau of Labor Statistics expects that number to fall 2% by 2035, partly because organisations “continue to automate or consolidate administrative functions”.

I set up an AI help desk for a fintech platform with one rule: the agent can read and explain, and never change an account. I also build online booking with Wallet stamp cards for local businesses. A phone agent talks like the help desk and writes into the booking calendar, so it needs the limits of both.

What is an AI receptionist?

It is an AI agent whose only channel is a phone call. The four jobs it does well:

• Answers every call, after hours and when two lines ring at once.
• Books, moves and cancels appointments in the calendar your staff already use.
• Answers routine questions from your own notes: prices, opening hours, parking, what to bring.
• Routes and takes messages: an emergency goes straight to a person, a sales question becomes a message with a callback number, and the team gets a written summary of every call.

“AI voice agent” is the wider term: the same parts can make reminder calls or run a sales line. If your customers mostly write to you, the chat version is in AI customer service agent, and putting a bot on your site is in AI chatbot for your website.

How does an AI voice agent work?

Five parts run in a loop for every turn of the conversation:

1. Telephony. Your number forwards to the vendor, or you take a new number from them. The call arrives as audio.
2. Speech to text. The caller’s words become text as they speak.
3. The model. It reads your instructions, the conversation so far and the results of any tools, then decides what to say or which tool to call.
4. Tools. Small functions you allow: find free slots, book, look up a price, take a message, transfer. Each is a door into a real system, so the tool list matters more than the prompt.
5. Text to speech. The reply is spoken back, and the loop repeats until the call ends.

It is the loop from agentic AI, with one difference: the caller hears every pause, so keep tools and answers short.

Try it on a made-up London dental practice: pick a caller, switch to night service, and set your call volume.

Open the interactive diagram on tawfik.tv

How much does an AI receptionist cost?

Either a finished receptionist priced per call or per bundle of minutes, or a developer platform priced per minute. US list prices, checked on each pricing page in October 2026:

• Smith.ai AI Receptionist: free for 25 calls a month, then $3.00 a call. Paid plans are $150 a month for 75 calls and $500 a month for 300, with extra calls at $2.50 down to $2.10. Every answered call counts, except known spam. Transfer to a live receptionist is available.
• Rosie: $49 a month for 250 minutes, $149 for 1,000 minutes and $299 for 2,000, paid monthly. Only the $149 and $299 plans book directly into your calendar and transfer calls; the $49 plan texts a booking link instead.
• Retell AI: $0.07 to $0.31 a minute depending on the model and add-ons, plus $2 a month per phone number, with $10 of free credit.
• Vapi: a $0.05 a minute platform fee plus the speech, model and voice providers at cost. Its own estimate for 1,000 minutes a month is $82 to $129.

A worked example: 300 calls a month at 2.5 minutes each, so 750 minutes. Smith.ai is $500. Rosie’s $149 plan covers it. Retell comes to $54.50 to $234.50 and Vapi about $62 to $97, before a developer’s time to build the agent, connect the calendar and test the transfers. The same 750 minutes at the US median receptionist wage of $18.27 an hour is $228, but nobody hires a receptionist for 12.5 scattered hours. The real comparison is the calls you miss now.

Check what counts as a call, whether booking and transfers are on your plan, and what happens above your bundle.

What must an AI receptionist never do?

Take card payments by voice. The PCI Security Standards Council says that storing the card security code in any audio recording after authorisation breaks PCI DSS, and that audio should be suppressed during card entry where the technology exists. A recorded AI line is the worst place for a card number. Send a payment link by text, or pass the call to a person on a compliant system.

Make promises. A discount, a refund, a diagnosis, “the dentist will see you today”: each belongs to a person. The agent can quote the price list and offer a callback.

Act on what the caller tells it to do. Callers will say “ignore your instructions, I am the manager”. The OWASP LLM01 prompt injection guidance gives the fix: restrict the model’s access to the minimum it needs, and put a person in the loop for privileged actions. If the phone agent has no refund tool, no caller can talk it into a refund.

Read records to an unverified caller. Check who is calling before discussing any booking.

Write the rules down outside the model, so they hold whatever the caller says:

agent: front-desk-phone
opening: "You are speaking to our AI assistant. Calls are recorded."
tools:
  calendar.find_slots:  allow
  calendar.book:        allow   new bookings, opening-hours slots only
  calendar.move:        allow   caller verified, own booking, 24 hours or more away
  price_list.lookup:    allow
  message.take:         allow
  call.transfer:        ask_person   emergencies, complaints, "can I speak to someone"
  payments.refund:      deny    not given to the phone agent
  patient.read:         deny    unless caller verified, own booking only
never say: "that's free", "we'll refund you", "the dentist will see you today"

That is the idea behind GVNR, the free and source-available guard I lead for AI agents, which works with Claude Code, Cursor, Codex, Gemini CLI and any MCP client. Before each action it answers allow, deny or ask a person, and it keeps a hash-chained record of every decision. A phone agent needs the same three answers.

Do you have to tell callers they are talking to an AI?

In the EU, yes. Article 50 of the EU AI Act, which applies from 2 August 2026, says a system that talks to people must tell them they are dealing with an AI unless that is obvious. Elsewhere, say it anyway.

Recording is a separate rule. In California, recording a confidential phone call without the consent of all parties can be fined up to $2,500 per violation under Penal Code section 632. Say “calls are recorded” in the opening line, and check the rules where you and your callers are.

If the agent also calls people back, the US Federal Communications Commission ruled in February 2024 that AI-generated voices count as “artificial” voices under the Telephone Consumer Protection Act, so those calls need the called party’s prior express consent unless an exemption applies.

How do you set up an AI receptionist for a small business?

1. List why people call. Go through a week of calls and your missed-call log, and write one answer or action for each reason.
2. Connect the booking calendar your staff already use, with each service’s length and buffers, never a second diary. On my booking and Wallet loyalty builds, every booking lands in one list and a completed visit adds a stamp to the customer’s card; a phone booking belongs in that same list.
3. Set your hours and the night rule. In hours, urgent calls go to the front desk; out of hours, to an on-call number or a message.
4. Name the handover numbers and triggers: emergencies, complaints, anything about money, and anyone who asks for a person. Keep that one step away at all times.
5. Write the opening line: the business name, “AI assistant”, and the recording notice.
6. Test 30 calls before going live, including a caller asking about someone else’s appointment, a refund demand and an emergency.
7. Forward the line in office hours first, with someone reading every summary, then extend to evenings and weekends.

Questions people ask

Is an AI receptionist worth it for a small business?

If you miss calls when staff are busy or closed, usually yes. The plans that book and transfer start around $150 a month, about one 8-hour day at the US median receptionist wage. If you answer nearly every call already, start with after-hours only.

Can an AI receptionist take payments over the phone?

It should not take card numbers by voice. Have it text a secure payment link, or pass the call to a person on a PCI-compliant system.

What is the difference between an AI receptionist and an answering service?

An answering service puts a person on your line. An AI receptionist takes several calls at once and books straight into your calendar, but needs written rules and a person to hand over to.

Will it work with my booking system?

If your booking tool lets other software read and write bookings, often yes. Smith.ai, for example, lists a Calendly integration on every plan; a custom build can connect to any booking tool with an API.

If you want an AI receptionist set up with these limits, or booking and loyalty around it, see AI consulting or booking and Wallet loyalty, or write to m@tawfik.tv.

That is worth getting right, because InstaPay is now how a large part of Egypt pays. By the end of Q2 2026, Egypt’s Instant Payment Network had nearly 22 million registered customers and 1.47 billion processed transactions worth around EGP 4.33 trillion, according to the Central Bank of Egypt.

I built InstaPlug, my own product that does this confirmation for any website, app or AI agent. The same matching runs a dog club’s bookings. Here is how it works, and what happens when customers do the unexpected.

What is InstaPay?

InstaPay is Egypt’s instant payment app. It runs on the Instant Payment Network, a national network linking all banks operating in Egypt, which the Central Bank of Egypt launched on 22 March 2022. The app is published by the Egyptian Banks Company.

The facts that matter for a business, from InstaPay’s own site and the CBE:

• Limits: EGP 70,000 per transaction, EGP 120,000 a day and EGP 400,000 a month, per bank registered in the app.
• Fees: 0.1% of the transfer, at least EGP 0.50 and at most EGP 20, applied from 1 April 2025.
• Addresses: you can receive on your mobile number, your account number, or an Instant Payment Address that looks like name@instapay.
• Status: a transfer is successful, rejected or pending. Pending means the receiving bank will execute it shortly.

Is there an InstaPay API for websites?

Not one you can sign up for as a merchant. I could not find a public merchant API on instapay.eg or on the CBE’s network page. That leaves two routes.

1. A licensed payment provider. Some Egyptian payment companies offer InstaPay inside their checkout. Kashier, for example, lists a QR code or request to pay over InstaPay. You sign up as a merchant, the provider sits in the middle, and you pay its fee.
2. Your own account, confirmed by your bank. The customer sends money straight to your account, as they would to anyone. Your bank already tells you when it lands, by text message. You turn that text into an automatic confirmation.

InstaPlug takes the second route. Nobody sits in the middle and there is no fee on top of InstaPay’s own. One limit I hit in testing: an InstaPay payment link opens the app with your details filled in, but not the amount, so the customer types the amount themselves. That is why the matching has to be careful.

How does automatic InstaPay confirmation work?

Five steps, from order to “Paid”.

1. Create the payment. Your website, your dashboard or an AI agent creates a payment for the price. The customer gets a pay page with the exact amount, copy buttons, your InstaPay number and, on a computer, a QR code to pay from their phone.
2. The customer pays from their own bank app. They send the amount by InstaPay to your number or address.
3. Your bank texts your phone. The phone that gets your account’s alerts forwards the incoming-transfer text to your server. On an iPhone that is one Shortcuts automation. On Android, any text-forwarding app that can post to a web address.
4. The matcher reads the text. It pulls out the amount, the payer’s name and the bank’s reference. Today it reads the Arabic texts from CIB, NBE, Banque du Caire and Banque Misr. Money going out, card withdrawals and one-time codes are ignored.
5. It marks the order paid, once. The pay page turns to “Paid” by itself and your shop gets a signed webhook, so your own system can ship the order or confirm the booking.

Why one amount is not enough

Customers pay the real price by default, because most shops sell at fixed prices. But a friend might send you exactly EGP 750 for something else on the same afternoon. So the exact amount alone never marks an order paid. One of three second signs has to agree:

• The payer’s first name on the bank text matches the customer’s name.
• The customer tapped pay on the pay page (copied the number, opened InstaPay) in the last 30 minutes. This covers a parent or partner paying for someone.
• Unique amounts are on. For busy hours there is a setting where each open order asks a pound or two less, 1 to 2% of the price at most: EGP 749, then 748. If only one order asks that amount, the amount is the proof.

If no sign agrees, the text waits on a check list for a person. It never pays the wrong order on a guess.

What happens when something goes wrong?

Most of the work is in the edge cases. In short:

• Two orders at the same price: names or the “tapped pay” sign decide, or unique amounts keep them apart. With nothing to go on, a person decides.
• The customer pays the wrong amount: within 10% of an open order, the text goes on the check list. Further off, it is treated as personal money and never stored.
• The text arrives late: if the order is still open, it matches when the text lands, and the pay page simply waits. If the link has expired, the text goes on the check list.
• The phone forwards the same text twice: the bank reference is stored once, so the second copy is dropped and the order is paid once.
• Someone sends a fake bank text: texts from ordinary phone numbers are never trusted. Fake “money in” messages come from normal numbers, and real ones come from the bank’s sender name.

Try each one below, with unique amounts on and off.

Open the interactive diagram on tawfik.tv

Can a screenshot prove an InstaPay payment?

No. A screenshot is easy to fake, and a pending transfer can still be rejected. InstaPlug has a “did it arrive?” check for shop counters: the staff snap the customer’s screenshot, it is read on the device without uploading, and checked against the bank texts that really arrived. Each text can vouch for one screenshot only, so the same payment cannot be shown twice. The answer is never “fake”, because texts can be late. Your bank app is the final word.

What do you need to set it up?

• A bank account linked to InstaPay, with incoming-transfer texts going to a phone you control.
• That phone on and online. If it goes offline, payments wait and match when it is back.
• A small server and a Postgres database. You run your own copy, so bank texts and payments stay in your database.
• A webhook in your shop that ships the order or confirms the booking when the signed message arrives.
• Your bank’s terms. Money arrives in your own account like any InstaPay transfer, so check what your bank says about business use. This is not legal advice.

Personal money into the same account stays private: only amounts close to an open order are kept, and only exact ones mark anything paid. Check your bank app now and then, since a text is a notification, not a statement.

The same server can also serve a talking counter screen for shops, staff alerts that never show the balance, and tools for AI agents to create a payment link and check whether it is paid. None of those tools can move money, the same rule I hold to in the guard I built for AI coding agents and in my MCP security checklist.

Questions people ask

Does InstaPay have an API for websites?

There is no public merchant API on InstaPay’s own site. You either go through a licensed payment provider that offers InstaPay in its checkout, or receive into your own account and confirm from your bank’s incoming-transfer texts.

Do I need a payment gateway integration to accept InstaPay?

Only if you want a provider in the middle. A payment gateway integration with a licensed provider that offers InstaPay in its checkout, such as Kashier’s QR code or request to pay, confirms each payment for you, for a fee. Without one, the money lands in your own account, a matcher confirms it from your bank’s texts, and your shop gets a signed webhook. That second route is the one InstaPlug takes.

Can InstaPay payments be confirmed automatically?

Yes. Forward your bank’s “money in” text to a matcher. It marks the order paid when the exact amount matches and a second sign agrees: the payer’s name, the customer tapping pay in the last 30 minutes, or a unique amount.

What is the InstaPay limit for one transaction?

EGP 70,000 per transaction, EGP 120,000 a day and EGP 400,000 a month, per bank registered in the app, according to InstaPay and the Central Bank of Egypt.

Does InstaPay charge fees?

Since 1 April 2025, transfers cost 0.1% of the amount, at least EGP 0.50 and at most EGP 20. Balance checks and mini-statements are EGP 0.50 each, with 10 free a month.

What if two customers pay the same amount?

Each payment needs a second sign: the payer’s name, a recent tap on the pay page, or a unique amount. If none fits, it waits for a person instead of paying the wrong order.

Is a screenshot proof of payment?

No. Only the money arriving in your account is proof. Check the screenshot against the bank texts that really arrived, and treat your bank app as final.

If you want InstaPay payments, bookings or a loyalty card wired into your business, see booking and loyalty systems or write to m@tawfik.tv.

It’s already moving real money. On 15 October 2026, L2BEAT counted about $3.8 billion secured by the 12 ZK rollups it tracks on Ethereum, networks that use these proofs to show a whole batch of transactions was processed correctly.

I’m Mo Tawfik Khalifa. I designed a zero-knowledge ID for players at PLAYERUNKNOWN Productions, and I’ve led identity products where the right answer was no zero-knowledge at all. The long story of those builds is in How to prove who someone is without seeing who they are. This is the plain answer, with a proof you can run yourself.

What is a zero-knowledge proof?

There are always two sides. The prover knows a secret. The verifier wants to be sure the prover knows it, without hearing it.

The idea comes from a 1985 paper by Shafi Goldwasser, Silvio Micali and Charles Rackoff, The Knowledge Complexity of Interactive Proof-Systems. Their question was how much a checker learns from a proof beyond the fact that it’s true. Their answer: it can be nothing. Goldwasser and Micali won the Turing Award, computing’s top prize, partly for this work.

How does a zero-knowledge proof work? The magic door

The classic explanation is a cave from How to Explain Zero-Knowledge Protocols to Your Children, by Jean-Jacques Quisquater, Louis Guillou and Thomas Berson. The cave is a ring. One entrance splits into a left and a right passage, and they meet at a door at the far end that opens only for the magic words.

1. You wait outside. The prover walks into the left or the right passage. You can’t see which.
2. You shout which side they should come out of.
3. If they know the words, they always can: they walk back, or go through the door.
4. If they’re bluffing, they only make it when they happened to pick the side you call. That’s 1 chance in 2.
5. Repeat. A bluffer survives 10 rounds 1 time in 1,024, and 40 rounds about once in a million million.

You end up sure, and you never hear the words. Try it.

Open the interactive diagram on tawfik.tv

The tape at the end is the clever part. In the paper, a rival reporter films a bluffer, cuts out every failed scene, and ends up with a tape nobody can tell from the real one. So a recording proves nothing to anyone else. That’s what “zero knowledge” means in the maths: anything the checker saw, they could have faked without the secret.

What are the three properties of a zero-knowledge proof?

Every one must pass three tests, and the cave shows all three.

1. Completeness. If the statement is true and both sides follow the rules, the checker is convinced. Someone who knows the words always comes out the right side.
2. Soundness. If the statement is false, a cheater gets caught, except with a tiny chance you can make as small as you like. Each round halves a bluffer’s luck.
3. Zero-knowledge. The checker learns nothing except that the statement is true. The fake tape looks just like the real one.

Soundness only works if the checker’s questions are unpredictable. Shout “left” every time in the game above with Alex at the cave and see what happens. That’s why the reporter in the story flipped a coin.

What is the difference between interactive and non-interactive proofs?

The cave is interactive: you have to be there, asking questions live. Fine for one checker, useless for a blockchain that thousands of computers check later.

A non-interactive proof is one message anyone can check, any time. In 1986 Amos Fiat and Adi Shamir published the trick most systems still use: the prover works out the “coin flips” from a hash of everything said so far, so nobody has to flip them live. In 1988 Manuel Blum, Paul Feldman and Silvio Micali showed non-interactive zero-knowledge proofs work when both sides share a random string set up in advance. That shared setup comes back below as a cost.

What are zk-SNARKs and zk-STARKs?

They are the two main families of non-interactive proofs in use today.

• zk-SNARKs make tiny proofs that are quick to check. In Jens Groth’s widely used 2016 design, a proof is only three group elements, a few short numbers. Most need a trusted setup: a one-off ceremony that makes the shared random string. If the secret left over from it isn’t destroyed, someone could forge proofs.
• zk-STARKs, from Eli Ben-Sasson and colleagues in 2018, are “transparent”: no trusted setup, only public randomness. Ethereum’s developer docs say they are also safe against quantum computers, while the maths under most SNARKs is not. The price is bigger proofs that cost more to check on-chain.

The line is blurring. Zcash, a private payments network, moved to a proving system called Halo 2 in May 2022 to remove its trusted setup.

Where are zero-knowledge proofs used today?

1. Age and identity checks. Google open-sourced its zero-knowledge libraries in July 2025 so a person can prove they’re over 18 “without sharing anything else at all”. The EU’s age verification blueprint has included zero-knowledge proofs since October 2025, and Denmark, France, Greece, Italy and Spain are building national apps on it. How that compares with ID uploads and face scans is in How to prove you’re over 18 without showing your ID.
2. Blockchain rollups. A ZK rollup runs a batch of transactions off the main chain and posts a summary plus a proof that every one of them followed the rules. Ethereum checks the proof instead of redoing the work.
3. Private payments. A normal payment on a public blockchain, like most stablecoin transfers, shows both addresses and the amount to anyone. Zcash’s shielded payments are encrypted on the chain yet still checked as valid.
4. Players and accounts. At PLAYERUNKNOWN Productions, my design let a player prove “I’m a registered player and I hold this item” without the game learning which player or which wallet. The full build is here.

What can a zero-knowledge proof prove, and what can’t it?

It can prove almost any statement a computer could check if it had the secret. In 1991 Oded Goldreich, Silvio Micali and Avi Wigderson showed that every such statement has a zero-knowledge proof: “this number is over 18”, “I know the password to this account”, “these 5,000 payments add up”.

What it can’t do:

• Make bad data true. A proof that a signed card says “over 18” is only as good as whoever signed the card.
• Stop one person getting two IDs. That’s decided when IDs are handed out, not in the proof.
• Hide everything around it. Your internet address, your device and a site that asks for too much are still there, as the EFF points out.

What does a zero-knowledge proof cost?

Checking is cheap. Making the proof is not. Ethereum’s docs say the cost of computing validity proofs is substantial, can raise fees, and needs specialised hardware, and that a mishandled trusted setup could compromise a rollup’s security.

The cost I’d plan for as a product lead is people. The statement has to be written as a “circuit”, a program the proof system understands, and a mistake there means proofs of the wrong thing still check out. That needs specialists and an outside audit before launch.

When do you not need a zero-knowledge proof?

Skip it in any of these four cases.

1. The checker must know who you are. A hospital can’t hire an anonymous nurse. In the credential passport for clinicians I led, the licence is checked once at the source and the clinician picks which fields each employer sees, with no zero-knowledge part.
2. A signed answer is enough. If the site only needs “over 18: yes” from a trusted issuer, a verifiable credential with selective disclosure does the job with less engineering.
3. The checker already holds the data. Your bank doesn’t need a proof of your balance.
4. Nothing private is at stake. An ordinary signature proves a file wasn’t changed.

Reach for zero-knowledge when the checker must be sure of a fact and must not be able to link it to a person or reuse it.

Questions people ask

Who invented zero-knowledge proofs?

Shafi Goldwasser, Silvio Micali and Charles Rackoff, in a paper presented in 1985.

Is a zero-knowledge proof the same as encryption?

No. Encryption hides a message so only the key holder can read it. A zero-knowledge proof convinces someone a statement about hidden data is true, and they never read the data.

Can a zero-knowledge proof be faked?

Only with luck or broken maths. In the cave, a bluffer passes 40 fair rounds about once in a million million. Non-interactive systems set that chance far lower, and a SNARK can be forged if its trusted setup leaked.

Are zero-knowledge proofs quantum safe?

STARKs are believed to be. Most SNARKs rest on elliptic curve maths that a large quantum computer is widely believed able to break.

Do you build this?

Yes. I design identity and privacy products end to end, and decide where zero-knowledge earns its cost, as a fractional CPO or hands on. If you need this built, write to m@tawfik.tv.

It also got much lighter to run this autumn. PlayCanvas shipped SuperSplat Editor 3.0, rebuilt on WebGPU, on 9 September 2026. On a 4.4 million splat scene, a 990 MB PLY, the editor’s memory with the scene loaded fell from 1,557 MB to 105 MB.

I build real-time 3D for the web: my Hermès virtual store, the TAG Heuer showroom I built at Napster, and SEVEN Al Hamra, a building you could walk through before it was built. For splats, my live demo is tawfik.tv/window. It renders Spark’s own sample scene, a fireplace, not a scan of mine, as if your screen were a pane of glass. What a splat is and how to capture one is in Gaussian splatting on a website. This page is the step in between: cleaning a scan so it is fit to publish.

What is SuperSplat?

SuperSplat is PlayCanvas’s tool for inspecting, editing, optimising and publishing Gaussian splats (README). Three things to know:

• It is free and open source. The Editor’s code is on GitHub under the MIT licence, and so are its viewer and the splat-transform converter. The hosting at superspl.at, where published scenes live, is run by PlayCanvas (overview).
• Your scan stays on your machine until you publish. The Editor loads files locally. Only publishing needs a free PlayCanvas account.
• It needs WebGPU. Current Chrome or Edge, Safari 26 or later, or Firefox with WebGPU switched on (getting started).

How do I open a .ply, .splat or .spz in SuperSplat?

1. Go to superspl.at/editor.
2. Drag your file onto the window, or use File > Import. It reads .ply, .compressed.ply, .sog, .splat, .ksplat, .spz and XGRIDS .lcc files (formats). A .ply must hold splat data: a mesh PLY from a modelling tool will fail to load.
3. Find your way round. Left-drag orbits, right-drag pans, the wheel zooms, double-click sets the point you orbit around, and F frames the selection.

You can also open a scan straight from a link:

https://superspl.at/editor?load=https://example.com/scans/postbox.ply

How do I delete floaters in SuperSplat?

Floaters are stray blobs hanging in the air where the training software was unsure what it saw. PlayCanvas’s own guide says most raw captures contain them, and that removing them is the single biggest quality win.

1. Press N to turn on Selection Depth, so the tools stop at the visible surface instead of reaching through the scene. Press Tab to show each splat’s centre.
2. Press B for the brush and paint over the floaters. [ and ] change its size. Hold Shift to add to the selection and Ctrl to take away from it.
3. For a lone clump, press O for Flood Selection, which grows a selection from where you click.
4. Press Delete. Turn the camera, look again, repeat.
5. Took too much? Ctrl+Z undoes (Cmd+Z on a Mac), and Select > Reset brings back every deleted splat.

When an area is finished, select it and press H to lock it, so a stray brush stroke cannot touch it. Shift+H unlocks everything. Every tool and key is in PlayCanvas’s selection guide and shortcut list.

Try it on a sample scan of a London post box. This brush reaches through the scan, as SuperSplat does with Selection Depth off, so turn the view when the post box gets caught.

Open the interactive diagram on tawfik.tv

How do I crop a splat in SuperSplat?

Cropping keeps what is inside a shape and deletes the rest: the street behind your subject, the ring of blurry ground every outdoor scan drags in.

1. Pick Box Selection, or Sphere Selection, and double-click in the scene to place it.
2. Shape it with the gizmo: 1 moves, 2 rotates, 3 scales. Or type its position and size.
3. Click Set to select everything inside. Leave Selection Depth off here, so the box reaches through the whole scene.
4. Choose Select > Invert (Ctrl+I), then press Delete.

How do I fix the orientation and scale?

Scans often load on their side or upside down, and at no real-world size. The transform guide covers three fixes:

• Level it. Pick the Orient tool, click three points on something that should be flat, such as the floor or a table top, and press Align to Grid. If it comes out upside down, orbit underneath and press Align to Grid again.
• Move, turn or resize it by hand. Choose Select > None first so the whole splat moves, then use Move, Rotate and Scale (1, 2, 3).
• Give it a true size. The Measure tool reports the distance between two points. Type the real distance, from a doorway you measured with a tape, and SuperSplat rescales the whole scan to match. The grid is in metres.

How do I compress and export from SuperSplat?

File > Export offers PLY, SOG, SPZ, Splat and Viewer App, and only visible splats are exported.

• SPZ for a web page you build yourself. It is Niantic’s compressed format; SuperSplat writes version 4 by default and version 3 for older readers.
• SOG, PlayCanvas’s own compressed format: a zip of WebP images and a small JSON file, which its docs recommend for apps. Spark reads both SPZ and SOG.
• PLY as your full-size master copy. Tick Compress PLY to write a smaller .compressed.ply.
• SH Bands sets how many bands of spherical harmonics go in: the numbers that let colour change with viewing angle. Fewer bands means a smaller file and flatter shine.

Ctrl+Shift+E repeats the last export to the same file. File > Save keeps an .ssproj project with your edits, so you can come back later.

What you delete counts twice. A full PLY stores about 248 bytes a splat, so every 100,000 floaters you cut is about 25 MB off the master.

How do I publish or embed a SuperSplat scene?

Three ways, from least work to most control.

1. Publish to superspl.at. Log in, frame the view people should see first, then File > Publish with a title and a description. SuperSplat compresses the scan to SOG, which can take several minutes, and gives you a scene page. New scenes are unlisted: only people with the link can see them. On the scene page, Embed gives you an iframe for your own site, and later changes you make in Studio show up in it (publishing guide).
2. Export a Viewer App. File > Export > Viewer App gives you one HTML file with the scan inside, or a ZIP with the viewer and an index.sog. The single file is about 30% larger, and PlayCanvas says files under 32 MB should load everywhere. The ZIP only runs over http://, so test it with a local server before you upload it to any web host (self-hosting guide).
3. Your own page, with Spark. See the next section.

To test an unzipped Viewer App on your own machine:

cd postbox-viewer        # the unzipped Viewer App
python3 -m http.server   # then open http://localhost:8000

How do I put a cleaned scan on my own website?

Export SPZ and load it with Spark, the three.js splat renderer my window demo uses. The heart of it is one line:

const scan = new SplatMesh({ url: "/scans/postbox.spz" });

The whole page, about 20 lines, and what broke when I shipped mine are in Gaussian splatting on a website. Which route to take:

• The iframe when the scan is the whole story and PlayCanvas’s viewer controls suit you.
• Your own page when the scan sits inside your design, next to other 3D objects, or needs controls of its own. My window demo moves the view with your cursor, your phone’s tilt or your head, which a stock viewer does not do.

Two cleanup habits pay off on your own page:

• Crop to where people can look. Shipping the window demo taught me that a scan stops where the photos stopped, and people see black at the edges unless you limit how far the camera travels. Crop to that same limit and you stop shipping splats nobody can see.
• Count your splats. Spark’s performance guide suggests 1 to 3 million splats on an iPhone and 1 to 2 million on an Android phone. Cropping is the cheapest way under budget.

If the scan is one room in a bigger 3D site, see how I build three.js websites. If you are pricing a walk-round of a property or venue, what a 3D virtual tour costs compares splats with 360 photo tours and scanned tours.

Questions people ask

Is SuperSplat free?

Yes. The Editor is open source under the MIT licence and free to use in the browser. Publishing to superspl.at needs a free PlayCanvas account.

Does SuperSplat upload my scan?

Not while you edit. The Editor loads files locally, and nothing is uploaded until you choose Publish.

Can SuperSplat convert PLY to SPZ?

Yes. Open the PLY and choose File > Export > SPZ. PlayCanvas also runs a converter page at superspl.at/convert, built on its splat-transform tool.

Why won’t my PLY open in SuperSplat?

It may be a mesh, not a splat: SuperSplat only loads PLY files that hold Gaussian splat data. It also needs a browser with WebGPU.

Is SuperSplat the same as Spark?

No. SuperSplat is PlayCanvas’s editor and viewer. Spark is a separate splat renderer for three.js, built by World Labs.

If you want a scan cleaned and built into your own site, see 3D web experiences or write to me at m@tawfik.tv.

The method comes from a paper by Kerbl, Kopanas, Leimkühler and Drettakis, published in ACM Transactions on Graphics in July 2023 and shown at SIGGRAPH 2023. Before it, the authors wrote, no method could show a complete, unbounded scene at 1080p in real time. Theirs ran at 30 frames a second or more (abstract on arXiv).

I built one you can try: tawfik.tv/window. It renders a splat live in your browser with Spark, and the screen behaves like a pane of glass: the room shifts as you move the cursor on a laptop, or drag or tilt a phone. If you allow the camera, it follows your head instead, worked out on your own device. To be clear about the scene: it is Spark’s own sample, a fireplace, not a scan of mine. It holds 301,000 splats in a 4.4 MB .spz file.

What is a Gaussian splat, in plain words?

Picture a 3D photo made of blobs instead of triangles. Each blob has a position, a size, a stretch and a direction, a colour, and how see-through it is. Blend enough of them from back to front and they add up to a photo-real picture you can walk round.

Three things make splats different from the 3D models in games:

• They are made from photos, not modelled. Software learns the blobs by checking them against your photos thousands of times. The original research code runs 30,000 training steps.
• They look like the photos. Plants, hair and fabric, which are slow to model by hand, come out looking the way they did on the day.
• The light is baked in. You get the light that was there when you scanned. You cannot relight a splat the way you relight a model.

How do you capture a Gaussian splat with a phone?

1. Pick an app. Scaniverse from Niantic Spatial has a free tier, runs on iPhone and Android, and exports splats as SPZ or PLY. Polycam builds a splat from 20 to 200 photos or an MP4 video.
2. Light it evenly. Overcast daylight or soft room light. Hard shadows get baked into the scan.
3. Walk a full circle, slowly. Keep the subject in the middle of the frame and overlap each shot with the last. Then walk a second circle, higher or lower.
4. Cover every side people will see. The software can only rebuild what the photos saw. Try “front half only” in the demo below and look round the back.
5. Avoid what moves and what shines. People walking through, leaves in the wind, mirrors and glass all turn to blur.
6. Clean it before you publish. Most scans have stray blobs floating at the edges. SuperSplat, a free, open-source editor that runs in the browser, crops them away.

Here is the whole pipeline in one place. Walk round the pot to take photos, train it, then see what a real scan weighs.

Open the interactive diagram on tawfik.tv

Which file format: .ply, .splat or .spz?

• .ply is what training produces. In the original research code every splat stores 62 numbers: position, a normal, 48 colour numbers that let the colour change with viewing angle, see-through, size and rotation. At 4 bytes each, that is 248 bytes a splat, so a million splats is about 248 MB.
• .splat is the simple format from the first WebGL viewer: 32 bytes a splat. It keeps one colour per blob, so shine does not move as you do.
• .spz is Niantic’s open-source compressed format, MIT licensed. Its makers say SPZ files are typically about 10 times smaller than the PLY, with minimal visual difference.

PlayCanvas published a real example in December 2023: their guitar scan was 132.8 MB as a PLY and 8.7 MB compressed. Spark reads PLY, compressed PLY, SPZ, SPLAT, KSPLAT and PlayCanvas’s newer SOG format.

My rule: ship .spz to the browser and keep the .ply as the master.

How do I put a Gaussian splat on my website?

Pick a viewer first.

• Spark. A Gaussian splat renderer for three.js, built by World Labs, MIT licence. It is what my demo uses. Choose it when your site already uses three.js, or when you want splats mixed with ordinary 3D objects.
• SuperSplat. PlayCanvas’s free, open-source editor for inspecting, editing, optimising and publishing splats, in the browser. The quickest route if you want no code.
• GaussianSplats3D. An earlier three.js viewer you will find in older tutorials. Its author says it is no longer in active development and points people to Spark.

With Spark, this is a complete page. It is Spark’s own getting-started code, trimmed, with your scan in place of their sample:

<style> body { margin: 0; } </style>
<script type="importmap">
{ "imports": {
    "three": "https://cdn.jsdelivr.net/npm/three@0.180.0/build/three.module.js",
    "@sparkjsdev/spark": "https://sparkjs.dev/releases/spark/2.3.1/spark.module.js" } }
</script>
<script type="module">
import * as THREE from "three";
import { SparkRenderer, SplatMesh } from "@sparkjsdev/spark";

const renderer = new THREE.WebGLRenderer({ antialias: false });
renderer.setSize(innerWidth, innerHeight);
document.body.appendChild(renderer.domElement);

const scene = new THREE.Scene();
const camera = new THREE.PerspectiveCamera(60, innerWidth / innerHeight, 0.01, 1000);
scene.add(new SparkRenderer({ renderer }));

const scan = new SplatMesh({ url: "/scans/room.spz" });
scan.quaternion.set(1, 0, 0, 0);   // turns the scan the right way up, as in Spark's example
scan.position.set(0, 0, -3);
scene.add(scan);

// the window effect, simplest version: the camera follows the cursor
addEventListener("pointermove", (e) => {
  camera.position.x = (e.clientX / innerWidth - 0.5) * 0.4;
  camera.position.y = (0.5 - e.clientY / innerHeight) * 0.2;
});

renderer.setAnimationLoop(() => renderer.render(scene, camera));
</script>

Source: Spark getting started. My live version goes one step further: the glass stays fixed and the eye moves in front of it, so the picture bends the way a real window does. Three things I hit shipping it:

• Your Content Security Policy. Spark starts its workers from data: URLs, so worker-src must allow data:. My page may only load its own files, which is also the privacy proof for head tracking: face detection runs in the browser, and anyone can open the Network tab and see that no frames leave.
• Paths. tawfik.tv serves /window without a trailing slash, so relative paths broke. Load the scan by an absolute path or relative to import.meta.url.
• The edges of the scan. A scan stops where the photos stopped. Limit how far the camera can travel, or people see black at the edges.

Will a Gaussian splat run on a phone?

Yes, if you keep the count down. Spark’s performance guide gives rule-of-thumb budgets:

• iPhone: 1 to 3 million splats.
• Android phone: 1 to 2 million.
• Quest 3: 1 million or less.
• Computer: 1 to 5 million, and 10 to 20 million or more on some desktops.

Over budget, turn on level of detail. With Spark 2.0, new SplatMesh({ url, lod: true }) renders a smaller set of splats sized to the device: by default 1 million on Android, 1.5 million on iOS and 2.5 million on desktop (level-of-detail guide). For big scans, build the level-of-detail file ahead of time and stream it.

Two more settings matter. Keep antialiasing off, as Spark advises, because splats gain nothing from it. And watch the pixel ratio: my demo times its own frames, and when 60 frames average slower than 25 ms it lowers the resolution a step, then raises it again when there is room. It also shows a loading percentage, so nobody waits on a blank screen while the 4.4 MB scan arrives.

What is a Gaussian splat website good for?

• Property. A walk-round of a real room on the listing, from a phone scan, with no 3D artist.
• Retail. A real product, a shop floor or a window display. In my virtual stores the products were rebuilt in real-time 3D from CAD files or photogrammetry, so they could be lit and configured. A splat is the faster route when you want the real thing as it looks and do not need to relight it.
• Venues. A stage, a club or a view from a seat, scanned once and opened from a link, as a light first step towards a digital twin.
• Events. Scan the set or the stand after the build and the event lives on as a page. On a fan platform, a scanned room is the skin; the points, games and rewards do the work.

Where splats fall short: anything you need to relight, offer in different colours as a product option, or drop into a game as a solid object. That still needs a modelled 3D asset.

Questions people ask

What is 3D Gaussian splatting?

A way to turn photos of a real place or object into a 3D scene made of soft, coloured blobs that render in real time. It comes from a 2023 research paper by Kerbl and colleagues.

Can I view or edit a Gaussian splat online without code, in SuperSplat?

Yes. Open the file in SuperSplat in your browser, or use the viewer in your scan app. To show it on your own site, in your own design, use a web viewer such as Spark.

How big is a Gaussian splat file?

About 248 bytes a splat as a raw PLY, so a million splats is about 248 MB. As SPZ it is roughly a tenth of that. My demo scene is 301,000 splats in 4.4 MB.

Do Gaussian splats work on iPhone and Android?

Yes, in a browser with WebGL2. Spark says it works on almost all devices, through WebGL2, and suggests 1 to 3 million splats on an iPhone and 1 to 2 million on an Android phone.

Is a splat better than photogrammetry?

They do different jobs. Photogrammetry gives you a mesh you can relight and use in a game engine. A splat looks more like the photos, but its lighting is fixed.

If you need a 3D scan on your site, or a whole 3D web experience around it, see 3D web experiences or write to me at m@tawfik.tv.

Customers are open to one, with a way out. In a Gartner survey of 3,566 customers, run in February and March 2026, 50% said service is easier when companies use generative AI, and 87% said it is essential to have an option to reach a human.

I set up an AI help desk for a fintech platform. I bought the agent instead of building one, wrote the help centre it answers from, and held one rule: the agent can read and explain, and it can never change an account. Anything that needs an action goes to a person.

What can an AI customer service agent safely do?

Three jobs, from day one:

• Answer questions from your help centre, with a link to the article it used.
• Look up the signed-in customer’s own records: order status, delivery dates, whether a payment went through.
• Collect the details and hand over, so your person starts with the full picture.

Leave out anything that moves money or changes an account. You can add those later, one at a time, behind a guardrail.

On the fintech help desk, the platform’s admin tools can move money between accounts and complete stuck cash-outs. The agent never gets those tools. When I tested it by asking it to send a customer’s cash-out to a third party, it refused and passed the conversation to a person.

Why does the knowledge base come first?

When an article is missing, the model fills the gap with something that sounds right. Build the knowledge base before you switch anything on:

1. Export your last few hundred conversations and list every question that comes up more than once.
2. Write one article per question in plain English, with the answer in the first line.
3. Write down the rules your team knows by heart: the returns window, what counts as faulty, delivery cut-offs.
4. Keep one source of truth. On the fintech desk one file publishes the public help centre, and the agent re-reads that site every week. Nobody edits answers inside the bot.

I also keep a list of phrases the agent must never say, such as “we’ll cover it”, and a check that fails if any article or saved reply contains one.

Should the agent be read-only or allowed to take actions?

Read-only first. Every action you add raises how much the agent resolves, and what one bad conversation can cost. When you add one, put the limits in a check that runs before the action, outside the model. The policy fits on one page:

agent: website-chat
can_read:
  - help_centre
  - orders and payments: signed-in customer only
can_do:                        # day one: read-only
  refund:          ask_person
  change_address:  ask_person
later, one at a time:
  refund:          allow up to £100, own order, duplicate charge confirmed
  change_address:  allow own order, not yet dispatched
answers:
  - only from a help article, linked; otherwise hand over
  - never say: "we'll cover it", "refund approved", "I've sent you a link"

This is the idea behind GVNR, the free, source-available guard I lead for AI agents in Claude Code, Cursor, Codex, Gemini CLI and other MCP clients. Before every action it answers allow, deny or ask a person, and it keeps a hash-chained record of each decision. A support agent needs the same three answers.

Try it on a small shop’s inbox. Turn on refunds or address changes, or shrink the help centre, and watch each conversation and the monthly bill.

Open the interactive diagram on tawfik.tv

How should the handover to a human work?

• One step to a person, any time. Gartner warns that customers forced through failed AI attempts are less likely to use the tool again.
• The agent writes the summary: the question, the order, what it checked and anything a guardrail stopped. The customer never repeats themselves.
• Say what happens next without a promise. “The team will pick this up” is safe. “You’ll hear back in an hour” is not.
• Say it is an AI. Under Article 50 of the EU AI Act, which applies from 2 August 2026, a system that talks to people must tell them they are dealing with an AI unless that is obvious.

How do you measure resolution?

Vendors count resolutions differently, so read the definition before comparing rates. Intercom bills an “outcome” when the customer confirms the issue is resolved, does not ask for more help after the agent replies, or the agent completes a workflow, handoffs included, once per conversation. Zendesk bills an “automated resolution” only when the AI agent resolved the request without escalation to a human. Intercom says its agent averages 76% across 12,000+ customers. Yours depends on your articles and permissions.

What I track every week:

1. Resolution, by my own definition: no person touched it, and the customer did not come back about the same thing within 7 days.
2. Handover reasons: each is a missing article or permission.
3. 20 resolved conversations, read in full. A customer who gave up looks resolved on a dashboard.
4. Guardrail stops. Each one is either a bad request or a rule that needs fixing.

How much does an AI customer service agent cost?

Seats for your people, plus a fee per AI resolution. Prices listed in October 2026:

• Intercom: $29, $85 or $132 per seat a month, paid yearly, plus from $0.99 per outcome.
• Zendesk: $19, $55 or $115 per agent a month, paid yearly, with 5 or 10 automated resolutions per agent a month included, then $1.50 each committed or $2.00 pay as you go.

Against people: Gartner’s 2019 poll put a live contact (phone, chat or email) at $8.01 on average, against about $0.10 for self-service. For a small business it is staff time: the median US customer service wage was $21.53 an hour in May 2025, so a 10-minute chat costs about $3.59 in wages alone.

So 1,000 chats a month with half resolved is 500 outcomes at $0.99: $495, plus a seat for the person who takes the rest.

An AI receptionist for a small business is priced per call. Smith.ai’s AI receptionist is free for 25 calls a month, then $3.00 a call, or $150 a month for 75 calls and $500 a month for 300, with transfer to a live receptionist. The median US receptionist earned $18.27 an hour in May 2025. The same rules apply: answers from your own notes, and anything involving money goes to a person.

Which AI customer support software should you choose?

Pick the one that sits on the help desk your team already works in, because the agent needs your articles, your customer records and a handover to a person in the same inbox. Intercom and Zendesk both sell an AI agent on top of their help desk, and both charge per seat plus a fee per resolution, so which is cheaper depends on your seat count and your volume. Compare how each counts a resolution before you compare prices, as above, since that definition sets the bill. Then test three things in a trial: can you lock it to read-only, does it link the article behind each answer, and where does it keep transcripts.

A 2-week rollout plan

Week 1

1. Day 1. Export recent conversations; list the questions and the actions asked for.
2. Days 2 and 3. Write the articles and rules.
3. Day 4. Set the agent up read-only on website chat, connected to the help centre, with signed-in customers verified by your own server before it reads any account.
4. Day 5. Replay 50 real past questions, plus refund demands, requests for another customer’s details and questions with no article. Fix what fails.

Week 2

1. Day 6. Go live during office hours, with a person watching every conversation.
2. Days 7 and 8. Read everything. Write articles for repeated handover reasons.
3. Day 9. Extend to evenings and weekends.
4. Day 10. Review the four numbers. Decide whether one action, with a limit, has earned its place.

What goes wrong?

Made-up answers. In February 2024 a Canadian tribunal ordered Air Canada to pay a customer C$812.02 after its website chatbot said the customer could claim a bereavement fare after travelling, which the airline’s own policy page ruled out. The tribunal found the airline had not taken reasonable care to make its chatbot accurate, and rejected the argument that it could not be held liable for what the chatbot said (Moffatt v. Air Canada, 2024 BCCRT 149). Answer only from articles, link the source, and hand over when nothing matches.

Refunds and promises. Customers will say a colleague already agreed a refund. Cap the amount per conversation, check the order is the customer’s own, and never let the agent promise money it has not moved.

Privacy. An agent that reads accounts must know who it is talking to. My rule for the fintech desk: no account data until the chat carries an identity your server has signed, so nobody can type someone else’s email address and ask about their money. Keep card numbers out of chat, and check where the vendor stores transcripts.

If you are connecting agents to tools over MCP, the MCP security checklist covers that side, and how to stop an AI agent deleting your database covers coding agents. More of my field work is in forward deployed engineer: four AI and fintech builds.

Questions people ask

How much does an AI chatbot for a website cost?

From about $1 to $2 per resolved conversation on the big help desks, plus $19 to $132 per seat a month for the people who handle the rest. Intercom charges from $0.99 per outcome; Zendesk charges $1.50 or $2.00 per automated resolution.

How do I build an AI customer service agent?

Buy the agent and build the parts that matter: the help centre, identity checks, the handover and the guardrail. Launch read-only and add actions one at a time.

Is an AI customer service agent worth it for a small business?

Run the cost numbers above with your own volume. If half your chats are the same ten questions, ten good articles and an agent take them off your team.

Will an AI agent replace my support team?

It takes the repeat questions. People still handle money, exceptions and upset customers, and 87% of customers in Gartner’s 2026 survey want the option to reach one.

If you need an AI help desk set up with these guardrails, write to me at m@tawfik.tv.

Couples still book the professional: 88% of US couples who married in 2025 hired a photographer, and the average wedding had 117 guests, according to The Knot Worldwide’s 2026 Real Weddings Study, published on 18 February 2026. That is up to 117 phones in the room as well, and the photos on them usually scatter across group chats.

I built Laqtaa for a friend’s wedding: one shared camera for your event. Guests scan a QR code and every photo lands in one live album. About 100 guests used it on the day and nothing broke, and it spread to more weddings by word of mouth. Here is what I learned, checked against Apple’s, Google’s and MDN’s own docs.

How do you collect photos from all your wedding guests?

1. Pick one album for the whole day. One link, one QR code, every guest.
2. Make joining one step. The QR code should open the camera or the album straight away, with no app, account or event code.
3. Put a card on every table, plus the bar and the guest book.
4. Decide who can see the album before you print, and say so on the card.
5. Ask the best man or the DJ to mention it once.
6. Download everything in the week after, before the link is forgotten.

Open the interactive diagram on tawfik.tv

Why does a no-download wedding photo app matter?

Every step between seeing the card and the first photo loses guests. An app means finding it in the store, downloading it on venue wifi, making an account and typing a code, drink in hand. A web album asks for one thing: point the camera.

Phones are ready for that one step:

• iPhone. The built-in Camera app reads QR codes: hold the phone so the code appears, then tap the link (Apple).
• Android. The built-in camera scans QR codes on Android 9 or higher (Google), and on a Pixel the camera shows a link bubble as soon as it sees one (Google).
• The camera in the browser. A web page can open the phone’s rear camera with one HTML attribute, capture. MDN’s compatibility data lists it in Safari on iOS since version 10 and in Chrome for Android since version 25 (MDN). A live viewfinder inside the page uses getUserMedia(), which only works on pages served over HTTPS (MDN).

The simplest version is one line of HTML:

<input type="file" accept="image/*" capture="environment">

On Laqtaa, the QR code opens the camera in the guest’s browser and each shot goes straight into the shared album. No app, no login, and personal events are free.

The demo’s drop-off rates are made up, so read the shape: every step loses people, and an app adds four.

Shared Google Photos album, iCloud, an app or a web QR album: which is best?

A shared Google Photos album. Free and familiar. Share an album by link and anyone with it can view the photos and add to the album, and Google Photos can make a QR code for it (Google). The catch for a wedding: a link can be passed on by others, and if you remove someone while link sharing is on, anyone with the original link can still view the album (Google).

An iCloud shared album. Apple changed these with iOS 27. Albums created on version 27 or later share photos at full resolution, and friends can join and add photos on the web, even without an Apple Account or Apple device. The owner decides whether people need approval or anyone with the link can join (Apple). The catches: those photos count towards the owner’s iCloud storage, albums made on version 26 or earlier reduce shared photos to 2,048 pixels on the long edge (Apple), and guests whose devices are not on the latest software have to update or view the album on iCloud.com.

A dedicated wedding app. Usually the most features, paid for by every guest in downloads, accounts and codes before the first photo.

A web QR album. What I built. Scan, shoot, done, on any phone with a browser. It lives on someone’s server, so check who runs it, how long the photos stay and how you get them out.

For a mixed room of iPhones and Android phones, the web QR album gets the most guests in. If most guests use Apple devices on the latest software, an iCloud shared album made on iOS 27 is a good free option.

What should you put on the wedding table cards?

• One instruction: “Point your phone camera here and tap the link.”
• “No app needed” in plain words. It is the line that gets people to try.
• Who sees the photos: “Everyone here can see the album” or “Only Harriet and Tom will see your photos.”
• A short link under the code, for anyone whose camera will not scan.
• Until when the album takes photos, if it closes.

Print the code large, on matte card, and scan the printed proof under the venue’s lighting before you print the rest. Google’s own tips for a failed scan are a steady hand, good light, no shadows or glare, and the whole code on screen (Google). Candlelight and glossy card fight all of those.

Who can see the wedding photo album?

• Guests at the wedding. Everyone sees everything, live. It is the fun option: people scroll at the table and shoot more when they see others doing it. On Laqtaa, every photo lands in one live album that everyone at the event can see.
• Couple only. Guests see their own photos and the couple sees all of them. Better with children, colleagues or guests who would rather not be shared.

Either way, treat the link as a key: check that you can reset it and remove people, and ask guests not to post the QR code online.

How do you get full-quality originals of guest photos?

Ask whether the album keeps original files or resized copies, then test it: upload one photo, download it again and compare the pixel size with the one on your phone.

iCloud shared albums made on version 27 or later keep photos at full resolution, while albums made on version 26 or earlier reduce them to 2,048 pixels on the long edge (Apple). Laqtaa puts a film look on every shot, like a disposable camera: part of the fun, and worth knowing if you want untouched files. For the few photos that matter most, such as the first dance from the front row, ask the guests who took them to send you the originals afterwards.

What happens to the photos after the wedding?

1. Download the whole album within a week, and keep two copies.
2. Close the album. Turn off uploads or link sharing, so an old link cannot add to it or browse it.
3. Send the best ones back to the guests who took them, with your thank-you notes.

On Laqtaa the album closes when the event ends and guests receive the full album on WhatsApp, so nobody has to remember a link.

A checklist for couples and planners

Before the day

• Choose the album and test it on one iPhone and one Android phone.
• Decide who can see the photos.
• Print one card per table, plus the bar and the guest book.
• Scan a printed proof in the venue’s light.
• Check the mobile signal and wifi where people will sit.

On the day

• Put the cards out before dinner.
• Get it mentioned once, after the speeches.
• Give one person the job of checking the album is filling up.

After the day

• Download everything within a week and keep two copies.
• Close uploads or link sharing.
• Ask for the originals of the photos you will frame.

I built Laqtaa on my own with AI in the loop, and wrote up what that taught me in can one person with AI do a whole team’s work. The same no-download rule runs through my Wallet stamp cards and fan engagement platforms.

Questions people ask

Do guests need to download an app to share wedding photos?

No. A web album opens from the QR code in the phone’s browser, and the built-in camera on an iPhone or on Android 9 or higher reads the code.

What is the best wedding photo sharing app?

The one your guests actually use: no download, no account, one scan. Then check who can see the album, how you download it, and whether you get original files.

Can we keep our wedding photo album private?

Yes. Use a couple-only album, where guests see only their own photos, or share with invited people only.

Can I use a shared Google Photos album for my wedding?

Yes. Share it by link or QR code and anyone with the link can view and add photos. To stop new photos, turn off Collaborate. To make it private again, remove the collaborators and turn off link sharing (Google).

If you need a QR album, online booking or a guest app built for your venue or business, see booking and loyalty builds for local businesses or write to m@tawfik.tv.

That range is for a sample 40,000 sq ft office with sensors in 40 rooms, 24 energy meters, a maintenance app and fault-finding software. Every number below links to the vendor or government page it came from. None of them are my prices.

The interest is real. In an August 2024 explainer, McKinsey reported that 70 percent of C-suite technology executives at large enterprises are already exploring and investing in digital twins, and projected the market to reach $73.5 billion by 2027.

What are the levels of a digital twin?

The Digital Twin Consortium defines a twin as a virtual representation of real things and processes, synchronised at a specified frequency and fidelity. In practice a building twin comes in three levels, and each one costs more than the last.

1. Visual model. A real-time 3D copy you can walk through, built from the construction files. I turned SEVEN’s Revit, IFC and Navisworks models for Al Hamra in Riyadh into a building you can walk in a browser, before it was built. At Expo 2020 Dubai my team of 12 worked on Virtual Expo Dubai, the whole site in real-time 3D. The Expo closed. The twin is still live.
2. Live data twin. The same model with real readings on it: who is in which room, what each circuit draws, which work orders are open. This is the “synchronised” half of the definition.
3. Simulation twin. The live twin plus a model that predicts: what happens to energy use if you change a setpoint, and which equipment is quietly wasting power.

For the FIFA World Cup in Qatar, Expo 2020 and SEVEN, I turned engineering models into live Unreal and Unity environments. That is the first level. The other two levels are where sensors, platforms and monthly fees come in.

How much does it cost to build a digital twin?

These are the lines for the sample office, from published prices checked in October 2026, in US dollars.

• Laser scan of the building: $0.20 to $0.70 per sq ft, so $8,000 to $28,000 (The Future 3D, March 2026).
• BIM model from the scan, at LOD 300: $1.50 to $3.50 per sq ft, so $60,000 to $140,000. Skip both lines if you already have the BIM, as SEVEN did. You still pay for the clean-up that makes it run in real time.
• Occupancy sensors: $229 per sensor plus $8 per room a month on Density’s published price list: $9,160 for 40 rooms, then $320 a month.
• Energy submeters: in a GSA field test (January 2021), each measured load cost $900 installed, $470 for equipment and $431 for the electrician, with analytics at $12 to $48 per meter a year. For 24 loads: $21,600.
• Maintenance tickets: MaintainX Premium is $65 per user a month, billed annually, and it is the plan with API access, which you need to put tickets on the model. Five technicians: $325 a month.
• Fault-finding and analytics software: across Lawrence Berkeley National Laboratory’s campaign, the median cost was $0.03 per sq ft to install and $0.02 per sq ft a year (2019). For this office: $1,200, then about $67 a month.
• Energy simulation engine: EnergyPlus is the US Department of Energy’s open-source engine, so the software is free. Building and calibrating the model is engineering time, quoted per project.

Switch layers on below and watch the plan, the ledger and the timeline change. The figures are the ones above.

Open the interactive diagram on tawfik.tv

How much does a digital twin platform cost?

The platform holds the model and the live data and is the smallest line on the bill.

• Autodesk Tandem: from $267 a month, with a free tier to try it. Built around BIM, so it suits facilities that already have Revit models.
• AWS IoT TwinMaker: $1.50 per million data calls, $0.05 per entity a month and $0.50 per 10,000 queries. AWS’s own 800-entity example comes to $197.53 a month, or $220 on the fixed bundle.
• Azure Digital Twins: pay per use. In East US, $2.50 per million operations, $1.00 per million messages and $0.50 per million query units. 64 devices sending one reading a minute is about 2.8 million operations and as many messages a month, roughly $10.

Which digital twin software is best?

It depends on who runs it. Tandem if your facilities team has the BIM and wants a product on day one. Azure Digital Twins if you have developers and want your own app on a graph you control. TwinMaker if your data already lives on AWS. For the 3D people actually walk through, on a phone or in a browser, I use Unity and Unreal; how I get a 650 MB model down to a 74 MB build is in Unity WebGL on mobile.

How long does a digital twin take?

• 3D model from existing BIM: SEVEN Al Hamra took just under 12 weeks from first access to sign-off, by hand.
• Laser scan: 1 to 21 days of turnaround, before the modelling starts.
• Energy meters: at the GSA test, an electrician installed 6 meters in 6 hours. In a GSA full-panel test (May 2019), 5 panels with 96 breakers took 14 hours, and connecting the data to GSA’s analytics platform took 12 hours.

Sensors, tickets and simulation have no public install times. They run alongside the model, so the model sets the date.

Where do digital twin cost savings come from?

The savings come from the data layers. These are the published results.

• Fault detection: in LBNL’s campaign of 96 organisations and nearly 6,000 buildings, fault detection tools gave a median 9% energy saving, $0.24 per sq ft a year, with a one to two year simple payback (US DOE, November 2019). For 40,000 sq ft that is about $9,600 a year.
• Energy information: the same campaign found a median 4% saving, $0.04 per sq ft, from energy information systems alone.
• Submeters: at a courthouse in Salt Lake City, circuit-level submeters paid back in 0.6 years, from fairer tenant billing and a 10% average cut in HVAC load in the GSA test.
• Maintenance: the DOE’s O&M Best Practices Guide estimates preventive maintenance saves 12% to 18% over fixing things when they break, and predictive maintenance 8% to 12% more.

The visual model pays back differently. Before opening, a model like SEVEN Al Hamra’s does leasing, pre-opening marketing and design reviews.

How do you start a digital twin small?

1. Pick one number. Energy cost per sq ft, open work orders, or rooms booked but empty. Every layer has to move it.
2. Use the files you have. BIM, CAD, floor plans. On SEVEN Al Hamra the construction models were the start: the building was not built yet, so there was nothing to scan.
3. Start on one floor. Meter the big loads and put sensors in the meeting rooms. That is under $8,000 on the lists above.
4. Rent the platform month to month. The platform is the cheapest line. Change it later if you outgrow it.
5. Add fault detection before simulation. Its published payback is one to two years.
6. Scale floor by floor once the number moves.

If you want the 3D side, I compare engines, devices and costs for stores, shows and venues in virtual stores, live shows and 3D worlds.

Questions people ask

What is a digital twin?

A live, virtual copy of a real building, machine or process, kept in step with the real thing by sensor data, so you can see, test and plan on the copy first. The Digital Twin Consortium defines it as a virtual representation synchronised at a specified frequency and fidelity.

How much does a digital twin cost?

For a 40,000 sq ft office, about $32,000 for sensors, meters and software if you already have the BIM, and about $100,000 to $200,000 if you have to scan and model it first. Running it costs about $750 to $1,100 a month with every layer on.

What is the cheapest digital twin platform?

On usage, Azure Digital Twins: a small building can run for tens of dollars a month. Autodesk Tandem starts at $267 a month and AWS IoT TwinMaker’s bundle at $220 in AWS’s own example.

Do I need a 3D model for a digital twin?

For the live data, no: a floor plan can show it. For people to walk the building before it opens, or to see where a fault sits behind a ceiling, yes.

What are the cost savings of a digital twin for buildings?

Published medians are 9% of energy cost from fault detection and 4% from energy information systems, with one to two year paybacks. Preventive maintenance saves 12% to 18% over fixing things when they break.

How long does it take to build a digital twin?

The model sets the pace. SEVEN Al Hamra took just under 12 weeks from construction models to a signed-off build. Meters go in within days.

If you have the BIM and want a twin people can walk through, see how I take on 3D web projects or write to m@tawfik.tv.

Agents are still new, even for software developers. In the Stack Overflow 2025 Developer Survey (July 2025), 14.1% said they use AI agents at work daily and 9% weekly, while 52% either don’t use agents or stick to simpler AI tools.

I build agents and the guards around them. I set up an AI help desk for a fintech platform that can read and explain, and can never change an account. I built mlx-agent, an open-source agent that runs open models on a Mac, searches the web and runs commands you approve. And I lead product for GVNR, a free, source-available guard that checks what an agent is about to do before it does it.

What is an AI agent?

Anthropic, which makes Claude, describes agents as “systems where LLMs dynamically direct their own processes and tool usage” (Building effective agents, December 2024). OpenAI’s practical guide to building agents is shorter: “Agents are systems that independently accomplish tasks on your behalf.”

In plain words: a chatbot gives you an answer and you do the work. An agent does the work. Ask a chatbot to book a table for four on Friday and it suggests restaurants. Ask an agent and it opens the booking site, picks a time, fills in the form, and should ask you before it pays the deposit.

“Agentic AI” is the wider term, for systems of several agents and how a business puts them to work. That has its own page: what agentic AI is and how companies deploy it. This page is about one agent and what it is made of.

What are the parts of an AI agent?

Five parts. OpenAI’s guide names the first three as an agent’s core components.

1. The model. A language model that reads, writes and decides the next step. It can come from any provider, or run on your own computer.
2. Instructions. The job description: what to do, what to avoid, when to stop. Instructions are a request, and the model can get them wrong. Claude Code’s own documentation says it treats its instruction files “as context, not enforced configuration”, and points you to a hook if you need to block an action whatever the model decides (How Claude remembers your project).
3. Tools. Each tool is a key to something: a browser, a folder of code, a terminal, an email account, a database, a payment card. Without tools, an agent can only talk. Many tools now plug in through MCP, the Model Context Protocol, which is why the MCP security checklist matters.
4. Memory. Most agents start every session blank. In Claude Code’s words, “each Claude Code session begins with a fresh context window.” What carries over is usually a notes file the agent reads at the start: AGENTS.md, “a README for agents” supported by Codex, Cursor and Gemini CLI, or CLAUDE.md for Claude Code.
5. The loop. The agent looks at the situation, decides one step, takes it with a tool, checks the result, and goes round again. It stops when the job is done, when it runs out of steps, or when it has to ask you.

Try it on an office. Pick a job for the agent, hand it keys from the cabinet, and see which rooms it can now reach and what it could break in each. Then run a shift and watch the loop.

Open the interactive diagram on tawfik.tv

What AI agents do people use today?

Coding agents. Claude Code, Cursor, Codex and Gemini CLI read a project, edit files and run commands in a terminal. Each has approval settings that decide which commands need a yes from you first. I list the settings for all four in how to stop an AI agent deleting your database.

Customer support agents. They answer customers from a help centre, look up the customer’s own orders and hand anything else to a person. On the fintech help desk I set up, the agent never gets the platform’s tools that move money. When I tested it by asking it to send a customer’s cash-out to a third party, it refused and passed the conversation to a person. The setup and the prices are in AI customer service agent: what it can safely do.

Browser agents. These drive a web browser for you: search, click, fill in forms. OpenAI says its ChatGPT agent (July 2025) asks permission before actions of consequence, and you can interrupt it or take over the browser at any point. Anthropic says Claude in Chrome (August 2025) asks you before publishing, purchasing or sharing personal data.

Agents on your own computer. mlx-agent runs open models on a Mac, searches the web, reads pages, and runs only the shell commands you approve.

What can an AI agent do, and what can’t it?

It does well at jobs with many small steps and a clear finish line: find the bug and run the tests, answer the question from the help article, compare five pages and fill in one form. It works at any hour and does not get bored of the hundredth look-up.

It cannot:

• Tell your instructions apart from text it reads. A web page, an email or a support ticket can hide orders aimed at the agent. This is called prompt injection. In Anthropic’s own tests of Claude in Chrome, 123 attack cases across 29 scenarios, attacks succeeded 23.6% of the time without its new safety measures and 11.2% with them (Claude in Chrome, August 2025).
• Know that it is right. It can sound certain and be wrong, so the answer should come from a source it links to.
• Remember last week, unless someone wrote it into its notes file.
• Do anything without a tool. Every action goes through a key you handed it.
• Take the blame. A person owns what the agent does, so a person should own its keys.

What is the one rule for AI agents?

Whatever its tools can reach, it can break.

An agent with a read-only key to your help centre can, at worst, quote the wrong article. The same agent with the refund button can send money to the wrong place, and with your live database password one command can delete your customer data. In July 2025 an agent on Replit deleted a founder’s database during a code freeze. Telling an agent “don’t” is a request. Taking the key away is a control.

So the safe way to start is short:

1. Give it one job with a clear finish line.
2. Hand over read-only keys first. Add a key only when the job proves it needs one.
3. Make it ask a person before anything it cannot undo: deleting, paying, sending, publishing.
4. Keep a record of what it did, and read it.

That is what GVNR does. It is free and source-available under FSL-1.1-ALv2 (code on GitHub), runs on your own machine, and works with Claude Code, Cursor, Codex, Gemini CLI and any other MCP client. Before each action it answers allow, deny or ask a person, and it keeps a hash-chained record of every decision, so an edited line shows. When you have more than one agent, the AI agent governance framework covers owners, identities, limits and reviews.

Questions people ask

What is an AI agent in simple terms?

An AI that does tasks for you instead of only answering. It has a job, a set of tools and a loop: look, decide, act, check, repeat.

What is the difference between an AI agent and a chatbot?

A chatbot answers and you act. An agent holds tools, so it can act itself: edit a file, fill in a form, send an email or issue a refund.

What are examples of AI agents?

Coding agents such as Claude Code, Cursor, Codex and Gemini CLI; customer support agents that answer from a help centre; and browser agents such as ChatGPT agent and Claude in Chrome.

Are AI agents safe?

As safe as the keys you hand them. Start read-only, make anything irreversible wait for a person, and keep a record. A prompt that says “be careful” is not a control.

What is the difference between an AI agent and agentic AI?

An AI agent is one worker with a job and tools. Agentic AI is the wider idea of systems that act on their own, often several agents together. See agentic AI.

If you need an agent built, or guardrails around the agents you already run, write to me at m@tawfik.tv.

Most UK adults are already set up to pay with their phone: 65% of them were registered for at least one mobile payment service in 2025, up from 57% in 2024, according to UK Finance’s UK Payment Markets Report 2025, published in August 2026.

I build online booking with Wallet stamp cards for local service businesses: a car care business where every car gets its own card, and a dog club where every dog has a membership. Here is how the pieces work, checked against Apple’s and Google’s developer docs.

How does a digital loyalty card (stamp card) in Wallet work?

1. The customer books online. The booking creates their record, and the confirmation page shows an Add to Apple Wallet or Add to Google Wallet button.
2. They tap it once. The card sits in Wallet next to their bank cards, with the business name, the stamps and a barcode.
3. They turn up. Staff scan the barcode or open the booking and mark the visit done.
4. The server adds the stamp. Apple or Google tells the phone, and the card redraws.
5. The card fills up. The reward shows. Staff scan it to use the reward, and the count starts again.

The server holds the count and the card only shows it.

Open the interactive diagram on tawfik.tv

How do you make an Apple Wallet loyalty card?

Apple’s format is a pass: a signed bundle with a .pkpass extension. For loyalty you use the store card style, Apple’s pass type for loyalty, gift and points cards. The steps, from Apple’s Building a Pass:

1. Join the Apple Developer Program, at $99 a year, for access to Certificates, Identifiers and Profiles.
2. Create a pass type identifier, a reverse-DNS string for your business and card.
3. Generate a Pass Type ID certificate from a certificate signing request.
4. Write pass.json: name, serial number, colours, stamp count, barcode, and the webServiceURL and authenticationToken that let you update it later.
5. Add the images. On store cards, a strip image runs across the card, a natural place for the row of stamps.
6. Sign and package it. Write manifest.json with a SHA-1 hash of every file, sign it with a PKCS #7 detached signature using the certificate, zip the folder and rename it to .pkpass.

Apple treats each pass type identifier plus serial number as one unique pass. So one card per car is simply one serial number per car.

Passes can be handed out from a web page, by email or from an app (Apple). For a local business, the booking confirmation page is the one that matters.

How does an Apple Wallet pass update after each visit?

Apple’s web service guide sets out the loop:

1. When the customer adds the pass, their phone registers it with your server and sends a device ID and a push token.
2. After a visit, your server sends a push through Apple’s push service, with an empty payload.
3. The phone asks your server which passes changed, then downloads each new version.

The lock-screen message comes from a field’s changeMessage, a format string such as Stamps: %@, where Wallet fills in the new value. Leave it out and the card updates quietly. Two catches from the same guide: the web service must use HTTPS in production, and update pushes only work in the production environment.

How do you make a Google Wallet loyalty card?

Google splits the card in two. A loyalty class is the programme, shared by everyone: name, logo, colours. A loyalty object is one customer’s card in that programme, with their account, points balance and barcode. The flow:

1. Set up an issuer account in the Google Pay and Wallet console.
2. Create the loyalty class once.
3. Create a loyalty object per customer, or per car, or per dog.
4. Sign it. Put the object in a JSON Web Token signed with your Google Cloud service account key. That token becomes the Add to Google Wallet link.
5. Ask to go live. New issuer accounts start in demo mode, where only test accounts can save passes and each pass is marked “[TEST ONLY]”, until the Google Wallet team grants publishing access.

To add a stamp, you patch the object’s loyaltyPoints.balance. Per Google’s update guide, changing the class updates every holder, while changing an object affects only that customer.

Can Google Wallet send a notification when a stamp is added?

Yes, within a limit set out in Google’s push notification guide. Add notifyPreference: notifyOnUpdate to the update, and a change to loyaltyPoints.balance puts a notification on the lock screen. You can also add a message with the type TEXT_AND_NOTIFY. Both share one cap: 3 notifications per pass in 24 hours, and the customer must have Wallet notifications switched on.

So I spend Wallet notifications on the stamp and the reward, and send booking confirmations by email or message. Switch the demo above to Android and book a few times to watch the cap kick in.

Can the card show up when the customer is nearby?

• Apple lets a pass list up to 10 locations, and Wallet can put it on the lock screen near one of them. Test on a real phone: Simulator does not show passes on the lock screen (Apple).
• Google takes up to 10 locations per class and 10 per object, and reminds customers who gave Google Wallet precise, always-on location access. Google decides the distance and the wording (Google).

A good extra, not the business case.

Can customers tap the card on a reader?

They can, and a small business rarely needs it. Apple’s NFC passes need a special entitlement issued by Apple, and Google’s Smart Tap needs a certified terminal. Staff scanning the barcode with a phone does the same job on day one.

Wallet card, paper card or loyalty app: which is better?

• Paper stamp card. Cheap, and everyone takes one. It gets lost, is easy to fill by hand, and tells the owner nothing: no name, no visit history, no way to invite someone back.
• Loyalty app. It can do the most, but the customer has to find it, download it and make an account before the first stamp. A local business is asking for space next to apps people already use.
• Wallet card. One tap from the booking page, no account, and it updates itself. The limits: Apple’s and Google’s templates decide the layout, Google caps notifications, and you run a small server.

Why pair the stamp card with online booking?

Because the booking is where the card gets its data.

• Every customer gets a card. It is issued with the booking, so nobody has to remember to offer one.
• A stamp is a tap on a booking. The visit is already in the system, so staff close it and the stamp follows.
• No-shows are visible. A missed slot is recorded against the card, so the owner sees who books and does not come.
• Repeat visits become a number, not a feeling.
• The card can belong to the thing. One card per car, per dog or per member, each with its own count.

What’s the best booking system for a small business or salon?

For most small salons, a ready-made system is the right start, and several have a free plan. A custom booking system with a Wallet card pays off when loyalty is part of what you sell, or when the card has to belong to a car, a dog or a membership instead of a person.

Here is what the main options charge, from their own pricing pages on 15 October 2026.

• Square Appointments, UK. Free plan at £0 a month for a single location. Plus is £29 and Premium £69 a month per location. In-person card payments are 1.75% on Free and 1.6% on the paid plans, and online UK cards are 1.4% + 25p. Square Loyalty is separate: £25 to £65 a month per location, depending on loyalty visits.
• Fresha. $19.95 a month for a one-person business, or $14.95 per team member a month, in US dollars; prices differ by country. Client loyalty is a paid add-on per location.
• Booksy, UK. £40 a month with all features, plus £5 a month for each extra staff member. Its Boost marketplace charges a one-time 30% fee, minimum £5, on a new client’s first visit. Card payments are 1.29% + 20p + VAT.
• SimplyBook.me. Free for 50 bookings a month and one provider. Basic is €11.90 a month billed yearly (100 bookings, 5 providers), Standard €24.90 (500 bookings, 15 providers) and Premium €49.90 (2,000 bookings, 30 providers). SimplyBook itself takes no fee per booking.
• Calendly. Free for one event type and one calendar connection. Standard is $10 and Teams $16 a seat a month, billed yearly. It is made for scheduling meetings, so it suits a consultant better than a salon with chairs, staff and services.

Open the interactive diagram on tawfik.tv

How I’d pick between them:

1. One person, standard services. Start on a free plan and pay the card fees.
2. A team. Price it per person, since Fresha, Booksy and Calendly all charge more as you add staff.
3. New clients from a marketplace. Booksy’s Boost fee is what a new client costs you, so compare it with what else you spend to win one.
4. Loyalty. Check whether it is built in or an add-on, and whether the card can live in Apple and Google Wallet.

Is there a free booking system?

Yes. Square Appointments, SimplyBook.me and Calendly all have free plans that cost nothing a month. Each has a limit: one location on Square, 50 bookings a month on SimplyBook.me, one event type on Calendly. You still pay card processing fees when customers pay online.

How much does it cost to create a loyalty app?

There is no fixed price, since it depends on what you build. The fixed parts are small and published.

• Apple Developer Program: $99 a year, needed for Wallet passes and for an iPhone app.
• Google Play developer account: a one-time US$25 registration fee, needed only for an Android app. A Google Wallet card comes from an issuer account in the Google Pay and Wallet console instead.
• Ready-made Wallet stamp cards: Loopy Loyalty lists $25 a month for one card design and one location, up to $95 a month for ten of each.

The rest is the build and a small server. A Wallet card skips the app store, the download and the account, which is why I build loyalty as a card first.

When does a custom booking system with a Wallet card make sense?

• The card belongs to a thing. One card per car, per dog or per membership, each with its own count.
• Your rewards follow your own rules, such as bigger jobs earning more stamps, which a ready-made loyalty add-on may not offer.
• You pay for several tools that don’t talk to each other: booking, loyalty and messages, each charged per staff member or per location.
• You want your own brand and your own customer list, kept in your own database and locked down (this is how I check that), not a listing next to other businesses on a marketplace.
• You want the visit, the no-show and the stamp in one record, as in the pairing above.

If none of those apply, a ready-made system on a free or low plan is the right call.

What I built for a car care business and a dog club

A car care business. Booking in any phone browser, a staff view to run the day, and a Wallet stamp card per car, not per person. Bigger jobs earn more stamps, so more work on the car earns better offers.

A dog club. Every dog has a member card. Owners book stays and day care online, staff run the day from one dashboard, and the card belongs to the dog, not the owner.

Both run in the browser with no app to install. I built them with AI in the loop as I describe in can one person with AI do a whole team’s work.

Questions people ask

Do customers need to download an app for a Wallet loyalty card?

No. Apple Wallet is built into the iPhone, and on Android the customer saves the card to Google Wallet from a link. One tap from the booking page in both cases.

Does a digital stamp card work on both iPhone and Android?

Yes, as two builds: a .pkpass for Apple Wallet, and a loyalty class with one object per card for Google Wallet.

What does it cost to issue Apple Wallet passes?

Apple requires an Apple Developer Program membership, $99 a year, for the pass type ID and signing certificate. On top of that you pay for the build and a small server that holds the counts and sends the updates.

What stops someone faking stamps?

The count lives on your server, not on the card. A stamp only lands when staff close a booking, and the card shows whatever the server says.

What happens if a customer deletes the card or changes phone?

They add it again from the same link. The stamps are on your server, so the new card shows the same count.

What is the best free booking system for a small business?

Square Appointments, SimplyBook.me and Calendly all have free plans. Square’s covers a single location, SimplyBook.me’s covers 50 bookings a month and Calendly’s covers one event type. Card fees still apply when customers pay.

How much does a loyalty app cost?

The published fixed costs are Apple’s $99 a year and, for an Android app, Google Play’s US$25 once. Ready-made Wallet stamp card services start at $25 a month. A custom build adds design, build and a small server on top.

How much does loyalty program software cost?

On their own pricing pages, Square Loyalty is £25 to £65 a month per location, depending on loyalty visits, and Loopy Loyalty lists $25 a month for one card design and one location, up to $95 a month for ten of each. Fresha sells client loyalty as a paid add-on per location. Before you compare prices, check whether the card can live in Apple and Google Wallet and whether it is tied to your bookings.

If you need online booking and a Wallet stamp card built for your business, see booking and Wallet loyalty cards or write to m@tawfik.tv.

In GoodFirms’ survey of more than 300 web development firms in 31 countries, run in April and May 2026, 60% quote $1,000 to $3,000 for a basic website and 54% quote $5,000 to $20,000 for a mid-sized business site (GoodFirms, web development cost survey).

I build websites, online booking and Wallet loyalty cards for local service businesses, and I run this site myself. Every price below is a US list price before tax, checked at its source on 15 October 2026.

How much does a website for a small business cost?

It depends on who builds it. Three routes:

1. Do it yourself on a builder. Nothing up front except your time. On annual billing, Squarespace Basic is $19 a month and Core $29, Wix Light is $17 and Core $29, and Shopify Basic is $29. Paying month to month costs more: Squarespace Basic is $25 and Shopify Basic $39.
2. A freelancer on a builder. The most common price for a low-code or no-code build in the GoodFirms survey is $1,500 to $5,000. Clutch puts designers who build on Wix, WordPress, Squarespace, Webflow and Shopify at $25 to $49 an hour. You still pay the builder plan.
3. An agency or custom build. GoodFirms’ most common ranges: $1,000 to $3,000 for a basic website, $5,000 to $20,000 for a mid-sized business site, $5,000 to $50,000 for ecommerce and $20,000 to $50,000 for a custom web application. Hourly rates in the US and UK sit at $50 to $100 in that survey. Clutch puts US agencies at $100 to $149 an hour and UK agencies at $50 to $99, and says most web design projects reviewed on its site cost under $10,000.

Tick what your business needs and switch routes. The preview builds the site for a made-up London dog groomer, and every quote line links to its source.

Open the interactive diagram on tawfik.tv

How much does a small business website cost per month?

About $37 to $53 a month on a builder once you add email, a domain and booking, before card fees. These are the lines people forget:

• The plan or the hosting. $17 to $29 a month on a builder. A custom site needs hosting, for example Vercel Pro at $20 a month, which is what this site runs on, and a database, for example Supabase Pro from $25 a month, once it stores bookings or orders.
• The domain. A .com is $11.08 a year at Porkbun. Squarespace and Wix include the first year free on annual plans, then it renews at their standard rate.
• Email at your domain. Google Workspace Business Starter is $7 per person a month on an annual plan. Squarespace includes the first year on Core and above.
• Booking. Squarespace uses Acuity Scheduling: Starter is $16 a month billed yearly, $20 monthly. Wix includes booking from Core.
• Card fees. 2.9% + 30¢ per online card sale with Squarespace Payments on Basic and Core, Wix Payments, Shopify Payments on Basic and Stripe. Squarespace Basic adds a 2% fee on online store sales.
• Maintenance. GoodFirms says to plan for 15% to 20% of the build cost each year. Retainers run $500 to $1,500 a month at 30% of firms and $1,500 to $3,000 at 28%, and the two-year cost of a professionally built site typically runs 150% to 200% of the build.
• A Wallet loyalty card. Issuing Apple Wallet passes needs the Apple Developer Program, $99 a year.

Example: Wix Core with booking, one email address and a .com is about $37 a month after year one, plus card fees.

What does a small business website actually need?

Fewer pages than you think, and five things:

• Fast on a phone. Google’s Core Web Vitals set the bar: the main content loads within 2.5 seconds, the page responds to a tap within 200 milliseconds, and the layout does not jump (a layout shift score of 0.1 or less), for 75% of visits.
• Booking that takes two taps. Pick a time, confirm, get an email.
• A Google Business Profile. It is free, it puts you on Search and Maps, and it carries your Google reviews. Point its website and booking links at your booking page.
• Prices, hours, address and a phone number you can tap.
• A reason to come back. A stamp card in the customer’s phone works well for repeat visits. I wrote up how Apple and Google Wallet stamp cards work.

Which route should you pick?

• Do it yourself if you have one location, simple services and some evenings.
• A freelancer on a builder if you want it done properly and still be able to change your prices yourself afterwards.
• An agency or custom build if your booking has rules a builder cannot follow, you want a loyalty card in Apple and Google Wallet, staff need their own view of the day, or you want customers and bookings in your own database.

That last route is my work. For a car care business I built booking in any phone browser, a staff view to run the day and a Wallet stamp card per car, where bigger jobs earn more stamps. For a dog club, every dog has its own member card and owners book stays and day care online. Neither needs an app.

What should you check before you pay?

1. The domain is registered in your business’s name, in your account.
2. You own every account: the builder or hosting, the Google Business Profile, analytics and email.
3. The quote says what it leaves out. GoodFirms names the four items most often missing from first quotes: content, SEO setup, third-party licences and post-launch maintenance.
4. Running costs are written down, line by line, per month.
5. Who fixes it when it breaks, how fast, and at what rate.
6. You can export your pages, customers and bookings if you leave.
7. Booking and payment fees per transaction are on paper.
8. You tested it on your own phone before signing off.

How do I fix my website? A quick security and speed check

When a small business site needs fixing, start with these checks. Each one takes minutes.

1. Speed. Run your home page and booking page through PageSpeed Insights on mobile and look at the three Core Web Vitals above.
2. HTTPS and security headers. Run the two commands below the list.
3. Book yourself. Make a real booking and send the contact form from your phone, then check the emails arrive, for you and for the customer.
4. Two-step sign-in on the builder, the domain registrar, email and the Google Business Profile.
5. Updates. On WordPress, update plugins and themes and delete the ones you do not use.
6. Backups you have restored once.
7. Customer data. Check who can read your bookings. Open your site, view the page source and search for secret: no secret key belongs there. If your site keeps data in Supabase, work through my Supabase security checklist, the same checks I run when I fix database security on live apps.

The commands for step 2, from any Mac or Linux terminal, with example.com replaced by your domain:

# does plain http send visitors to https?
curl -sI http://example.com | grep -i -E "^http|^location"

# which security headers does the site send?
curl -sI https://example.com | grep -i -E "strict-transport-security|content-security-policy|x-content-type-options|x-frame-options|referrer-policy"

The first command should show a redirect to an https:// address. In the second, strict-transport-security keeps browsers on HTTPS, and content-security-policy limits which scripts can run on your pages.

Questions people ask

How much does a small business website cost in 2026?

$17 to $29 a month on a builder if you build it yourself, most often $1,500 to $5,000 for a freelancer on a builder, and $1,000 to $20,000 from an agency, up to $50,000 for ecommerce or a custom web application.

How much does a small business website cost per month?

About $37 to $53 on a builder with email, a domain and booking, plus card fees. A custom site adds hosting, a database and maintenance at 15% to 20% of the build each year.

Is Wix or Squarespace cheaper for a small business?

For a plain site, Wix Light is $17 a month and Squarespace Basic $19, both billed yearly. With booking, Wix Core is $29 with booking included, while Squarespace Basic plus Acuity Starter is $35.

What is the cheapest way to get a small business website?

Wix has a free plan with Wix branding and its own web address. The cheapest plan on your own domain is Wix Light at $17 a month, billed yearly.

How much does it cost to fix a website?

By the hour. Clutch puts builder specialists at $25 to $49 an hour, and GoodFirms puts US and UK firms at $50 to $100.

Do I need a website if I have a Google Business Profile?

The profile is free and gets you found on Maps. A website is where people book, see your prices and add your loyalty card, Most local businesses need both.

If you need online booking, a Wallet stamp card or a site fixed for your business, see booking and Wallet loyalty cards or write to m@tawfik.tv.

Two issuers hold most of the market. Tether reported about $184.6 billion of USDT in circulation on 30 June 2026, over 60% of all stablecoins, in its Q2 2026 attestation prepared by the accounting firm BDO. Circle reported $73.3 billion of USDC at the end of the same quarter in its second quarter results.

I’m Mo Tawfik Khalifa, chief product officer and forward deployed engineer at Instruxi. I have built the customer side of this twice: dollars, stablecoins and tokenized gold in one balance, with a checkpoint in front of every move. This is the plain version: what it is, what holds it at a dollar, and what breaks it.

What is a stablecoin?

Think of it as a digital dollar bill that a company prints and promises to buy back. You send the issuer $100 by bank transfer, it creates 100 coins in your wallet, and they move like any other token: wallet to wallet, at any hour, across borders, in minutes. When you want dollars back, you send the coins to the issuer, it destroys them and wires you $100.

Creating coins is minting, handing them back is redeeming. In between, the issuer’s whole job is keeping enough safe assets to buy every coin back.

It is not a bank deposit: it is not insured, and under US law it is unlawful to say it is. And unlike bitcoin, whose price floats, it is built so that its price does not move.

mint(x):    customer pays $x in      reserve + x    coins + x
redeem(x):  customer hands x back    coins - x      reserve pays $x out
the peg holds while:  reserve you can reach today  >=  coins out

How does a stablecoin keep its $1 peg?

Two things hold it: a reserve that covers every coin, and a redemption door that stays open.

• The reserve. For every coin out, the issuer holds at least a dollar of safe assets that sell quickly: cash at banks, Treasury bills that mature within weeks, overnight repo and government money market funds.
• Redemption. If a coin trades at 99.7 cents, a trader who can redeem buys it and hands it to the issuer for a full dollar. At $1.003, they mint at a dollar and sell. Both trades push the price back to $1.
• Proof. The issuer publishes the reserve every month and an accounting firm checks the report, so holders know the door will open tomorrow.

The weak spot is the word “reach”. A reserve stuck in a failed bank, or in assets that only sell at a loss, pays nobody back that week. That is when a coin slips below a dollar.

Try it on a sample issuer’s monthly reserve report: mint, redeem, start a run, fail a reserve bank, and switch the backing to see which designs hold.

Open the interactive diagram on tawfik.tv

What are the types of stablecoins?

Three designs, sorted by what sits behind the coin.

1. Fiat-backed. Cash, bank deposits and Treasury bills, held by a company. USDC works this way, and Tether says the majority of USDT’s reserve is in US government-backed instruments. It is the only design the US law accepts for a payment stablecoin.
2. Crypto-backed. Software holds other crypto, such as ether, as collateral, more than a dollar of it per coin because its price swings. When cover gets thin, the software sells collateral to buy back and burn coins. It survives slow falls, not falls faster than those sales.
3. Algorithmic. No outside reserve. The coin is held at a dollar by a promise to swap it for a dollar’s worth of a sister token from the same issuer, printed on demand. It works while people want the sister token.

Why did algorithmic stablecoins fail?

Because the only thing behind the coin was another token from the same people, and it loses value in the same panic.

TerraUSD (UST) is the case everyone points to. Per the US Attorney’s Office in New York, Terraform’s promotional materials claimed that one UST could always be exchanged for $1 worth of LUNA, its sister token. UST had already fallen below 92 cents in May 2021, and the peg came back only after a trading firm secretly bought millions of dollars of UST to prop it up. In May 2022 the peg broke again, UST and LUNA crashed, and investors lost over $40 billion. The SEC said the price of UST and its sister tokens “plummeted to close to zero”. Terraform’s founder, Do Kwon, was sentenced to 15 years in prison on 11 December 2025.

Switch the report above to algorithmic and start a run to see why: every coin handed back prints sister tokens, they get sold, the sister price falls, and the next coin needs even more of them.

Section 14 of the GENIUS Act orders a Treasury study of exactly this design, which it calls “endogenously collateralized”.

Who issues the biggest stablecoins?

Tether issues USDT, the largest, and reported reserves exceeding liabilities by about $4.11 billion at 30 June 2026. Circle, listed on the New York Stock Exchange, issues USDC. Both earn the interest on the reserve, and holders get none of it.

What does the GENIUS Act require of a stablecoin issuer?

The US GENIUS Act, signed on 18 July 2025, sets the rules for a “payment stablecoin”. What it means for a holder:

• One for one reserves from a short list: cash, insured bank deposits, Treasury bills with 93 days or less to run, overnight repo and government money market funds. Reserves cannot be pledged or lent out, except in narrow cases.
• A monthly report of coins out and reserves, examined by an accounting firm.
• Timely redemption under a published policy. Only regulators can limit it.
• No interest and no deposit insurance.
• Holders first in a failure. Their claims on the reserve come before everyone else’s.
• Freeze on a lawful order. An issuer must be able to seize, freeze or burn coins when ordered, and run a full sanctions programme.

It takes effect by 18 January 2027 at the latest. What it means for a bank is in can a bank issue its own stablecoin.

How does a business or a bank use a stablecoin?

• Paying suppliers abroad. Faster than a wire almost every time, cheaper only sometimes: cross-border payments with stablecoins.
• Settling between companies. On 16 December 2025 Visa launched USDC settlement with US banks.
• Paying out income. Rent from a tokenized property can go to each holder’s wallet in a stablecoin, as I describe in how to tokenize real estate.
• Offering it to customers. A bank can let customers buy, hold and send stablecoins in its app, keep them safe, or issue its own.

That last one is my work. The first build was a bank-in-a-box for a listed gold company: a white-label app where a bank’s customers hold dollars, stablecoins and tokenized gold in one balance. Every send or purchase goes through a checkpoint of 11 ordered rules with three outcomes: allowed, held, or unavailable when a fact it needs, such as the gold price, has gone stale. I also built a cross-border payments pitch for a network that settles between member banks in seconds: an interactive page where you switch one part off and watch the payment fail. Both are in forward deployed engineer: four AI and fintech builds.

Access to a stablecoin is easy to buy. The rules for who may send, mint or redeem, checked before the money moves and recorded, are the part you build.

What are the risks of a stablecoin?

• Depeg. In March 2023 more than $3 billion of USDC’s reserve cash was at Silicon Valley Bank when it failed. Circle’s own filing says USDC saw “a temporary price dislocation” on some markets until the funds were released. Put the reserve bank into failure in the report above to see the same shape.
• Issuer. You are trusting a company’s reserve, its banks and its report. Read the monthly report: what it holds, where, and who examined it.
• Sanctions. Issuers can freeze coins in a wallet. OFAC’s guidance says blocked virtual currency must be frozen and reported within 10 business days. Screen who pays you: a frozen coin pays no one.

Questions people ask

Is a stablecoin a cryptocurrency?

Yes, a token on a blockchain, but built not to move in price. A reserve and the issuer’s promise to buy coins back hold it at one dollar.

Are stablecoins safe?

As safe as the reserve and the issuer behind them. A coin backed by cash and short Treasury bills, reported monthly, is a different thing from an algorithmic one. Neither is insured.

Can a stablecoin lose its peg?

Yes. USDC slipped in March 2023 while part of its reserve was stuck at a failed bank, then recovered. TerraUSD broke in May 2022 and fell close to zero.

How do stablecoin issuers make money?

From interest on the reserve: Circle reported $668 million of it in the second quarter of 2026. Under the GENIUS Act, holders get no interest.

What is the difference between USDT and USDC?

Both are reserve-backed dollar stablecoins. Tether’s USDT is larger, about $184.6 billion in mid 2026, against $73.3 billion for Circle’s USDC. Each publishes its own reserve reports.

If you need this built, write to m@tawfik.tv, or see how I work as a fractional CPO.

What usually breaks a stream is the venue’s internet, not the budget. In March 2024 the FCC raised its definition of broadband to 100 Mbps down and 20 Mbps up. YouTube recommends 14 Mbps for a 1080p stream at 30 frames a second, and Vimeo’s rule of thumb is to stream at half of your upload speed. So a line that counts as broadband in the US does not leave enough headroom for that stream.

I’m Mo Tawfik Khalifa. I have worked at both ends of a live broadcast: as a technical producer on live F1 race coverage, as technical and transmission manager at the PyeongChang Winter Olympics for Olympic Broadcasting Services, and as a streaming manager at Amazon, including live music streams for Amazon Music. The same rules apply to a wedding: test the line, mic the voices, record a backup, rehearse. Every price below links to its source, checked on 15 October 2026.

How much does it cost to live stream an event?

Three tiers. Prices are US list prices from the maker, or three-day hire prices from Lensrentals, a US rental house. Crew rates are Bectu’s London live events guidance for 2025/26, for a 10-hour corporate day.

1. Phone and gimbal: about $174. Your phone, a DJI Osmo Mobile 7 gimbal at $75 and a DJI Mic Mini kit with two transmitters at $99.
2. A small multi-camera kit: about $517 to hire for three days. Three Canon XA60 camcorders at $103 each, three video tripods at $43 each, an ATEM Mini Pro switcher at $29 and a DJI Mic 2 kit at $50. To buy instead: the ATEM Mini Pro is $349 and streams to YouTube, Facebook and Twitch over Ethernet without a computer, and a Blackmagic Studio Camera 4K Plus G2 is $1,555, lens extra.
3. A crewed production: kit plus people. Four cameras on hire, three camera operators, a video tech on the switcher and the stream, and a sound technician. Bectu’s professional minimums are £360 for a camera operator and £350 each for a sound technician and a video tech, so those five crew start at £1,780 a day. For a field or a venue with no wired line, add bonded cellular: a LiveU Solo PRO HDMI at $1,795 from a US reseller, plus LiveU’s two-modem Connect kit at $450.

Build your own order below. Pick the event, cameras, sound, venue internet and audience; the kit list, the upload meter and the run of show follow.

Open the interactive diagram on tawfik.tv

How do you live stream an event, step by step?

1. Test the venue’s upload speed at the same time of day as the event, from where your kit will sit. Ask for a wired port. Vimeo advises Ethernet on a dedicated, unshared network.
2. Pick the quality the line can carry. Set the encoder to half your measured upload or less.
3. Mic the voices, not the room.
4. Rehearse a real stream to a private or unlisted link and watch it on a phone on mobile data.
5. Record locally on the switcher, the camera or the laptop. Vimeo says you should always record your stream locally, whatever your network.
6. Go live early with a holding slide, and keep one person watching the stream on headphones.

What upload speed do you need to live stream?

These are YouTube’s recommended bitrates for H.264, with the upload that leaves Vimeo’s half for headroom:

• 720p, 30 fps: 8 Mbps recommended, 3 minimum. Upload: 16 Mbps.
• 1080p, 30 fps: 14 Mbps recommended, 5 minimum. Upload: 28 Mbps.
• 1080p, 60 fps: 17 Mbps recommended, 6 minimum. Upload: 34 Mbps.
• 4K, 30 fps: 42 Mbps recommended, 11 minimum. Upload: 84 Mbps.

If the line is slower, lower the bitrate before anything else: a steady 1080p stream at 8 Mbps on a 16 Mbps line is better than 14 Mbps that stalls. Your audience size does not change the upload you need. The platform copies your one stream to every viewer. How viewers’ players add delay is in why my stream is behind live TV and in low-latency streaming.

What is the best platform to live stream an event?

• YouTube. Free. You need a verified channel with no live streaming restrictions in the past 90 days, and your first stream may take up to 24 hours to enable. Going live from the YouTube phone app needs at least 50 subscribers. An encoder, like the ATEM or OBS on a laptop, does not.
• Restream. Sends one stream to several platforms. Free for two channels with Restream branding, $19 a month for three, $49 a month for five channels in Full HD, billed monthly.
• Vimeo. Live streaming needs the Advanced plan, $75 a month billed annually or $125 monthly, with registration for up to 100 attendees, Q&A and polls.

For a wedding or a family service, an unlisted YouTube link is enough. For a conference with sign-ups, Vimeo. For reaching people on several platforms at once, Restream.

Audio is the thing people forget

A soft picture is still watchable. A voice you cannot hear is not. A camera mic at the back records the room: echo, chairs, air conditioning. Live TV treats sound as its own job. When F1 went remote it was rigging 90 cameras and 147 microphones at every race, more microphones than cameras.

For your event:

• Wireless lapel mics on whoever speaks: the officiant, the pastor, the speaker.
• A feed from the venue’s sound desk when there is one. Whatever reaches the PA reaches your stream. The ATEM Mini Pro has two 3.5 mm microphone inputs for it.
• Headphones on the stream, not the room, all the way through.

Rehearsals and backups

Live TV plans for the link failing. F1 rehearses switching to its backup every Thursday before a race weekend. At Channel 4, as product owner of the on-demand service, nothing shipped until every release gate passed. Scale that down:

• A rehearsal at the venue, with the real line, at least a day before.
• A local recording running the whole time.
• A second connection: a phone hotspot on a different network, or bonded cellular.
• Charged spare batteries and a second of every cable that matters.

Do you need permission to stream music?

Yes, usually. YouTube scans live streams, and when it finds third-party content a placeholder image may replace your stream, then the stream can be interrupted or ended. That catches a wedding’s first dance and a band playing covers.

• Churches in the US can add a CCLI Streaming License to the Church Copyright License: it covers songs played live by your musicians, from $84 a year for churches already licensed with CCLI, or $108 for an average church of 100 to 199 people. Backing tracks and multitracks need Streaming Plus.
• Sports: the league, club or organiser often controls the streaming rights. Get it in writing.
• Conferences: get speakers’ agreement to stream and record, and to keep the recording up afterwards.

Checklists by event

Weddings. Agree with the couple which parts go out live. Lapel mic on the officiant. One camera on the aisle, one on the couple. Unlisted link sent to guests the week before. Take the first dance off the stream, or expect the platform to cut it.

Church services. Sound desk feed, not a room mic. Licence for the songs. One wide camera, one on the pulpit. The same start time every week, so people can find it. Lifeway Research found 39% of Protestant churchgoers watched a livestream instead of attending in person on more than five occasions in a year (survey of September 2022).

Conferences. The slides as a direct feed from the lectern laptop into the switcher. Sound from the venue desk. Speaker consent. A registration page if attendance matters.

Sports. Rights first. One camera high and central for the wide view. A score on screen. Bonded cellular if there is no wired line at the ground.

The same drawing runs from a phone on a gimbal to a world feed: how live TV and streaming work. Live shows built for the browser are in virtual stores, live shows and 3D worlds.

Questions people ask

How much does it cost to live stream a wedding?

From about $174 in kit with your own phone: a $75 gimbal and $99 of wireless mics, streaming free to an unlisted YouTube link. A three-camera kit hires for about $517 for three days. Crew is extra.

How much does it cost to live stream a church service?

The same kit as any event, from about $174. US churches streaming worship songs also need a CCLI Streaming License, from $84 a year if already licensed with CCLI.

How do you stream a conference live?

Cameras and the lectern laptop into a switcher, sound from the venue desk, a wired line with twice your stream’s bitrate, a local recording and a rehearsal the day before.

What is the best way to live stream an event?

The cheapest setup that meets three tests: you can hear every voice clearly, the venue’s upload is twice your stream’s bitrate, and a backup recording runs the whole time.

Can I live stream an event from my phone?

Yes. On YouTube, going live from the app needs at least 50 subscribers. Below that, stream from an encoder app or a laptop with a stream key.

If you need a live event or a live product built, write to m@tawfik.tv, or see what I build.

The role was invented at Palantir. It is now one of the fastest-growing jobs in tech. On Indeed, postings for it in April 2026 were roughly 729% higher than in April 2025, according to Business Insider. The reason: getting AI to work inside a real company turns out to be a deployment problem, not a model problem.

I’m Mo Tawfik Khalifa, chief product officer and forward deployed engineer at Instruxi. I lead product and the teams, and I still build: I come from coding and design, and I ship with AI at every step. Here are four builds from the field. I built them, but the clients can’t be named under NDA.

What is a forward deployed engineer (FDE), and what do they do?

A forward deployed engineer sits between the customer and the product team. They write production code in systems they did not build, scope problems the customer cannot yet put into words, and explain trade-offs to executives who do not care about the tech stack. In practice it is five steps, in this order.

Open the interactive diagram on tawfik.tv

1. Guardrails for AI coding agents

The problem. Teams wanted AI coding agents working with real access: the shell, git, cloud credentials, a company card. One bad loop can burn a budget in minutes. One confident command can wipe a folder or push over a colleague’s work. “Be careful” in a prompt is not a control.

What I built. A free, source-available guard that sits between the agent and its tools and answers one question before every action: is this allowed? Each call gets one of three answers: allow, deny, or stop and ask the person.

• Spend caps per minute and per session. Hitting the per-minute cap pauses the agent and asks you. It does not throw the work away.
• Loop detection. An agent repeating the same failing step gets stopped.
• Command rules. Piping a script from the internet into a shell is denied outright. Deleting folders, force-pushing, touching credentials and deploying stop and ask first.
• A record you can prove. Every decision goes on a hash-chained record, so afterwards you can show exactly what the agent was and was not allowed to do.
• Local and locked. It runs on the developer’s own machine, plugs into agents over MCP, and none of its agent-facing tools can loosen a limit.

Open the interactive diagram on tawfik.tv

Result. Published free and source-available, with a live dashboard and a one-line install. The rule I held to: the agent can never talk its way past its own limits.

2. A credential passport for clinicians

The problem. Doctors, nurses and paramedics prove the same licences again for every new hospital, agency and shift. Every time means forms, scans and weeks of waiting while someone checks the licensing board by hand.

What I built. A mobile app for iOS, Android and the web where a clinician’s licences and certifications live in one encrypted vault, verified at the source.

• Identity check built into sign-up.
• Licences verified against the issuing authority, with an alert before one expires.
• Sharing that gives away only what you choose. Tick the fields, name the one recipient, pick how long the link lives, from one hour up to 30 days or never, and revoke it any time.
• A portal for the verification company to publish new credential types, and a checkout to order new checks.
• Underneath, a governance layer that decides who can see what, and decentralised encrypted storage for the files.

Open the interactive diagram on tawfik.tv

Result. Through QA and submitted to App Store beta, with the publishing portal in the verification team’s hands.

3. Digital dollars and gold for community banks

The problem. U.S. community banks are watching deposits leave for stablecoins and crypto apps. Their own trade body puts the deposits at risk from yield-bearing stablecoins at $1.3 trillion. Access is easy to buy now: large exchanges already resell custody and stablecoin payments to thousands of banks. What a bank cannot buy off the shelf is the decision layer: who passed identity checks, who can send, mint or redeem, what the limits are, and a record an examiner will accept.

What I built. Three working pieces, for three different conversations.

• A bank-in-a-box for a listed gold company. A white-label app where a bank’s customers hold dollars, stablecoins and tokenised gold in one balance. The demo is a money path: press send or buy gold and watch the value travel from the customer to the bank, through a checkpoint, onto the payment rails and into the ledger. The checkpoint opens or holds the money with a plain-English reason, from 11 ordered rules with three outcomes, including “unavailable” when a fact it needs has gone stale. The technical record sits one tap away, never in the customer’s face.
• A partner-bank app, explained for bank people. Customers fund, invest in and track digital assets from the bank they already trust. They keep the keys to their own wallet, the bank chooses what is on the menu, and every move is checked before it happens. It ends in a three-step pilot.
• A cross-border payments pitch for a network that settles between member banks in seconds: an interactive page where you switch one part off and watch the payment fail, so the buyer sees what each piece is for.

Open the interactive diagram on tawfik.tv

Result. Each one turned a slide-deck conversation into something a bank could press. The money-path and partner-bank demos each ship with a test script that checks every claim on the page, so the numbers on screen never drift from the engine behind them.

4. A street of homes, read from the blockchain

The problem. A client turns rented homes into tokens that back a loan. On their test network every piece existed: house, token, vault, loan, rent. Nobody outside could see how a dollar of rent moved through them, and the team could not see where the live data and the app disagreed.

What I built. A working prototype that reads the client’s live test network and draws every home as a plaster model on a 3D street, each one built from its own listing: storeys, floor area, garage. Hover over a house to see the real photo, or collect a month of rent and follow the coins.

• A scroll journey from house to token to vault to loan to rent.
• Four break-it gates. Switch off the title check, the valuation, the rent feed or the holder check and see what fails.
• The client’s own yield formula as sliders.
• Every token explained in one plain sentence.
• A ship list of fixes, each with screenshot evidence, and a check script that fails the moment the client fixes one, which is the signal to update the page.

Open the interactive diagram on tawfik.tv

Result. One page that explains the product to an investor in a minute and doubles as a bug list for the engineers.

What the four builds have in common

• Start with the customer’s problem in their words, not with the product.
• Put a check in front of every risky move: an agent command, a shared licence, a payment, a loan.
• Give a plain-English reason for every decision, and keep the technical record one tap away.
• Build demos the buyer can break, not slides they sit through.
• Ship a test with every claim, so what the page says stays true.

How fast is demand for forward deployed engineers growing?

Fast. Two dated numbers, from two sources:

• More than 800% growth in forward deployed engineer job postings from the start of 2025 through September 2025, reported by the Financial Times and covered by Fast Company.
• Roughly 729% year on year: Indeed’s postings for the role in April 2026 against April 2025, shared with Business Insider.

Both reports tie the growth to the same need: companies bought AI, and someone has to make it work inside their own systems.

Forward deployed engineer vs product manager vs solutions engineer vs consultant

I do two of these jobs at once: I’m chief product officer and forward deployed engineer at Instruxi. So this is how I tell them apart from the inside.

• Forward deployed engineer. Works inside one customer’s systems and writes the production code that makes the product run there. Stays until it runs, then feeds what they learned back to the product team.
• Product manager. Decides what to build next and why, across every customer. The output is priorities and specs, and the engineers write the code.
• Solutions engineer. Works before the sale. Shows a buyer how the product fits, runs demos and proofs of concept, answers the technical questions, then hands over at signature.
• Consultant. Studies the problem from outside and recommends what to do. The output is a report and a plan, usually independent of any one product, and someone else builds it.
• Fractional CPO. Runs product and the product team part-time: one priority list, the team, and how it ships. That is the fractional CPO work.

The quick test: if your customers cannot get the product working in their own systems, or you need code shipped inside a client’s stack, you need a forward deployed engineer. If you do not know what to build, a product manager. If you need a demo to win a deal, a solutions engineer. If you want an outside plan before you spend, a consultant. If nobody runs product, a fractional CPO.

Open the interactive diagram on tawfik.tv

How do you become a forward deployed engineer?

I came through three eras, and each one gave me part of the job.

1. Live broadcast systems. I started as a broadcast engineer at the BBC and Channel 4, then worked on live Formula 1 coverage, as technical and transmission manager at the Winter Olympics, as a technical manager at Sky and as a streaming manager at Amazon. Live TV teaches you to work inside systems other people built, to draw the workflow before you build it, and to ship things that cannot fail in front of an audience. More in how live TV and streaming work.
2. Immersive 3D. I turned engineering models into live Unreal and Unity environments, real-time digital twins for the FIFA World Cup in Qatar, Expo 2020 and SEVEN. Then I led teams: technical director at Sensorium, VP production at Expo 2020 Dubai, VP delivery at Napster with 24 developers, designers and producers. That is the customer-facing half: taking a client’s own data and making something they can walk through. More in virtual stores, live shows and 3D worlds.
3. AI and fintech. Blockchain work at Theta Labs and PLAYERUNKNOWN Productions, head of growth at OKX, and now Instruxi, where I ship the four builds above with AI at every step. This era adds the hardening: identity, permissions, limits and a record you can prove. More in can one person with AI do a whole team’s work.

You do not need my route. You need what it added up to. If I were starting now, I would do it in this order:

1. Ship one real product on one stack. Something people use, that you deployed and kept running.
2. Work inside systems you did not build. Integrations, legacy code, other people’s data and permissions.
3. Get close to customers. Support, delivery, implementation or solutions roles all count.
4. Learn to write it down. A one-page scope with a demo date, and trade-offs in plain English for someone who does not care about the stack.
5. Build with AI in the loop, and harden what you build. Fast prototypes are easy now. Production is the skill.
6. Show your work. Demos people can press beat a CV line.

The skills, concretely

• One backend language to production standard, Python or TypeScript, plus enough front end to put a working screen in front of a customer.
• APIs, webhooks and sign-in: OAuth, single sign-on, API keys and how to scope them.
• Databases and SQL, and reading a data model you did not design.
• Deployment: containers, CI, cloud, logs and monitoring.
• LLM work: prompts, tool calling, AI agents, MCP, and tests that catch a bad answer before a customer does.
• Security basics: least privilege, secrets handling, audit trails.
• Scoping: turning “we want AI” into one problem, one owner and one date.
• Explaining: a trade-off in two sentences to an executive, and the same trade-off in detail to their engineers.
• One domain deeply. For fintech that means identity checks, payment rails, ledgers and what a regulator will ask to see.

Questions people ask

What does FDE stand for?

FDE stands for forward deployed engineer: an engineer who works inside the customer’s team, on the customer’s systems, until the product works there. It is also searched as “forward deployment engineer”.

What is the difference between a forward deployed engineer and a solutions engineer?

A solutions engineer shows how the product fits and helps sell it. A forward deployed engineer builds production software inside the customer’s environment and stays until it runs. Many forward deployed engineers start where a solutions engineer stops.

What is the difference between a forward deployed engineer and a sales engineer?

A sales engineer runs demos and answers technical questions during the sale. A forward deployed engineer writes and ships the code after the contract, and often builds the prototype that wins it.

What skills does a forward deployed engineer need?

Writing production code in systems you did not build, scoping vague problems, explaining trade-offs to executives, and shipping fast without breaking security. In AI work, add LLM integration, AI agents and MCP, data access and permissions, and deployment.

How fast can a forward deployed engineer ship a prototype?

Days, with AI in the loop. The slow part is hardening: identity, permissions, limits and an audit trail. Skip it and the prototype stays a demo.

What is the difference between a forward deployed engineer and a product manager?

A product manager decides what to build for all customers. A forward deployed engineer builds it into one customer’s systems and writes the code. Good forward deployed engineers feed what they learn back to the product manager.

What is the difference between a forward deployed engineer and a consultant?

A consultant recommends what to do and hands over a plan. A forward deployed engineer ships the working software inside your systems and stays until it runs.

Is a fractional CPO the same as a forward deployed engineer?

No. A fractional CPO runs product and the product team part-time across the company. A forward deployed engineer works on one customer deployment at a time. I do both kinds of work, and the fractional CPO page covers the part-time product role.

How do I become a forward deployed engineer?

Ship one real product, then get good at working inside systems you did not build, close to the customers who use them. Add plain writing, AI in the loop and the hardening work: identity, permissions, limits and an audit trail.

Is forward deployed engineering in demand?

Yes. Postings grew more than 800% from the start of 2025 through September 2025, per the Financial Times, and Indeed’s postings for the role in April 2026 were roughly 729% above April 2025.

Do you take on forward deployed work?

Yes. If you have an AI or fintech problem that needs someone to sit with your team and ship it, write to m@tawfik.tv.

How live TV and streaming work, from camera to cloud to your phone. Why streams lag the TV, and how broadcast workflows moved from tape to files to AI.

Read it on tawfik.tv, with the interactive explainers

How I built private identity three times: a zero-knowledge player ID, a game login on Holochain, and a licence nurses share without their whole file.

Read it on tawfik.tv, with the interactive explainers

I’m Mo Tawfik Khalifa. For 20+ years I have built live systems and real-time worlds: for the BBC, Formula 1, the Winter Olympics and Expo 2020 Dubai, and in games including PUBG. Today I build virtual stores, live shows, digital twins and games that open from a link on a laptop, phone, tablet or handheld. Call it a virtual world, a 3D world or the metaverse: clients ask me the same questions. Here are my answers, with the work.

How do you build a 3D virtual store?

A woman on a sofa picks up a tablet. One tap on a red-brick townhouse and she is inside a Hermès store, as an avatar with her own live video above her head. A digital host in a silk scarf walks over. She turns a bag in 3D and moves in close on the leather and the clasp.

That was my own Hermès build, and it is the recipe for a 3D virtual store: rebuild the products in real-time 3D, set them in a world that tells the brand’s story, open it on the screen the customer already holds, and end every room in an action.

At Napster I built a TAG Heuer virtual showroom. A round room under a giant watch movement opens onto a racing garage with a Porsche race car, and onto a golf course by the sea where a virtual try-on puts the sunglasses on your own face, with the product page beside them.

I judge immersive retail by one number: taps through to a product page per visitor. Whatever does not move it gets cut.

• Spend the polygons on the product. CAD files or photogrammetry, rebuilt to a polygon budget with the fine detail baked into normal maps. Nobody zooms in on a wall. They zoom in on the clasp.
• Bake the room. Baked lighting and shared materials keep draw calls and texture memory down, so the tablet spends its effort on the bag.
• Load the first room first. Draco-compressed meshes and KTX2 textures stream from a CDN while the customer looks around. Every second on a loading bar is a visitor deciding to leave.
• Build the world, buy the till. The basket stays on the brand’s ecommerce site, one tap away. A 3D product configurator earns its place only when a choice changes the product: strap, dial, colour.

How to create a 3D virtual store, step by step

These are the steps behind my Hermès virtual store and the TAG Heuer showroom I built at Napster, in the order they happen.

1. Pick the one number. For a store, mine is taps through to a product page per visitor. Every later step gets checked against it.
2. Start from the screen the customer holds. The Hermès store opens on a tablet on the sofa. Name the weakest device your customers use and give it a budget for frame rate, draw calls and texture memory.
3. Get the real product files. CAD files or photogrammetry, rebuilt to a polygon budget, with the fine detail baked into normal maps. The leather and the clasp of the bag get the polygons. The walls do not.
4. Build a world that tells the brand’s story. A red-brick townhouse for Hermès. For TAG Heuer, a round room under a giant watch movement that opens onto a racing garage with a Porsche race car and onto a golf course by the sea.
5. Bake the rooms and load the first one first. Baked lighting, shared materials, Draco meshes and KTX2 textures streamed from a CDN, so the first room opens while the rest loads.
6. Add people where they help sell. In the Hermès store, visitors are avatars with their own live video above their heads, and a digital host walks over to help.
7. Add try-on where the product sits on the body. In the TAG Heuer showroom, the sunglasses go on your own face through the camera.
8. End every room in an action. The product page sits beside the try-on, and the basket stays on the brand’s own shop, one tap away.
9. Test on every device, open the doors, and watch the number. Whatever does not move taps to a product page gets cut.

How is a virtual concert made?

Romain Pissenem asked me to come and meet him at his office in Ushuaïa Ibiza. Romain directs High Scream, the show design studio behind the Ushuaïa and Hï Ibiza stages and David Guetta’s shows. High Scream designed PRISM, the virtual club world inside Sensorium Galaxy. Romain brought me in to run the technical production and workflow of PRISM: the builds, the team, the shows and the tech.

On the Ushuaïa main stage, the LED walls showed test grids, each zone named: DJ BOOTH, DJ BACK 2, L TOP, R TOP.

Those grids are the answer. A real stage is mapped panel by panel, so every cue lands where the designer meant it. A virtual concert, or metaverse concert if you still use the word, needs the same map, cue list and rehearsals. Only the stage is built in Unreal Engine instead of steel. Unreal reads DMX, the signal a real lighting desk sends, so the lighting designer programmes the virtual show from the desk they already use.

With High Scream, I made the DJ booth concept for David Guetta’s show in PRISM.

Running a virtual show means running 4 things at once:

• Builds. Club, booth and effects in Unreal Engine, with a build for each device.
• Team. One plan for design, engineering and show people, one name on each part.
• Shows. Lights and visuals on timecode, rehearsed like a real show.
• Tech. A budget per device for frame rate, draw calls and texture memory. Dropped frames in a headset make people feel sick, so the headset budget wins every argument.

Open the interactive diagram on tawfik.tv

Carl Cox’s show, Intermundium, premiered in PRISM as a free 30-minute set. His avatar was built with photogrammetry and motion capture, and the show ran in Unreal Engine, in VR on Steam and as 2D streams from YouTube to TikTok Live. Mixmag reported over 1 million viewers in the opening weekend, and the full show on YouTube has since passed 10 million views.

Carl Cox’s show was a successful test. David Guetta’s show is next, date to be confirmed.

How do virtual concerts work?

A virtual concert is a live show played inside a real-time 3D world. The artist is captured and turned into an avatar, the venue is built in a game engine, the show runs from one cue list, and the audience arrives at the same moment from headsets, phones, browsers and video streams. Carl Cox’s show above is a worked example.

To make a virtual concert, you go through 6 steps. In PRISM, the first 2 belonged to the artist’s team and Sensorium’s motion capture studio. I ran the technical production from the build onward.

1. Capture. Cameras photograph the artist from every side (photogrammetry), and a marker suit records how they move (motion capture).
2. Avatar. 3D artists clean up the scan, rig it to the captured motion and cut it to a budget each device can draw.
3. World build. The venue, stage, screens and crowd are built in a game engine, one build per device. PRISM was built in Unreal Engine.
4. Show control. Lights, visuals and effects are cued to the music on one timeline. Unreal’s DMX plugin lets the lighting designer run the virtual rig from a real desk.
5. Streaming to thousands. The audience is split into rooms of 50 to 100, all locked to one show timeline, with a video stream for everyone else. The next section explains why.
6. Chat and interaction. Chat, emotes and nearby voice inside each room, and shared moments fired to every room at once from the show timeline.

Open the interactive diagram on tawfik.tv

How do you get 1,000 people into one virtual experience?

You don’t put them in one room. With 1,000 avatars in one space, every device draws 999 others and the server sends about 1 million position updates every tick. No phone survives that, which is why a Fortnite match holds 100 players and Travis Scott’s Fortnite concert drew over 12.3 million players at once in copies capped at 50.

So I build one show and many rooms:

• Shard. Rooms of 50 to 100, locked to one show timeline, so every room hits the drop together.
• Cull. Interest management syncs only the people near you. The server (Photon, Nakama or Unreal dedicated servers) holds the truth.
• Instance. Distant avatars share one low-detail mesh, drawn with GPU instancing. Voice only carries nearby.
• Overflow. Past capacity, or on a weak device, you get the live stream.
• Load-test. Bots fill every room before the doors open.

On the night I watch who is still there for the last track. Peak concurrency makes the press release. Retention says the show worked.

Do you need a virtual event platform or a custom build?

If your event is mostly talks on video, a ready-made virtual event platform will do the job. A custom build earns its place when the venue itself is the point: my team of 12 worked on Virtual Expo Dubai, the whole Expo site in real-time 3D, and DMCC’s Crypto Centre, launched with Napster, opens from a link in a desktop browser with nothing to install. Whichever you choose, ask three questions before you sign: does it open from a link on a phone, how does it split a big audience into rooms on one show timeline, and what happens past capacity? My answer for 1,000 people is above: rooms of 50 to 100 locked to one timeline, with a live stream for the overflow.

What is a digital twin of an event?

Months before the gates of Expo 2020 Dubai opened, the master plan model stood next to a tablet running the interactive plan. You could already find your way round pavilions that did not exist yet.

That is a digital twin: a real-time 3D copy of a venue that people can visit before the doors open and after they close. At Expo, my team of 12 worked on Virtual Expo Dubai, the whole Expo site in real-time 3D. The Expo closed. The twin is still live. If you want digital twin examples, start there.

A twin earns its keep 3 times. Before opening, it sells the place to sponsors. During the live event, it lets people who cannot travel walk in. After closing, it keeps the doors open.

Do people need a VR headset?

No. Open a laptop, click a link, and you are in the lobby of DMCC’s Crypto Centre, looking out over Dubai. Walk into a boardroom where avatars meet, or join the treasure hunt. Nothing to install: it runs on WebGL in a desktop browser. DMCC launched it with Napster, where I led a 24-person team.

The big audiences point the same way. Carl Cox’s show was built for VR, and its biggest numbers came on YouTube. Bruno Mars drew over 12.8 million players at once to a concert on Roblox. Meta is taking Horizon Worlds almost exclusively to mobile.

Every step up in fidelity costs reach, so I pick the engine by where the audience already is:

• WebGL (three.js): an interactive 3D website that opens from a link on almost any device. Most reach, tightest budget.
• Unity: apps on phones and handhelds, with more headroom.
• Unreal Engine: the best visuals, downloaded or streamed as video through Pixel Streaming, which reaches any phone but rents a cloud GPU for every viewer, about $0.53 an hour each on AWS.

What should you bring if you want one built?

Bring 5 things.

1. The goal and its one number. Sales, appointments, minutes inside, people still there at the end. Pick one, and every build decision gets checked against it.
2. Who it is for, on which devices. If your customers live on their phones, the phone is the spec.
3. The assets you have. CAD and 3D files, packshots, brand guidelines, footage, floor plans. Every real file is one I don’t rebuild by eye.
4. The moment it has to work live. A premiere, a store opening, a product drop. I plan back from that minute, the way live TV plans back from air.
5. Who signs off. Everyone will have a view. One person owns the yes.

From those 5, I write the brief back to you on one page: the number, the devices, the performance budget for the weakest device, what we build, what we buy (multiplayer, voice, checkout) and what we cut. That page sets the cost and the timeline.

How much does a 3D website or product configurator cost?

On published price lists, a 3D product showcase starts at about $2,000, a product configurator at about $25,000, and a custom 3D store you walk through reaches $200,000 and more. The 3D models of your products usually come on top.

These are market ranges from agency and vendor pricing pages, checked in October 2026. They are not my prices.

• 3D product viewer or tap-through showcase: $2,000 to $5,000, built in 3 to 4 weeks from a template (GlamAR).
• Product configurator with variants: from $25,000 up to $150,000 (Program-Ace). Twikit tells small and mid-size businesses to budget $25,000 to $75,000, and Kolonell quotes 25,000 to 80,000 EUR over 3 to 5 months.
• 3D virtual store or virtual showroom: $5,000 to $25,000 from a template in 4 to 8 weeks (GlamAR), or $50,000 to $200,000+ built custom (Zolak).
• Multiplayer world or live event: $100,000 to $1 million for simulation and sandbox metaverse projects (300Mind, 2023).
• Each 3D product model: $200 to $1,000, or $150 to $500 each from 10 products up (Talo), and $500 to $5,000+ per variant at configurator quality (Twikit).
• AR try-on: $20,000 to $60,000 and 8 to 12 weeks as one feature added to an app (RaftLabs), or from $40 a month as an add-on to a rented configurator (Zakeke).
• Checkout and shop integration: $15,000 to $50,000 for a standard implementation (Twikit).

Three things drive every one of those numbers:

1. Asset creation. How many products, and how close people look. A product people zoom into costs more to model than one seen across a room.
2. Optimising for phones. Polygon budgets, baked lighting, compressed textures and testing on the weakest device. It has no price of its own in these lists. It sits inside the build line and is a big reason that line is wide.
3. Integration. Basket, prices, stock, a CMS your team edits, analytics. Twikit warns hidden costs can add 30 to 50% to a first estimate.

Pick a scope below and the range rebuilds from those sources, line by line.

Open the interactive diagram on tawfik.tv

If you want a range for your own products, see how I take on 3D web projects.

So what happened to the metaverse?

Only the word went away. People never stopped shopping from the sofa, dancing in clubs that do not exist or visiting venues before they open. Those worlds now live in browsers, on phones and on handhelds, with the headset as one screen among many. Your audience does not need new hardware. They need a link worth opening.

Live TV taught me to make things work on the night, the first time. A virtual store, a live show and a game ask for exactly that.

Frequently asked questions

Unreal or Unity?

Unreal when visuals come first. Unity for apps on phones and handhelds. WebGL when it has to open from a link.

Can Unreal Engine run in a browser?

Yes, through Pixel Streaming: it renders on a cloud GPU and streams video to the browser. When each viewer controls their own session, each needs their own instance, so cost grows with every viewer. It gets expensive fast: one streaming GPU server on AWS costs about $0.53 an hour, so 1,000 people exploring at once is roughly $526 an hour in GPUs alone, before bandwidth and the spare servers you keep warm for the rush. A WebGL build costs one download per visitor instead, so I only stream when the visuals are worth the bill.

How much does a virtual store or virtual event cost?

It depends on 4 things: how many products are rebuilt in 3D, how real they must look, how many people join at once, and whether it runs live once or stays open. The same 4 set how long it takes.

How much does a 3D website cost?

On published price lists, from about $2,000 for a 3D product showcase built from a template to $200,000 and more for a custom 3D store, before the 3D models of your products. The calculator above shows which choices move the number.

How much does a 3D product configurator cost?

Public ranges run from about $25,000 to $150,000 to build, plus $150 to $5,000 or more for each product model, depending on how close people look. Renting one from a platform such as Zakeke starts at $59 a month for 10 products.

How long does it take to build a 3D virtual store?

Published timelines run from 4 to 8 weeks for a store built from a template to 3 to 5 months for a configurator with pricing and shop integration. Modelling the products runs alongside, at 3 to 10 days per model for one modeller.

How do you make a virtual concert?

Capture the artist, build the avatar and the venue in a game engine, run the show from one cue list, then split the audience into rooms locked to one timeline, with a video stream for everyone else. The 6 steps are above.

Can a virtual concert run in a browser?

Yes. A WebGL build opens from a link on almost any device. Unreal Engine can stream to a browser through Pixel Streaming, at about $0.53 an hour in cloud GPUs for every viewer. Carl Cox’s show reached its biggest audience on YouTube.

Is a digital twin the same as a 3D virtual tour?

No. A virtual tour is photos you click through. A digital twin is a real-time 3D model you can walk through and run live.

Can customers try products on?

Yes. Glasses and sunglasses can be tried on through the camera, as in the TAG Heuer build.

If you want a virtual store, a live experience or a game built, email m@tawfik.tv.

Can one person build a real app with AI?

Yes. I built Laqtaa on my own for a friend’s wedding. About 100 guests used it on the day and nothing broke.

The problem: people pay the equivalent of about $1,000 for a wedding photographer, the pictures rarely get shared, and they end up forgotten. Guests’ own phone photos scatter across chats.

The solution: guests scan one QR code and every photo lands in one shared live album. No app to install. 10 languages, including Arabic. It is live at laqtaa.app.

Before any code I wrote a 780-line brief with a hard deadline days before the wedding. On the first day, 6 milestones were built and deployed in 53 minutes. A couple of hours later the next commit read “resolve all critical runtime bugs”. Fast, then humbling.

Over 5 weeks that became 188 commits: 93 fixes and 69 features.

How much does an app like this cost to run?

Laqtaa costs about $46 a month to run, against the roughly $1,000 people pay for one wedding photographer.

That is $20 for a Vercel Pro plan, $25 for a Supabase Pro database and about $1 for the domain, and the two plans also carry my other projects.

Did Laqtaa make money?

No, and it was never meant to. It was a test of a product thesis and of market fit. I built no funnels and no go-to-market plan. It spread locally anyway, to more weddings and to friends of friends, and people still use it today. Word of mouth did that, not marketing.

What breaks when you build an app with AI?

When you build alone, what breaks is everything a team normally catches: scope, testing on real phones and the fallback plan.

Nobody said no. The brief scoped 2 languages and I shipped 10. A 3D iris animation went in and came out 10 days later. Late one night the design flipped to a new direction and back again inside half an hour. On a team, somebody would have asked why.

Bugs came back after QA was called done. The camera froze after a phone call. “Download all” crashed phones. Events were created as “open” while the database only showed “live” ones.

And no slate was loaded. In live TV, the “technical problems” slate is ready before you go on air. My brief planned 11 acceptance tests and a fallback switch. The repo ended with 1 test file and no fallback. I noticed, had no time to build it, and did not need it. That was luck. It was not a plan.

Will AI replace product teams?

No. AI replaced the typing. It did not replace the person who says no, testing on real phones, a fallback plan, or the person who catches the wrong name on screen.

At the PyeongChang Winter Olympics I worked on the transmission side of the host broadcaster’s Olympic news channel. My sticky note from that job had lines like “uplink from van 26 is weak, needs a stronger antenna” and “I need Monday off”. Every line on it was somebody else’s job. That is what a live system is: a room of people who each own one thing.

During a World Cup football match, a slug, the caption on screen, went up with the wrong player’s name. That is the mistake a live team exists to catch. Faster typing does not catch it. On Laqtaa there was one pair of eyes on the monitor. Mine.

What does a product leader do when AI does the typing?

The same job as before: decide what not to build, test on real devices, and load the fallback. When the typing is cheap, judgement is the job.

I have led teams across countries, on site and remote, for more than 11 years. At Napster I led a 24-person team of developers, designers and producers across Unreal, Unity and WebGL, including the DMCC Crypto Centre metaverse in Dubai, which we launched.

On Laqtaa I was the whole team, and the gaps showed where those people would have stood: the producer who cuts scope, the tester on real phones, the engineer who loads the slate before air.

So can one person with AI do a whole team’s work?

The building, yes. I have 188 commits and about 100 wedding guests to show for it. The catching, no. That still takes other people. If you build alone, write down who would have said no, then say it to yourself. Load the slate before you go on air. And get someone else to watch for the wrong name.