The record nobody can edit

In Queensland, a booking entity must keep a record of every booking for at least 2 years and produce it if TMR asks. A record anyone can quietly edit is weak evidence: for TMR, for a rider with a complaint, and for us.

What we did

Every booking in our system has a history: requested, quoted, confirmed, on the way, arrived, rider on board, finished, receipt sent. Each step is written as a new entry in that history.

The database itself refuses to change or delete those entries, whatever the app or a staff member asks. I tested that refusal at 9:23 am on 23 August 2026, within a quarter of an hour of the first code going in, on our test system, and again on our own server when the system went up there later that day. That was the first day of the build, weeks before the system ran under our own BEA.

So when something needs fixing, it is fixed forwards:

• a correction is a new entry that says what was wrong and why;
• a refund is a new entry; the original receipt is never touched;
• a waived charge is a new entry, with the reason.

The money on a finished trip is never edited. If it was wrong, there is a visible, dated correction.

Why it matters to an operator

• When TMR asks for a record, you hand over exactly what happened, in order.
• When a rider disputes a fare, the quote, the times and the receipt are all there, and nobody can say they were changed afterwards.
• It changes how your staff work, for the better. There’s no temptation to “just fix” a record, because the database won’t let them.

We keep booking records for 5 years, not 2, because the tax records need them too.