Prypco Clone · Development Company

Prypco Clone Development Company: What to Ask Before You Hand Over the Register

A fractional property platform is a bookkeeping product wearing a property brand. What you are actually buying is the record of who owns what, and the controls that keep it honest. Three questions settle more than any feature list: how is ownership written, what did the security review find, and is the tokenisation implemented or merely described. Our answers are below, in writing, including the parts that are not finished.

Talk to Our Team →See Pricing
Since 2010 building platforms
11 lines on one chassis
Gap list published before you pay
Full source yours, not a tenancy
Our gap list
On this page, before you pay
What Handover Includes
01Full application source
02Prisma schema, 108 models
03Double-entry ledger and register
04XRPL module, sandbox stated
05Security handbook
06VAPT review, severities named
2010
Building Platforms Since
108
Database Models Transferred
6 days
To a Branded Build
100%
Source Code Transferred
Compare

Agency vs Freelancer vs Miracuves

Three honest routes to the same product, measured on what exists the day you start rather than on what a proposal promises.

What you are buyingA freelance teamA custom agency buildMiracuves ready-made
The ownership recordRows that get updated in placeDesigned properly, after a discovery phase you pay forAppend-only register, already the legal source of truth
Money accountingA balance column on a wallet rowDouble-entry, if the architect insistsLedger accounts, transactions and entries, with balances derived
Payment to ownershipTwo writes and a hopeScoped as a reconciliation taskAllocation, ownership and certificate in one database transaction
TokenisationUsually a slideA phase two line itemXRPL module in code, on a deterministic sandbox until you configure a chain
Breadth on day oneThe core fractional flowWhatever the statement of work namesEleven product lines on one chassis, gold and mortgage and the agent channel included
Security evidenceNone, in most casesCommissioned separately if you askA security handbook and a VAPT review whose severity counts are printed below
What is unfinishedFound in acceptance testingNegotiated as change requestsPublished before purchase, in the gap list on this page
Cost shapeDay rates that move with scopeA programme budget plus maintenanceFixed at $6,999, plus your own hosting
LeavingFinding the next freelancerEnding a retainerNothing to leave: the source is already yours

A good agency build is a real option, particularly where the jurisdiction forces an unusual legal structure. It costs more, it takes longer, and somebody on that team still has to write the ledger, the register and the certificate flow from nothing. This table measures what exists when the clock starts, not who could build it eventually.

Due Diligence

Questions Worth Asking Any Provider

Nine of them, and we would rather you asked us all nine first. Most are settled on a shared screen in minutes. The rest are settled by what a provider will put in writing before you pay.

01

Show me ownership being written, live

Buy a share on the demo and watch the record change. Is a row updated in place, or is an entry appended? Only the appended version answers who held what last quarter without a reconstruction from receipts.

02

Are balances stored or derived?

A stored balance is a number somebody can edit. A balance derived from double-entry ledger entries cannot disagree with its own history, because it has no separate existence. Ask which one you are looking at, then see the accounts behind it.

03

What happens between payment and ownership?

If allocation, ownership and the certificate are three separate writes, there is a state where money arrived and ownership did not record. Ask whether they happen in one database transaction. It is the most important answer on the list.

04

Is the tokenisation implemented, or described?

Ask to see the code path that mints and the queue that signs it, then ask which network it points at today. A provider who says mainnet without naming an issuer account and an RPC endpoint is describing an intention.

05

When the chain and the register disagree, which wins?

There is a correct answer and it is the register. The chain mirrors; the register decides. A platform that treats a ledger entry as a consequence of a chain event has put its legal record somewhere it cannot control.

06

Who approves a withdrawal, a distribution, a mint?

Ask to watch the queue refuse to clear without a second actor on all three. Dual control that lives in a procedure manual rather than in the software is not a control, it is a request.

07

What did your security review find, by severity?

Not whether one was done: the counts, the severities, and what each item actually is. A provider offering a summary instead of numbers has decided which parts of their own review you may see.

08

What is not finished?

Ask for the gap list in writing, before money moves. Every product in this category has one. A provider who names nothing has either not looked at their own build or decided not to tell you.

09

Does buying this get me closer to a licence?

The only correct answer is no. Software is not authorised by anybody. A provider who implies otherwise will be equally relaxed about the things you have no way of checking yourself.

Our answers to one through eight are on this page and open on the demo. Our answer to nine is no: documentation helps a regulatory application and is often asked for, but it is not authorisation and it never becomes authorisation.

Process

The Six-Step Development Process

Six days to a branded deployment, app store approval excluded, with the readiness gate named as a step rather than left off the slide.

Step 1 · Day 0

Choose the product lines and agree the gate

Eleven lines ship on one chassis and almost nobody opens with all eleven. We agree which go live first, which stay dark behind a flag, and what the register has to look like for your legal structure. We also write down the readiness items that must close before a real investor sees the platform, so that list is agreed on day zero rather than discovered later.

Step 2 · Days 1 - 2

Brand every surface, including the printed ones

Your identity across the investor web application, the Expo mobile client on both stores, the admin console suites, and the documents an investor keeps: certificates, statements and payment allocation records. Interface languages are configured here too, Arabic included with the layout mirrored rather than translated, and checked on your own content.

Step 3 · Days 3 - 4

Deploy as an isolated sibling you control

Your servers, your PostgreSQL, your object storage, your payment and verification accounts, your mail and push credentials. This is not a tenant on a shared platform: each operator gets its own database, provider wiring, branding and jurisdiction profile. Nothing runs on our infrastructure and nothing phones home.

Step 4 · Day 5

Configure money, roles and the chain decision

Fee schedules across the ten fee types, the revenue rails you intend to switch on, share classes and SPV structure per property, exit window rules, and the five role dashboards mapped to the people who will actually use them. This is also where the chain decision is made and written down: stay on the deterministic sandbox, or supply an RPC endpoint and an issuer account and point the module at a real network.

Step 5 · Day 6

Train on the paths where money meets the record

Your team drives a property from listing through allocation to issued certificates, a secondary trade settled against the register, an exit window priced and closed, and a distribution batch released through two approvers, all on seeded test data. They read the ledger entries and the audit log as they go, because the people who will answer an auditor should have seen the answer before the question.

Step 6 · The gate

Close the readiness list

Rotate the payment webhook secret away from its sandbox placeholder and wire your processor's own signature verification. Move the rate limiter and the passkey store to Redis so the deployment is no longer single-node. Decide key custody properly, because the local vault in the base build is not production custody. Scope sanctions and politically exposed person screening, which is not included and which most regulators will expect. Then 60 days of guidance, 6 months of priority fixes and 12 months of updates.

We would rather lose the deal at day zero than have an operator open registration on an unhardened build. In this category the failure mode is not an outage anyone can see. It is a forged payment callback that credits a wallet and issues genuine ownership against property nobody paid for.

Warning Signs

Red Flags That Mean Walk Away

Five answers that should end the conversation

"The platform is regulator approved" or "we are compliance ready". No software is authorised by anybody. Regulators license operators and the arrangements around them, not codebases. A provider saying it is either confused about the regime or content for you to be.

"Investor funds are held safely in the platform wallet." A platform records money. Banks and licensed institutions hold it. Ask which institution, under what arrangement, and who signs. If the answer is the name of a screen, walk away before you reach the pricing.

"Tokenisation is fully live." Then show me the signing queue, and name the network, the issuer account and where the key sits. Ours runs against a deterministic sandbox and the admin screen says so. Honest beats live here, because you can configure a chain later and you cannot un-mint a mistake.

"You will not need the source code." In a business whose only durable asset is the investor register, renting the system that holds it hands your pricing power to the vendor at every renewal and your continuity to their roadmap.

A quote with no gap list and no security document. Both exist for every real product. A provider who can produce neither is selling something nobody independent has examined, possibly including themselves.

We hold ourselves to exactly this test, which is why the second section below is our own list of defects rather than a row of trust badges.

Domain

What a Fractional Investment Platform Has to Get Right

Six properties that decide whether a deployment survives its first audit, its first dispute and its first staff mistake.

One record that decides ownershipAn append-only ownership register treated as the legal source of truth, with a certificate issued on allocation. Everything else in the system, anything on a chain included, is a mirror of it. A platform with two places that both claim to know who owns a share has a dispute waiting for a date to happen on.
Double-entry accounting, not wallet columnsLedger accounts, transactions and entries, so every movement has two sides and balances are derived rather than stored. That is the difference between a system that can be audited and one that can be argued with.
Money and ownership in one commitA signed payment webhook drives allocation, then ownership, then the certificate, inside a single database transaction. There is no intermediate state in which the money arrived and the register did not move. Reconciliation scripts exist because somebody skipped this.
Dual control on everything irreversibleWithdrawals, distribution release and every chain mutation go through a second approver. The token operation signing queue is dual control by design, which matters more than the chain does: the control that protects an operator is usually the one protecting it from its own staff.
Liquidity with rules, not promisesThree doors, each governed: a secondary marketplace that lists, offers, counters and settles against the register; exit windows with their own valuation date, pricing method, fee percentage and minimum holding days; and property sale by share-weighted investor vote. Fractional ownership without a governed exit is a lock-in with a nicer interface.
Evidence a reviewer can read aloneAudit logging across the money paths, per-investor document scoping, magic-byte validation on uploads, and provider health surfaced in the console so a failed callback is visible rather than silent. Your reviewers should answer their own questions without booking a walkthrough with us.

All six are in the base build. Whether they are configured for your governance rather than ours is delivery work, which is what step four and the gate are for. On the call we open each one in order, starting with a payment that writes ownership in front of you.

Platform Trust

Custody of the Record, and Our Own Gap List

What holds the register up, and then, in the same breath, the eight things about this build that are not finished. Ask every provider on your list for their equivalent of both halves.

01

The register is the source of truth

Ownership is recorded in an append-only register which the platform treats as the legal record. Nothing overwrites a prior state, so a secondary trade or an exit from two quarters ago is still answerable today without a reconstruction.

02

Double-entry, with derived balances

Ledger accounts, transactions and entries sit underneath every movement of money. Balances are read from entries rather than kept as a separate number somebody could edit, so a wallet and its own history cannot drift apart.

03

One transaction from payment to certificate

A signed payment webhook drives allocation, ownership and the payment allocation certificate inside one database transaction. There is no state in which money arrived but ownership did not record, which removes the reconciliation problem instead of staffing it.

04

Dual control where it is irreversible

Withdrawals, distribution release and every chain mutation require a second actor. The signing queue enforces it in software rather than in a policy document, so the approval exists as a record even when the people involved later disagree.

05

The chain mirrors, the register decides

XRPL issued-currency tokens with authorized trust lines, so a holding is compliance-gated at protocol level, plus NFToken certificate offers and a chain event indexer. If chain and register ever disagree, the register is right and the indexer gets fixed.

06

Audit logging across the money paths

Sessions, passkeys, one-time codes and device registration on the way in; audit logging, per-investor document scoping and magic-byte upload validation afterwards. Provider health for payments, verification, storage, mail, pricing and FX is surfaced in the console rather than discovered in a support ticket.

Our own gap list: eight things we publish before you pay

The security review counts, printed. The VAPT review records 1 Critical, 7 High, 5 Medium and 2 Low. The single Critical is a data-classification label, not an exploitable finding, and we will not let it be presented as one. You receive the review itself, not our summary of it.
Tokenisation runs against a sandbox. The XRPL module is implemented, and until you supply an RPC endpoint and an issuer account in secrets management it runs against a deterministic sandbox. The admin screen prints the word sandbox. Testnet or mainnet is your configuration.
The local vault is not production custody. The build's own pre-mainnet checklist says so, and we are not going to say otherwise on a sales page. Key custody is designed during delivery, against your jurisdiction and your risk appetite.
The payment webhook secret is a placeholder. It ships as a sandbox value and must be rotated before anything real touches it, alongside your processor's own signature verification and replay protection. First item on the gate, for a reason.
Single-node until Redis. The rate limiter and the WebAuthn passkey store are in-process. They are correct on one node. Horizontal scale means moving both to Redis, which is deployment work rather than a code gap, but it is not done for you.
Sanctions and PEP screening are not included. Identity verification is wired through a provider abstraction; sanctions and politically exposed person screening is not in the box at all. Most regulators will expect it before you operate, so scope it early.
No licence comes with the software. Not ours, not anybody's. The platform is the system of record a regulated operator needs. It is not a regulated entity, it holds no client money, and deploying it grants you no permission to raise capital from the public.
Six days is a deployment, not a launch. Six days gets you a branded build on your own infrastructure, app store approval excluded. That is not the same as being ready to take public money, and anyone conflating the two is selling you the wrong date.

What is built is equally real and equally checkable: 108 data models, 299 API route groups, 160+ routed web pages, 60+ mobile screens on a native Expo client, 46+ admin console suites, 8 interface languages including Arabic with full right-to-left, eleven product lines, ten fee types and nine configurable revenue rails. Open any of it on the demo and hold the claim against the screen.

Modelled

Modelled Reference Deployment

Miracuves has not delivered a fractional real estate platform to a named client. What follows is therefore a modelled configuration, not a customer story, and we would rather say so here than let you work it out later. Every figure below is a property of the build.

Modelled Reference, Not a Client

An operator opening with four of the eleven lines

A modelled operator launching fractional property investment and rental distributions, with the secondary marketplace and the agent channel switched on in the same deployment rather than deferred to a later phase.

Modelled configurationNot a client engagementNo result, revenue or investor figure is claimed
4 of 11Product lines switched on at launch
108Data models in the domain
5 + 1Role dashboards plus super admin

Why this configuration is worth modelling: winning one verified investor costs the same whether that investor buys into one product or five. An operator who verifies somebody for fractional property and then has nothing else to sell them has paid full price for a single transaction. Switching the marketplace and the agent channel on at launch is the cheapest decision in the plan, because the chassis already carries both.

What the platform supplies: the append-only register and the double-entry ledger underneath all four lines at once, one allocation path writing ownership and the certificate in a single transaction, a secondary marketplace settling against the same register, dual control on withdrawals and distribution release, and an agent workspace with commissions, advances and referrals already modelled.

What would still have to be scoped: the readiness gate in full, live processor and verification wiring on the operator's own accounts, sanctions and PEP screening, the chain decision and key custody if tokenisation goes beyond the sandbox, Redis for the rate limiter and passkey store, and the operator's own licence or exemption, which is theirs alone to obtain.

Real named engagements, with their own reported outcomes, are published in our portfolio. Read the above as a configuration we can build on your infrastructure, not a business anybody has launched on it.

FAQ

Frequently Asked Questions

Have you delivered a fractional property platform to a client before?
Not under that description, and we are not going to dress one up. Miracuves has been building platforms since 2010, including investing, broking and payments products where verification onboarding, portfolios, order handling and reporting are the core of the work, and those named engagements are published in our portfolio. There is no fractional real estate client engagement to point at, which is exactly why the reference section on this page is labelled modelled. The platform itself is fully built and documented, and every capability claimed as shipped is open on the demo for you to drive.
Is the XRPL tokenisation implemented or just described?
Implemented, and running against a deterministic sandbox until you configure a chain. The module issues currency tokens with authorized trust lines so a holding is compliance-gated at protocol level, offers NFToken certificates, routes every mutation through a dual-control signing queue and indexes chain events back into the platform. What it does not do out of the box is talk to testnet or mainnet: that needs an RPC endpoint and an issuer account in secrets management, which is your configuration. The admin screen prints the word sandbox so nobody on your team can mistake one for the other.
What exactly did your security review find?
The VAPT review records 1 Critical, 7 High, 5 Medium and 2 Low. The single Critical is a data-classification label rather than an exploitable finding, and we say that plainly in both directions: we will not inflate it into a breach story and we will not quietly drop it from the count. You receive the review itself along with the security handbook, so your own people read the findings rather than our summary of them. We would encourage an independent penetration test before you open, and we will work from its findings the same way.
Does buying this software help my licence application?
It does not get you a licence, and any provider implying otherwise is overselling. No licence anywhere comes with this software. What the build does give an application is the technical material a reviewer usually asks for: a documented data model, the API surface, a security handbook, the VAPT review, and a clear account of how ownership and money are recorded and who has to approve what. That is useful evidence for your counsel to work with. It is not authorisation, and it never becomes authorisation.
Which of the eleven product lines are actually code today?
All eleven are in the build: fractional property investment, the secondary marketplace, exit windows and liquidity governance, rental distributions, mx Mint for fractional gold, mx Mortgage, mx Golden Visa, mx One for the agent channel, mx Real Estate services, mx Will, and CRM with investor relations. They sit on one chassis with one register and one ledger underneath them, which is the commercial point: you can switch a line on without buying a second platform or verifying your investors a second time. Which ones you open with is a configuration decision we take on day zero.
What transfers at handover, and what does it cost to keep?
The complete codebase: the Next.js 15 application with its 299 API route groups and 160+ routed pages, the native Expo client for iOS and Android with 60+ screens, the Prisma schema of 108 models, the ledger and register packages, the XRPL module, the provider adapters, the Docker image and the EAS build configuration. Full ownership to modify, extend and redeploy. No runtime licence, no per-investor fee, no revenue share and nothing that phones home. The documentation suite transfers with it, including the security handbook and the VAPT review, and your ongoing cost is your own hosting.

Ask us for the gap list before you ask us for the price

Then ask every other provider on your shortlist for theirs. The ones who have a list have looked at their own build. The ones who do not are asking you to look for them.

Explore

Explore the Prypco Clone

Five pages on this product. You are on Development Company.

The provider who tells you what is missing is the one to trust with the register.

A documented domain, a security review with its severity counts printed, a gap list published before purchase, and full source at handover. Hold every provider on your list to that standard, starting with us.

Talk to Us →
Miracuves · Prypco Clone Process, disclosed findings and modelled deployment cross-verified against the MXPropstake platform documentation, 2026-10-17
Disclaimer

Miracuves is an independent software development company. We are not affiliated with, connected to, sponsored by, or endorsed by Prypco.

Why this name

“Prypco Clone” is used descriptively. It is how the software industry refers to building a platform with functionality similar to Prypco, and how clients search for it.

Who built this

The entire design and codebase is built by our own team. The product contains no code, design, graphics, or content originating from the Prypco website or applications.

Trademarks

Prypco and all other third-party names and marks are the property of their respective owners, referenced here solely to describe the category of software offered.