Loski Internacional is a Colombian exporter of specialty coffee. In four weeks, WebMinds, an AI and software development company based in Atlanta, Georgia, built LOSKI TRACE: coffee traceability software designed for EUDR compliance. Every lot gets a structured code and an immutable chain of events (harvest, drying, bagging, dispatch and delivery) tied to geo-referenced farms and plots drawn over satellite imagery, with photo evidence, documents and a public QR code any buyer can scan to verify the full history with SHA-256 integrity checks. It runs on infrastructure the client fully owns.
Key facts
- 4 weeks from kickoff to production: first commit on February 28, 2026, MVP live on March 27, 2026.
- 7 immutable lifecycle events: created, harvest, drying, bagging, dispatch, delivery and correction.
- 10 of 10 tables under row-level security, with PostGIS points and polygons plus spatial and full-text indexes.
- 55 API endpoints across 11 NestJS modules, with 56 stable domain error codes.
- Farms with 30+ fields (SICA, FNC, ICA and CAR) and EUDR deforestation-free flags per plot.
Context: proof of origin, demanded lot by lot
International specialty-coffee buyers want to know exactly where a lot comes from: which producer, which farm, which plot and how it was processed. Since 2025, the EU Deforestation Regulation (EUDR) has added a regulatory layer on top: commodities like coffee entering the European market must be traceable to geolocated plots and shown to be free of deforestation.
At Loski, that information lived on paper, loose photos and spreadsheets, with no guarantee it had not been edited afterwards. The client was explicit about scope: the MVP could not be a prototype. It had to be the definitive core, ready for IoT, satellite validation and smart escrow without a rewrite.
The challenges:
- Buyers and the EUDR demand lot-level proof of origin, geolocation and deforestation-free status.
- Supply-chain records lived on paper and in spreadsheets, editable by anyone, with no audit trail.
- Smallholder producers, rural farms and a field team working mostly from phones.
- The MVP had to be the definitive core, fully owned by the client and ready to grow without a rewrite.
Why a generic traceability tool or spreadsheet template wasn't enough
There are traceability platforms and EUDR checklists on the market, and spreadsheets are always an option. The problem is trust. A record that anyone can edit later is not proof; it is a claim. Loski needed a history where the order of events is enforced, where nothing can be quietly changed, and where a buyer outside the company can check integrity without being given access to private data.
Coffee also brings its own vocabulary: Colombian registries such as SICA, FNC, ICA and CAR, processing steps like drying and bagging, and documents like phytosanitary and origin certificates. A generic tool would have forced those into free-text fields. Finally, ownership mattered: the client wanted the code, database, hosting and domain in its own accounts from day one, not a subscription to someone else's platform.
That is why the project began with a spec for the definitive architecture, agreed with the client, which combined our consulting and strategy work with web and app development.
What we built: LOSKI TRACE, coffee traceability software for EUDR
Six systems delivered as one platform in four weeks, deployed on the client's own Supabase, Vercel and Render accounts with its own domain.
An event-sourced traceability engine
Each lot is a timeline of seven lifecycle events, enforced in order and immutable at the database level. Mistakes are fixed with a correction event that references the original, never by editing history.
Immutability is enforced by trigger, not by good intentions: a PostgreSQL trigger makes it impossible to edit or delete an event, even with direct database access. The required event order lives in a shared package used by both the API, which rejects out-of-order events, and the mobile wizard, which blocks the user and explains why.
A SHA-256 integrity layer
Every event is sealed on the server with a SHA-256 hash and can be verified by anyone, including buyers through the QR. Getting this right meant solving a subtle problem: Postgres and Node format timestamps differently, which produced false "tampered" alerts. We normalize timestamps and sort metadata keys before hashing, and verification stays backward-compatible so no historical hash is ever invalidated.
A geo-referenced producer, farm and plot registry
Producers, farms with 30+ fields (including SICA, FNC, ICA and CAR data) and plots drawn as polygons over satellite imagery, with area computed in hectares and EUDR deforestation-free flags alongside. This is the data foundation that EUDR due diligence depends on.
Lot identity and a public QR
Structured lot codes are generated atomically: an upsert on a per-producer, per-year sequence table creates each code without race conditions, and a self-healing version recovers if the sequence ever drifts. Each lot has a scan-to-verify public history that hides sensitive data by design. The QR shows the story, not the secrets: no ID documents, no coordinates, no prices, no buyers and no documents leave the private platform.
Evidence and documents
Field teams log each step with photos and GPS from a mobile wizard. Event photos and lot documents (phytosanitary, origin, quality, transport and invoice) upload straight to storage through signed URLs.
Invitation-only access by role
Three roles (admin, operator and producer), a dedicated producer dashboard, and transactional email for invites, new events and completed lots.
Under the hood
LOSKI TRACE is not a dashboard. It is a traceability data model with its business rules encapsulated in the database (triggers, an atomic RPC and row-level security) and in a NestJS API with strict validation. Roughly a third of the code, and most of the engineering decisions, live below the UI: 36 security policies across tables and storage, 19 coffee-domain enum types in Postgres, 25 versioned migrations and 55 REST endpoints in 11 modules.
It is also built to grow without a rewrite. Every event already records its source (manual, IoT or API) and an external reference, so sensors, satellite checks or an ERP can plug in as new event types, exactly as the spec required.
We built it with Hybrid AI Coding: senior engineers own the architecture, the data model and every decision with the client, while AI agents accelerate implementation under independent review. That is how a definitive, production-grade core shipped in four weeks.
Exporting coffee, cocoa or another commodity and facing EUDR questions from buyers? Get a free assessment and we will review what your traceability data needs.
Timeline
- February 2026: spec for the definitive architectural MVP, agreed with the client.
- February 28, 2026: monorepo, data model, row-level security, triggers and the atomic lot-code RPC; backend and dashboard start the same day.
- March 3, 2026: SICA, FNC, ICA and EUDR fields across producers, farms, plots and lots.
- March 11, 2026: public QR view, email notifications, profiles and maps.
- March 14, 2026: backward-compatible integrity verification, role-based dashboards and the producer experience.
- March 27, 2026: handover of code, database, hosting and domain on the client's own accounts.
Results
Proof of origin, built in
Every lot carries a tamper-evident history, from the plot polygon to the delivery dock, that a buyer can verify with a phone camera. The database itself enforces that integrity, not a process.
EUDR-ready from day one
Geo-referenced farms, satellite-drawn plot boundaries and deforestation-free flags give Loski the data foundation European buyers and regulators now require, without a separate compliance tool.
A core that grows without a rewrite
The event model already anticipates IoT sensors, satellite checks and external systems as new event sources, on infrastructure Loski owns end to end. See the screens in the Loski case study.
FAQ
What does coffee traceability software need for EUDR compliance?
At minimum, a reliable link between each lot and the geolocated plots it came from, plus evidence that those plots are deforestation-free. LOSKI TRACE stores plots as polygons over satellite imagery with EUDR flags and ties every lot event back to them.
How can a buyer trust that the lot history was not edited?
Events cannot be edited or deleted, even with direct database access, because a trigger blocks it. Each event is sealed with SHA-256, and buyers can verify the hashes themselves by scanning the lot's QR code.
Does the public QR expose sensitive farm or commercial data?
No. The public view shows the lot's story but hides ID documents, coordinates, prices, buyers and documents by design. Those stay in the private platform.
Can field teams use it from their phones?
Yes. The event wizard is built for mobile, so field teams log each step with photos and GPS, and the producer has a dedicated dashboard.
Can this kind of platform work for other supply chains?
The architecture is not coffee-specific in principle: an immutable, sealed event log tied to geo-referenced origins applies to many supply chains. For other logistics work, see our Kila freight document engine and the ANT Mobility freight marketplace.
Make your supply chain verifiable
Loski went from paper records to a traceability core buyers can check themselves, in four weeks. Read the full LOSKI TRACE case study for the architecture and screens.
Get your free assessment or book a call to talk through your traceability needs.