The provenance of every Arai, proven in seconds

Context & Challenges

On the track, trust starts before the green light. An Arai helmet is certified to protect whoever races, but that promise only holds for a genuine Arai. And there was no simple way to prove it: riders had nowhere to check the origin of a shell bought from someone else, and Arai Brasil kept serials, sales and owners in a spreadsheet.

Our challenge was to turn that control into a product. A system that gives riders a public, instant answer, puts each helmet in the name of the person who wears it and gives the team a dashboard to run inventory, sales and presence at race tracks. A custom app, designed around Arai’s e-commerce operation.

Public lookup

One serial. One answer. In seconds.

The experience starts with a direct question: is your Arai genuine? Riders type the serial engraved inside the shell and instantly get the model and the helmet’s status, available to register or already linked to a rider.

Transparency without exposure: when a helmet has an owner, the name is shown abbreviated. Provenance is public; personal data is not. The screen itself shows where to find the serial, under the neck lining, and recalls what an official Arai guarantees: FIA and Snell approval, official provenance, original parts and support.

Rider registration

The helmet in the name of the one who rides it.

Registering an Arai takes two short steps. First, the serial, the model and where it was bought: official store, authorised dealer, event or race track, or from another person. Then, just the rider’s name and the purchase date.

No link is automatic. Every registration joins a pending queue and is checked by the Arai team before approval. That is what keeps the base reliable and gives real weight to the word genuine.

Dashboard

The team’s pit box, on a single screen.

The overview answers what matters at the start of the day: how many helmets already have a rider, how many are available for sale, what is awaiting approval and the size of the inventory, with stock broken down by model, from the SK-6 to the GP-6S.

The dashboard doesn’t live in isolation. The catalogue talks to Arai’s Tray store and syncs every six hours, so models and stock follow the e-commerce with no double entry.

In the inventory, every serial carries its own biography: status, rider, sale date and the helmet’s full history. Search by serial, model or rider and status filters make 671 records navigable in a few clicks.

Sale registration follows the same logic: the serial is entered, the system confirms it exists and is free, and the sale is completed in two steps. Access follows roles: administrators run the whole operation; sellers work in the Track report.

Track report

Who races in Arai, on every grid.

At race tracks, the brand needs data too. In four steps, the team records the race, the track and the riders lining up in Arai. Each report becomes a PDF with an official copy in the brand’s Google Drive, and the dashboard confirms when the file is saved. Track presence stops being an impression and becomes a record.

Everything was designed from the phone up, because that is where the question comes up: in the paddock, helmet in hand. In the dashboard, navigation sits within thumb reach and the main actions are always one tap away.

How it was built

From a spreadsheet to a made-to-measure product.

We started from the source of truth: Arai Brasil’s serial-control spreadsheet. Before a single line of back end, the screens took shape in a clickable prototype with fictitious data, so the team could validate lookup, registration and dashboard exactly as they would work.

The migration was designed to discard nothing. The import brought in 671 serials, 603 with a rider and 68 available, and 276 customers. The 23 repeated serials became history: the latest row sets the current state, and the earlier ones tell whose hands the helmet passed through. Inconsistent dates were flagged for review, and no real data lives in the code.

Underneath, React 19, tRPC and MySQL, with e-mail or Google sign-in limited to registered users. Security was a requirement from day one, not a final step: sessions in protected cookies, bcrypt passwords, rate limits on lookup, registration and login, and protective headers on every response.

Deliverables: Product, UX/UI, front end, back end, data migration
Stack: React 19, tRPC, Drizzle, MySQL
Integrations: Tray store, Google Drive, Google sign-in
Screens: Lookup, registration, dashboard, inventory, sale registration, track report

All projects