The problem

Corporate buyers and data centers in Singapore and Johor want renewable energy and carbon credits, but sourcing them across borders is slow and risky. Deals happen over email and brokers, nobody can easily confirm who a counterparty really is, and a single certificate can be sold twice. GreenGrid APAC is a B2B marketplace that connects these buyers with solar developers in Indonesia, Malaysia, Vietnam and Laos, and treats trust as the product: every company is verified, and every listing is checked before anyone can see it.

What we built (Phase 1)

Trust and onboarding

• Multi-user companies with role-based access (company admin, procurement, finance, legal, sustainability, viewer) and two-factor authentication
• KYC/AML onboarding: document upload validated by content and size, sanctions screening, and an admin review queue that shows the time left for each decision

Listings and discovery

• Sellers create separate listings for energy and for carbon credits, because the two assets have different data (carbon credits are not measured in MW)
• Buyers search with filters for capacity, country, price, duration and asset type

Verification before visibility

• A listing becomes ACTIVE only after a platform admin verifies its certificate. There is no other path to ACTIVE, so unverified supply never reaches buyers

Admin and operations

• Admin panel with KYC queue, listing moderation and platform settings
• A four-eyes rule for high-impact actions: one admin proposes, a second approves, a written reason is required, and an admin cannot process a company they have a stake in
• Every admin action is written to an audit log with its reason
• Email notifications for KYC and listing decisions go through a queue, so a mail outage never blocks the main action

How we built it

We started with the document, not the code. Before writing a line, we stress-tested the product requirements with a structured audit that found 24 gaps: three conflicting definitions of when escrow money is released, certificates of different kinds mixed under one name, a data model that allowed one user per company while the user stories described five roles, and more. Those findings decided what went into Phase 1 and what we deliberately cut, such as contracts, escrow and payments.

Each feature was then built against acceptance criteria quoted from the PRD, in small steps, with tests written alongside. The suite has 114 automated tests (Pest), all passing, and we re-ran it after every feature.

Stack

Laravel, PHP, MariaDB, Blade, Pest.

What we learned

The riskiest parts of a marketplace are the rules, not the screens: who is allowed to do what, and what must be true before something becomes visible. Writing those rules down first, and then making the code refuse everything else, saved us from the contradictions the audit had flagged.

What’s next

Phase 2 adds offers, contracts, escrow with milestone-based payouts, and dispute handling, on top of the verified supply that Phase 1 now provides.