Requirements:
1. Clients must fund a job or milestone before freelancers can start working.
2. Integrate a suitable payment provider for M-Pesa and card payments, subject to provider availability and approval.
3. Verify all payments securely on the server using signed webhooks or provider verification APIs. Never trust a frontend success message.
4. Keep a clear transaction record for every client payment, funded milestone, platform fee, refund, dispute, and freelancer payout.
5. Display payment statuses: Awaiting Payment, Payment Confirmed, Funds Secured, In Progress, Work Submitted, Under Review, Approved, Disputed, Refunded, and Paid Out.
6. Prevent freelancers from starting funded work until the required funds are confirmed and secured.
7. Allow clients to approve completed work or request revisions according to the contract.
8. Implement milestone-based payments, transparent platform commissions, freelancer payout requests, and payment receipts.
9. Add automatic payment release only after a clearly disclosed review period, with advance notice and an option to open a dispute before release.
10. Add a dispute system that pauses disputed payments until an authorised resolution is recorded.
11. Provide an admin dashboard for reviewing transactions, disputes, refunds, fraud alerts, and payout failures. Admins must not be able to secretly alter transaction history.
12. Protect against duplicate payments, duplicate payouts, forged webhooks, unauthorised refunds, and race conditions using server-side authorisation and idempotency.
13. Never store raw card details or expose secret API keys in frontend code.
14. Do not simulate real payments or mark jobs as funded without verified payment-provider confirmation.
15. Use a legally compliant escrow or marketplace payment provider that is authorised to hold and release customer funds. Do not hold customer funds in an ordinary business account without confirming the legal requirements.
16. Include clear buyer and freelancer terms, fees, cancellation rules, dispute deadlines, and refund policies.
Before implementation, identify the required backend functions, database tables, payment-provider integrations, and compliance requirements. If genuine escrow or payout functionality is unavailable, clearly identify what remains unimplemented instead of claiming that payments are protected.








