The Unglamorous Week: Legal Pages, a Payment Swap, and an SEO Push

Three of the live products in the portfolio moved this week, and not one of the changes is the kind of thing you'd put in a highlight reel. No new feature launched. What shipped was the unglamorous layer underneath — the part that decides whether a product is actually a business or just a demo that happens to be live.

FieldForce SA got a launch-readiness pass: Terms and Privacy pages, a required POPIA consent checkbox on signup that gates both the email and the Google sign-up path, and the company's real registration details in the footer instead of placeholders. Buried in the same batch was a proxy bug that had been quietly wrong since the Paystack integration went in — the app's /api/* auth gate was 401ing incoming Paystack webhooks before the webhook's own signature check ever got a chance to run. The route was already verifying the HMAC itself, so the session gate in front of it was pure risk with no upside. Subscription renewals and invoice-paid events would never have processed. Nobody in the loop, no error visible on a dashboard — it would have just silently not worked the first time it mattered.

Hans Rooseboom Art swapped its South African checkout leg from Payfast to Paystack — same HMAC-signature verification discipline, same amount re-check against the order total, just a different provider. The international Stripe leg didn't move. Alongside that: a thematic collections feature so the gallery can be browsed by theme, a Price-on-Application tier for the premium originals, and — the part that actually matters most for a portfolio site — real first-person copy. An artist statement, a biography, a philosophy page, all built from Hans's own notes rather than placeholder text. A store with the right payment provider and no real voice behind it is still just a form.

FundReady SA spent the week on being findable. The homepage got rewritten for conversion — dual CTAs, schema markup, trust signals, a sticky mobile buy bar — and two new guides went up (NYDA funding, SEFA business plans) aimed at organic search rather than paid traffic. Underneath that: robots.txt, a sitemap, clean URLs, and verification in Google Search Console. None of it is visible to a visitor. All of it decides whether a visitor ever arrives.

The thread across all three: legal pages, a correctly-wired webhook, a payment provider that actually matches the copy describing it, a sitemap Google can read. None of this compounds into a demo you'd show off. It compounds into a product that doesn't quietly fail the first time someone tries to pay, sign up, or search for it.