Payments · US
An event-driven orchestration platform covering charges, 3-D Secure, disputes, payouts, identity checks and ledgering — which stayed online through a DDoS attack.
New processors can be added without any merchant-facing work, so the business grows its acquiring relationships without slowing down merchants already live on the platform.
// the problem
Every new acquirer meant another integration for every merchant, and a failure in one processor took payments down with it.
// engineering
Eighteen processors and gateways sit behind the same interface — Stripe, CyberSource, NMI, Finix, Mastercard Payment Gateway, FlexCharge, PayNetWorx and TriplePlay among them — so adding the eighteenth changed no merchant-facing code. Visa and Mastercard card rails are reached through those acquirer and gateway integrations, never through a direct card-network connection.
3-D Secure, authorizations, captures, refunds and voids are handled end to end, with chargeback alerts, dispute evidence handling, decline recovery and each processor's own fraud tooling wired into the same event stream.
Events are written in the same transaction as the data that produced them, so a crash can delay a side effect but never lose it.
Modules talk only through events, so charges, disputes, payouts and the ledger can change independently. The ledger tracks reserves, fees, payouts, transfers and recipients, and feeds invoicing, coupons and reporting for every merchant.
KYC/KYB verification and bank account linking gate onboarding, and policy-based permissions govern every action, including an act-as-user path that is fully audited. Signed webhooks with retries and complete API request logs give merchants a record of every event, and a public API with developer docs, a checkout library, an e-commerce plugin and a bilingual interface make the platform self-service.
We built and took this platform through PCI DSS Level 1 service provider validation — a QSA-led onsite assessment with a Report on Compliance and a signed Attestation of Compliance, not a self-assessment questionnaire — and through its PCI DSS v4.0 revalidation, with quarterly ASV scans. Getting there was an architecture decision as much as an audit outcome: scope reduction so as few systems as possible ever touch a raw card number, tokenization, no raw PAN storage, encryption in transit and at rest with AES-256 under managed keys, segregated access, and audit logging across the platform. The same observability dashboards that cover throughput, latency and error rates across every processor were part of what made evidence collection for the assessor straightforward.
// result
Four years in production across eighteen processors and gateways, with 3-D Secure, authorizations, captures, refunds, voids, chargeback alerts, dispute evidence handling and decline recovery running against Visa and Mastercard card rails through acquirer and gateway integrations. The ledger reconciles reserves, fees, payouts, transfers and recipients daily, KYC/KYB and bank account linking gate every onboarding, the platform achieved PCI DSS Level 1 validation through a QSA-led assessment and Report on Compliance with continued revalidation under PCI DSS v4.0, and the API stayed available through a DDoS attack that was mitigated within the week.
The client needed one API in front of many acquirers, so that adding a processor never meant changing merchant integrations.
Event-driven backend · Relational database · Message queue · Containerized deployment · Cloud-native infrastructure
Tell us what you're building. You'll leave with an honest opinion, even if it's "you don't need us."
Reference calls with past clients are available under NDA during evaluation.