Brand identity
Configured per programmeLogo, colour tokens, typography and tone applied to the partner-facing surfaces in scope.
Managed by Shared

TaxiD White-Label Platform
Launch a branded mobility experience backed by TaxiD’s booking, fulfilment, payment, settlement and reporting infrastructure. Build your customer proposition while operating through a governed platform and partner model.
You own your brand and customer relationship. TaxiD provides the mobility infrastructure within the agreed programme scope. Transport image is illustrative, not evidence of available fleet.
Your identity, your distribution, your customer proposition. The scope below distinguishes configurable experiences from features still on the roadmap.
YOUR NEXT JOURNEY
Pickup · Nairobi
Destination · Airport transfer
Quote subject to admitted supply and availability
Your identity at the front.
TaxiD infrastructure underneath. Brandable surfaces are admitted and configured for your programme.
Logo, colour tokens, typography and tone applied to the partner-facing surfaces in scope.
Managed by Shared
Branded quote-and-book journey for the services admitted to the programme.
Managed by Shared
Order history, tracking and documents under the partner brand.
Managed by Shared
Operational workspace at /partner/workspace for the partner's own staff.
Managed by TaxiD
Partner sender name and template content; authenticated sending domain is agreed during provisioning.
Managed by Shared
Partner brand on documents, with statutory identifiers and tax data fixed by the issuing entity.
Managed by Shared
Partner-owned hostname with DNS verification and managed TLS.
Managed by Shared
A store-published branded app is not part of the white-label programme today.
Managed by Partner
Alphanumeric sender IDs depend on the operator and market and are arranged per programme.
Managed by Shared
Brand profiles cover logo, colours, typography, app and email identity, notification templates, legal identity and customer-facing policies—only within the admitted surface scope.
A clear path from your customer proposition to an accountable, settled and reported order.
Tenant isolation, security, governance, observability and compliance span every stage.
Explore architecture, tenant boundaries and order statesService admission and market coverage require operational approval. A programme never inherits every service or every city by default.
Admitted per market and vehicle class.
Scheduled pickups with flight reference on the order.
Employee travel with cost-centre attribution.
Assigned chauffeur supply, contracted per programme.
Quotation-led; priced from the governed charter rate card.
Bus, van & coach · Aircraft · Helicopter · Marine
Recurring routed movements agreed with operations.
Available in Nairobi operations; other markets by agreement.
Inventory-dependent; availability confirmed at quoting.
Handled as a contracted arrangement, not as a booking flow.
Not admitted to the white-label programme today.
Full catalogue in scope
Payments settle in KES via M-Pesa and card rails.
Ride, transfer, charter, shuttle
Supply density confirmed before launch.
Charter and contracted movements
By agreement, with lead time on supply.
—
No white-label availability today; expansion is assessed per market.
Coverage classifications are programme scope, not a guarantee of supply or a payment test for your tenant. Payment-rail availability must be verified before launch.
Documented platform controls, with roadmap items kept distinct. These labels are not a certification or an independent security assurance.
The operating model defines who does what. Legal accountability remains governed by the signed agreement.
Partner
Marks, tone and approved customer-facing presentation.
Acquisition, first-line commercial contact and retention.
Channels, campaigns and demand generation.
TaxiD
Quoting, ordering, tracking, documents and the operating platform.
Supply admission, assignment and completion of journeys in scope.
Charge capture, statement generation and reconciliation records.
Shared
TaxiD governs the rate structure; partner margin is contracted per programme.
Partner takes first line; TaxiD operates mobility escalation in scope.
Joint review cadence against the agreed measures.
Each party is accountable for its own regulated obligations under the agreement.
Scope, markets, services, volume and integration requirements determine the agreement. Negotiated rates and contract-specific terms are not public price lists.
One-off, sized from the agreed scope of services, markets and integration work.
Per completed order, tiered by monthly volume.
Applied on top of the governed rate, agreed per service and market.
Settlement period and payment window fixed in the agreement.
Where a programme carries dedicated supply or operations capacity.
Allocated by cause between partner and TaxiD under the agreement.
Charged and remitted by the issuing entity per Kenyan tax law.
Selected support tier and the associated response targets.
Only verified payments are recognised. Corrections create adjustment entries; historical ledger records are never edited.
Finance, settlement and contractual service levelsThe same governed API platform used by API partners. Start with scoped capabilities; keep endpoint specifications in the developer resources.
Capability domains, endpoints, scopes and webhook catalogue.
Usage, quotas, OpenAPI versions, webhook verification, delivery log and credential rotation.
Reference material for the published surface.
Entry point for partner engineering teams.
Operational workspace for an admitted partner.
The enterprise proposition this programme sits inside.
Scoped credentials · Signed webhooks · Idempotency keys · Versioned OpenAPI · Tenant-scoped access
Capability evidence and compatibility contractsTen stages. Named owners. Evidence at every gate. Mandatory production-readiness stages cannot be bypassed.
Controlled exposure, hypercare, incident escalation and joint reviews keep the programme governed as it grows.
Booking quality, payments, webhook delivery and reconciliation exceptions feed the operating review.
Named escalation owners, staged exposure and agreed rollback criteria support incident handling.
Changes follow notice and approval rules. Breaking changes and scope changes require recertification.
Architecture, controls, commercial terms and operational procedures remain accessible here—without interrupting the main narrative.
A partner request enters at the top of this spine and leaves as a settled, reported, documented journey. Each layer is a real system boundary with its own authorization.
Partner
Contracting legal entity
Tenant
Brand, services, markets, environment
Brand configuration
Identity applied to surfaces in scope
Customer experience
Branded booking and tracking surfaces
Booking / API
Quote, order, cancel, track — scoped credentials
Canonical mobility order
One order record, one state machine
Operations
Exception handling, support escalation
Dispatch / fulfilment
Supply assignment and completion
Payments
Capture on verified provider callback
Settlement
Append-only ledger and sealed statements
Reporting
Performance, usage and reconciliation
Tenant A cannot reach Tenant B, and sandbox cannot reach production. Isolation is enforced in the database by row-level security, so a UI defect cannot leak another partner's data.
The contracting legal entity.
Root of every scope below; created by the partner desk on admission.
One operating configuration of a partner (brand, services, markets, environment).
Sandbox and production are separate tenants; credentials never cross them.
The partner's own staff and their permissions.
Row-level security scopes every read and write to the caller's partner membership.
End customers of the partner brand.
Visible only inside the owning tenant; never pooled across partners.
Canonical mobility orders raised under the tenant.
Tenant-scoped; cross-tenant reads are rejected server-side, not hidden in the UI.
API keys and webhook secrets.
Issued per tenant and environment, revocable, with an append-only audit trail.
Receipts, invoices and statements.
Tenant-scoped, hash-sealed and verifiable independently of the UI.
Charges, fees, statements and reconciliation.
Tenant-scoped, append-only; corrections are adjustments, never edits.
A brand profile is attached to the tenant at provisioning and applied to the surfaces in scope. Some information is deliberately outside its reach.
The customer sees one continuous branded experience. Behind it, each step has an accountable operator.
One order record carries the journey from quote to settlement. These are the only states, and the only transitions the platform allows.
| State | Meaning | Allowed next |
|---|---|---|
| QUOTED | A priced, time-bounded offer exists. | PENDING · EXPIRED |
| PENDING | Accepted by the customer, awaiting confirmation of supply or payment authority. | CONFIRMED · CANCELLED · FAILED |
| CONFIRMED | Commitment made; the order is owned by operations. | ASSIGNED · CANCELLED |
| ASSIGNED | Supply is allocated to the order. | STARTED · CANCELLED |
| STARTED | Fulfilment is in progress. | COMPLETED · FAILED |
| COMPLETED | Fulfilment finished; charge and documents are raised. | terminal |
| CANCELLED | Terminated before completion; cancellation terms apply. | terminal |
| FAILED | Could not be fulfilled; exception handling applies. | terminal |
| EXPIRED | A quote lapsed before acceptance. | terminal |
White-label runs on exactly the same API platform published for API partners — one surface, one set of scopes, one changelog. There is no separate, undocumented white-label API.
Capability domains, endpoints, scopes and webhook catalogue.
OpenUsage, quotas, OpenAPI versions, webhook verification, delivery log and credential rotation.
OpenReference material for the published surface.
OpenEntry point for partner engineering teams.
OpenOperational workspace for an admitted partner.
OpenThe enterprise proposition this programme sits inside.
OpenScoped credentials per tenant and environment
Signed, replay-bounded webhooks
Idempotency keys on every mutating call
Versioned OpenAPI with published diffs
Each branded surface is sourced from the same capability model as the API partner platform, with a mandatory X-TaxiD-Tenant header and tenant identity on every webhook envelope.
Server-governed quoting, identical to the API partner surface.
Canonical mobility order with idempotency keys and a closed state machine.
Scoped share tokens safe to render inside the partner brand.
Partner brand on receipts and invoices; statutory identifiers fixed by the issuing entity.
Tenant-scoped statements enabled per programme at provisioning.
Per-tenant, per-environment credentials with rotation and an append-only audit trail.
Only controls that exist are listed as controls. Everything else is marked roadmap or contractual — a security architect should be able to plan against this table without a call.
Tenant isolation
LiveRow-level security scopes every partner read and write to the caller's membership; cross-tenant access is denied in the database, not the UI.
Scoped credentials
LiveAPI credentials are issued per tenant and environment by the integration desk, with revoke and rotation history.
Role-based access control
LivePartner staff hold explicit roles; privileged actions are checked server-side on every call.
Webhook signing
LiveHMAC-SHA256 over `${timestamp}.${rawBody}` with a bounded replay window and a verification console.
Audit logging
LiveCredential, lifecycle and document events are recorded append-only with actor and timestamp.
Encryption in transit
LiveTLS on every partner-facing endpoint; plaintext transport is refused.
Secrets management
LivePlatform secrets are held in managed secret storage and never returned to a browser.
Sandbox separation
LiveSandbox credentials cannot reach production data, and production credentials cannot reach sandbox.
Single sign-on for partner staff
RoadmapEnterprise IdP federation for partner workspace users.
Multi-factor authentication
RoadmapSecond-factor enrolment for partner workspace users.
IP allow-listing
RoadmapRestricting production credentials to declared egress ranges.
Data minimisation
LiveOnly the traveller data required to quote, fulfil, document and settle a journey is collected.
Access logging
LivePrivileged reads of partner and customer records are recorded with the acting identity.
Data residency
Configured per programmePlatform data is held in the managed cloud region agreed at provisioning.
Retention and deletion
ContractualRetention periods and deletion handling are set in the data-processing terms of the agreement.
Data subject requests
ContractualRequests are routed through the partner as first line and executed by TaxiD for platform-held data.
Subprocessors and incident notification
ContractualNamed in the agreement, with notification obligations on both parties.
Each step names its source of truth. Nothing in this chain is edited after the fact — corrections are new entries.
A completed order fixes the billable scope.
Source of truth: Canonical order record
Fare, surcharges, waiting and tolls are computed from governed pricing.
Source of truth: Pricing engine output stored on the order
Captured from the customer or drawn from a pre-funded partner wallet.
Source of truth: Verified payment-provider callback
Platform fee, partner margin and applicable tax are applied to the charge.
Source of truth: Contracted commercial schedule
Amounts due are accumulated over the agreed settlement period.
Source of truth: Append-only settlement ledger
A sealed statement is issued for the period.
Source of truth: Issued document with content hash
Statement, payments and orders are matched line by line.
Source of truth: Reconciliation run output
Refunds, reversals, adjustments and disputes are raised as new entries.
Source of truth: Adjustment entries — no ledger row is ever edited
The structure is published; the numbers live in the signed agreement. TaxiD does not publish white-label pricing, because it is sized from scope, services, markets and volume.
| Term | Basis | Status |
|---|---|---|
| Implementation and setup | One-off, sized from the agreed scope of services, markets and integration work. | Contractual |
| Transaction fee | Per completed order, tiered by monthly volume. | Contractual |
| Partner margin | Applied on top of the governed rate, agreed per service and market. | Contractual |
| Payment terms | Settlement period and payment window fixed in the agreement. | Contractual |
| Minimum volumes | Where a programme carries dedicated supply or operations capacity. | Contractual |
| Refunds and chargebacks | Allocated by cause between partner and TaxiD under the agreement. | Contractual |
| Taxes | Charged and remitted by the issuing entity per Kenyan tax law. | Contractual |
| Support and service levels | Selected support tier and the associated response targets. | Contractual |
Targets and objectives are how the platform is run and reported. A commitment exists only where the agreement says so.
Booking API availability
SLOInternal service-level objective, reported monthly to the partner.
Quote latency
TARGETOperational target tracked in the developer console; not a contractual commitment.
Webhook delivery
TARGETRetried with backoff; every attempt is recorded with a correlation ID.
Incident response
CONTRACTUALSeverity definitions and response targets are set in the agreement.
Planned maintenance
CONTRACTUALAdvance notice window agreed per programme.
Service credits
CONTRACTUALWhere agreed, credits attach to the contracted measures only.
Production exposure is staged, and every stage has a defined way back. Hypercare ends on evidence, not on a date.
The relationship does not end at go-live. It enters a loop with recertification built into it.
Breaking API change
RecertificationAdvance notice with a dated migration window and a supported previous version.
Additive API change
Published in the changelog; no partner action required.
Pricing change
Notice period as set in the agreement.
Service or market change
RecertificationAgreed with the partner before configuration changes.
Policy or legal change
Notified with the effective date.
Security change
Notified; may be applied immediately where a risk requires it.
Brand change
Partner-initiated, reviewed against the brand immutables before publication.
1. Detection
Platform monitoring, partner report or customer escalation opens an incident.
2. Severity
Classified by customer impact and financial exposure using the agreed severity scale.
3. Escalation
Routed to the accountable operations and engineering owners.
4. Partner notification
Issued for incidents that affect the partner's customers or settlement.
5. Mitigation and recovery
Containment first, then service restoration, with staged re-exposure where traffic was withdrawn.
6. Root cause analysis
Documented cause, contributing factors and detection gap.
7. Corrective action
Tracked to completion with an owner and a date.
8. Post-incident review
Reviewed jointly at the next governance session.
Requests fail closed with typed errors; no order is silently created or lost.
Orders remain valid and queued; operations fall back to manual assignment.
Capture is deferred and retried; orders are not marked paid without a verified callback.
Quoting degrades to agreed fallback pricing rather than producing an unpriced order.
Managed platform recovery; recovery objectives are agreed contractually rather than published.
Retry with backoff plus a delivery log with correlation IDs for replay.
Credential revocation, containment and partner notification under the agreed notification terms.
What gets measured, and the forum that owns each decision.
Partner eligibility
Partner deskAdmission, suspension and exit criteria.
Brand approval
Brand reviewCustomer-facing presentation checked against the brand immutables.
Service and market approval
OperationsWhat the tenant may sell, and where.
Security
Security reviewCredentials, access, isolation findings and remediation.
Data governance
Privacy reviewProcessing scope, retention and data subject handling.
Commercial governance
Commercial reviewPricing, margin, volume and settlement performance.
Change governance
Change boardNotice, impact, testing, recertification and rollback.
Performance governance
Joint reviewScheduled review of the agreed measures and actions.
Published so a buyer can challenge us on any statement above. Each claim carries a status and the evidence behind it.
| Claim | Category | Status | Evidence |
|---|---|---|---|
| Partner data is isolated per tenant | Security | Live | Row-level security policies scoped to partner membership, exercised by authorization tests. |
| Webhooks are signed and replay-bounded | Security | Live | HMAC-SHA256 signature scheme with a tolerance window and a verification console. |
| Credentials can be rotated and revoked with history | Security | Live | Credential audit records written on create, rotate and revoke. |
| Settlement records are append-only | Finance | Live | Corrections are recorded as adjustment entries; no ledger row is updated in place. |
| Branded booking experience | Product | Configured per programme | Brand profile applied per tenant during provisioning. |
| Custom partner domain | Product | Roadmap | Not implemented; shown as roadmap on the public page. |
| Branded native mobile application | Product | Roadmap | No store-published white-label app exists. |
| SSO and MFA for partner staff | Security | Roadmap | Not implemented; explicitly labelled as roadmap. |
| Availability and latency commitments | Service levels | Contractual | Targets and objectives are reported; commitments exist only in a signed agreement. |
| Commercial pricing | Commercial | Contractual | No published price list; structure only. |
11 / Your next chapter
Tell us about your brand, target markets, service portfolio and integration requirements. Our team will assess programme fit, operational readiness and the appropriate commercial model.