Car sharing with Citylink

Context

Car sharing is a simple pitch with a brutal fact behind it: you are handing a stranger a car worth tens of thousands of euros, with no human in between. Citylink runs that model, and HipCar in Moldova ran the ride-sharing sibling of the same problem. I was CTO across 2018 to 2025.

Everything on the platform — the app, the booking flow, the pricing — is secondary to two questions. Is this person who they say they are, and can we prove what happened to the car afterwards. Get either wrong and you do not have a product, you have an insurance incident.

Constraint

Identity checks had to be strong enough for real liability, in two countries with different document systems, without making signup feel like a mortgage application. A review team reading documents by hand scales linearly with signups and still gets tired at 2am on a Saturday, which is exactly when cars get taken.

The car side had its own constraint: unlocks happen in underground garages and dead zones. A system that needs signal to open the car strands a paying customer next to the vehicle they booked.

Decision

We rejected manual document review and wired the official registries in directly — verifying the vehicle exists, the documentation is valid and the driver is licensed, against external sources. It cost integration work up front and kept onboarding same-day at any volume, with no review queue that could quietly become the bottleneck.

We built unlock over phone-to-car Bluetooth, because Bluetooth works without signal in a parking garage. But every unlock still writes a server-side audit record, so a disputed trip has evidence — where the car was, who opened it, and when. Convenience offline, accountability online.

We put OBD2/CAN telemetry in from day one even though the first release did not need it. Fuel, mileage and fault data turned out to be the difference in damage disputes and maintenance scheduling later, and retrofitting hardware across a live fleet is the kind of project that never happens.

What shipped

Citylink: car sharing with production KYC, verifying users are real people and are the actual person using the car, with Bluetooth/IoT car access and vehicle telemetry. HipCar in Moldova: ride sharing with driver KYC wired into external vehicle and licence registries. React Native apps, PHP backends, AWS infrastructure, IoT hardware in the cars.

Numbers

Two mobility platforms shipped across two countries. External registry verification on every driver and vehicle, with no manual review queue. Every car unlock — online or offline — backed by a server-side audit trail.

What I'd do differently

I would have designed the dispute flow earlier than we did. When a customer says the car was already damaged and the platform says it was not, the answer is telemetry plus timestamps plus photos, and the flow that gathers them in the moment matters more than the evidence you can reconstruct later.

I would also have standardised the vehicle hardware earlier. Two platforms grew with slightly different IoT setups, and every firmware difference becomes a support conversation that did not need to exist.