Step 17 · Launch
Public chapterLicenses and policies
Position
SwiftBite’s payment acceptance and courier dispatch remain blocked until the founder holds verified processor, insurance, licensing, and jurisdictional evidence. White-label vendors may operate the technology, but the founder retains approval authority and incident ownership. Missing evidence means no launch exception, including for a merchant-referred driver.
Compliance register with owners
Authority and jurisdiction register
The founder owns the compliance register in an access-restricted business document repository. Retained local counsel approves the jurisdiction checklist; a licensed commercial insurance broker approves coverage requirements; the software vendor supplies technical evidence.
Before activation, record the operating city, state or province, applicable privacy authority, business licenses, delivery permits, worker-classification requirements, insurance limits, reporting deadlines, and renewal dates. An unresolved requirement blocks the affected activity. LLC registration does not substitute for operating licenses.
Payment and privacy controls
Use a PCI-validated payment provider’s hosted checkout or hosted payment components. Card data must pass directly to that provider, never through SwiftBite servers, support channels, analytics, or logs. Store only processor tokens, transaction references, payment status, and masked card details necessary for support. Never retain security codes.
The founder obtains the provider’s current Attestation of Compliance, the white-label vendor’s payment data-flow diagram, and a written responsibility matrix. The acquiring bank must confirm the applicable validation route; outsourcing alone does not establish SAQ eligibility or compliance.
Require unique accounts, multifactor authentication, least-privilege permissions, and logged administrative access. Merchants see their orders; couriers see assigned delivery details only. Prohibit shared accounts, personal-device exports, and card details in chat. Refunds go through the processor to the original payment method.
Publish a counsel-approved privacy notice before collecting customer information. Obtain separate, optional marketing consent. Restrict driver location collection to dispatch and delivery purposes; prohibit advertising reuse. Route access, correction, and deletion requests to the founder for identity verification and legally compliant fulfillment.
Vendor contracts must prohibit selling customer data, list subprocessors, support deletion and export, require breach cooperation, and disclose payment-page changes before release.
| Control | SwiftBite requirement |
|---|---|
| Account review | Monthly; remove departing users immediately |
| PCI validation | Before activation and thereafter on the acquirer-required schedule |
| Driver location and proof-of-delivery retention | Delete after 90 days unless a documented legal hold applies; policy ceiling subject to counsel approval |
| Credential files | Retain during authorization; counsel sets post-termination retention before onboarding |
| Financial records | Retain under the jurisdiction-specific tax schedule; segregate from operational location data |
| Security testing | Vendor supplies payment-page security, patching, and required scan evidence before activation and after material changes |
Courier authorization and safety
Each courier must provide identity evidence, a valid license appropriate to the vehicle, registration, and insurance documents naming the driver and vehicle. Obtain lawful consent for driving-record checks. Counsel defines permissible screening and adverse-action procedures.
The broker must verify coverage for paid food delivery, including waiting, travel to collection, and delivery. A personal auto insurance card without delivery coverage confirmation is insufficient. Obtain SwiftBite’s own broker-recommended liability coverage, including hired/non-owned auto exposure where applicable; courier coverage does not eliminate company exposure.
Maintain a dispatch eligibility record with document expiries, coverage confirmation, screening outcome, training acknowledgment, and founder approval. The vendor must support automatic blocking; absent that capability, the founder controls a verified dispatch roster.
| Trigger | Required action |
|---|---|
| Before initial dispatch | Verify documents and coverage; complete road-safety acknowledgment |
| 30 days before expiry | Request replacement evidence; policy reminder interval |
| Expiry, suspension, cancellation, or vehicle change | Block dispatch until reverified |
| Each dispatch session | Courier confirms fitness, vehicle safety, and unchanged eligibility |
| Monthly | Founder reviews official transport, municipal, insurance-regulator, and labor updates; counsel resolves applicability |
Couriers must park before interacting with the app, use seat belts, avoid impairment, secure food loads, and report collisions or unsafe conditions immediately. No delivery deadline overrides traffic law. Allow unsafe-delivery refusal without punitive dispatch treatment.
Publish delivery rates before acceptance. Track required working time and apply a pay-floor adjustment whenever delivery earnings fall below the applicable minimum-wage equivalent, with legally required expense treatment. Counsel must approve classification and the time-accounting method; contractor labels are not sufficient.
Incident response
For suspected payment compromise, disable the affected checkout path, preserve logs, revoke compromised access, and notify the processor and counsel. Resume only after containment and required approval. Counsel controls statutory notifications.
For a collision, prioritize emergency assistance, suspend the affected courier’s dispatch, preserve evidence, and notify insurers under policy terms. Do not admit liability or request unnecessary medical information.
The numbers
| Item | Figure | Basis |
|---|---|---|
| Starting capital | $85,000 | Grounding file |
| Personal burn reserve | $67,200 (estimate) | $4,800 × 14 months |
| Capital outside that reserve | $17,800 (estimate) | Before all other venture spending |
| Compliance setup allowance | $4,000 (estimate) | Counsel, broker, vendor review; quote-dependent |
| Recurring compliance allowance | $300/month (estimate) | Administration and verification; excludes insurance premiums |
| Merchant commission ceiling | 12% | Binding advertised cap |
| Consumer delivery fee | $3.99 | Grounding file; no hidden compliance surcharge |
| Commercial gate | Contribution-positive from month 1 | Include verification, insurance allocation, and pay adjustments |
Decisions and trade-offs
| Decision | Binding treatment |
|---|---|
| Hosted payments versus direct handling | Hosted payments only; reject card-data access features |
| Faster onboarding versus verified coverage | Verification wins; no provisional dispatch |
| Cheap vendor versus enforceable controls | Reject vendors lacking access logs, export, or dispatch blocking controls |
| Insurance affordability versus coverage | Obtain quotes before commitment; narrow operations rather than dispatch uninsured |
Do this next
| Action | By when | What proves it worked |
|---|---|---|
| Founder appoints counsel and broker | Before vendor signature | Signed scope and jurisdiction register |
| Vendor and acquirer confirm payment scope | Before payment activation | Accepted validation route and responsibility matrix |
| Broker binds required coverage | Before courier approval | Policies and delivery-use confirmations |
| Founder tests expiry blocking and incident response | Before pilot dispatch | Failed-document test blocks assignment; incident log completed |
Risks in your situation
Thin unrestricted capital makes insurance pricing a launch constraint. Founder-only administration creates approval bottlenecks; maintain a dispatch pause rather than delegating unchecked access. White-label configuration changes can expand payment scope. Local wage, classification, or insurance requirements may invalidate the planned courier model; suspend affected operations until corrected.
Evidence gate
- ☐ Jurisdiction register approved; required licenses active.
- ☐ Acquirer accepts payment validation evidence.
- ☐ Vendor contracts and access controls pass review.
- ☐ Courier documents and delivery coverage verified.
- ☐ Pay-floor accounting and classification approved.
- ☐ Insurance costs fit contribution targets.
- ☐ Dispatch blocking and incident procedures tested.