Optimal Lab
E-commerceA UK research-use peptide brand: a full storefront and back-office, then Pep, the AI assistant the team runs operations through in plain English.
Optimal Lab sells research-use-only compounds, where one verb is a regulatory risk. Copy saying a compound boosts, supports, aids or treats anything makes an implied medicinal claim, and the brand carries it.
Each purchase must clear an age check, and checkout must record what the customer agreed to in a form that holds up months later.
Vials are tracked by lot with expiry dates and sold earliest-expiry first, so stock on those lines is counted lot by lot.
A reviewer reading by eye misses the claim buried in clean copy, and the whole load falls on a small team already running orders, stock and customer messages.
A storefront and back-office on Next.js and Firebase: catalogue, PayPal checkout, Royal Mail shipping labels, and admin for orders, stock, discounts and wholesale.
Pep, an AI assistant in the back-office. The team asks it to check orders, adjust stock, run a stock count, draft a customer reply or pull a sales report, and it acts through a defined set of tools. At eight each morning it writes a briefing on the day before: what was paid, what needs a reply, what is running low and what is stuck.
Pep asks before it changes anything. A confirmation card shows exactly what will happen, and only lookup tools (19 of its 42) run unattended. Approval is a signed, single-use token tied to the exact arguments on the card, so a changed argument or a replay is refused. A new tool arrives gated unless it opts out.
Customer text is fenced off. Names, subject lines and message bodies are wrapped in trust markers, and the assistant treats that text as data. That stops a customer typing an instruction into their own name and having the back office act on it.
Each morning Pep picks the three lot-tracked lines counted longest ago and asks for on-hand figures in chat. It writes the correction through the same audited adjustment a person uses, against the earliest-expiring lot. An early adversarial pass caught Pep changing order statuses without audit rows; those changes now go through the same guarded transition as the human screens.
Compliance checks run when work is committed. One guard refuses a commit when banned marketing wording reaches customer-facing copy. Its blocklist is deliberately stricter than the regulator's minimum, since a false positive costs ten seconds at commit and a false negative costs the business. An override must name the term and give a written reason. A second guard fails the commit when a claim's tagged evidence file is missing.
The age check left the honour system. A typed date of birth replaced the tick-box, the server makes the decision, and it keeps only the month, year and age at signing. Checkout records four versioned consent documents against a signature and matches the set to what is in the cart.
What it actually looks like, running.
A small team runs a compliance-heavy shop largely by talking to it: checking orders, taking stock counts and drafting customer replies in conversation. The age check and the claim wording are enforced automatically.
Banned wording and unevidenced claims fail at commit, hours before a customer could see them. The checkout produces the age check and consent record.
The stock count is three questions each morning. Each answer lands on the right lot with its audit row written.
Take half an hour to see what a build like this would look like for your business.
No commitment and no fixed quote until it is scoped. If we go further, you own what we build.