LeafLedger
Staff-only SaaS ERP for South African cannabis clubs: sales, stock, suppliers, and inspection-ready compliance records.
Product Walkthrough
Product tour
The Problem
South African cannabis clubs are legally required to track every member's stock movements and contributions, but most were running that on spreadsheets and paper logs, no audit trail, no reliable way to reconstruct stock history, and nothing that would hold up to a regulatory inspection.
The Goal
Build a staff-only ERP that gives club staff real-time visibility into stock, sales, and suppliers, while producing an inspection-ready, tamper-evident audit trail for every transaction, without requiring club members to interact with the system directly.
Overview
LeafLedger is a staff-only ERP for South African cannabis clubs, covering member KYC, supplier and product catalogues, movement-based inventory, order/dispense capture, and an append-only contribution ledger with full audit logging for regulatory inspection.
Architecture
Services Used
- • AWS Amplify
- • Amazon CloudFront
- • Amazon S3
- • Amazon API Gateway
- • AWS Lambda
- • Amazon RDS (PostgreSQL)
- • Amazon Cognito
Engineering Decisions
- • Modelled inventory as a movement ledger (receive, adjust, waste, transfer, dispense) so stock levels are reconstructed from history instead of mutated directly.
- • Used Cognito for staff-only authentication with server-side role enforcement, since club members never access the system directly.
- • Kept the contribution ledger and audit log append-only to preserve a tamper-evident compliance trail.
Tradeoffs
- • Manual, in-person KYC trades automation for the verification certainty regulators require in this industry.
- • Request/response only, no real-time updates, keeps the system simple at the cost of live dashboards.
Key Insights
- • Modelling inventory as an append-only movement ledger meant every stock figure was reconstructable and auditable, not just a mutable number that could silently drift from reality.
- • A staff-only access model removed an entire class of member-facing security concerns, shifting the compliance burden onto internal role management instead.
- • Append-only records simplify auditing but require derived views to answer "what is the current state", a tradeoff worth making for a regulated business.