Payment software, engineered for licensed financial institutions.

Engineering standard

Built to be reviewed by someone else's auditor.

Our clients are supervised businesses. Their auditors, their banking partners and their regulators eventually read the systems we deliver — so we build for that reading from the first sprint.

• Secure SDLC: threat modelling, peer review, SAST and dependency scanning in CI
• Least-privilege access, MFA and per-environment credential separation
• Every state change written to an append-only, timestamped audit log
• Encryption in transit and at rest; secrets never in source control
• Signed NDAs and confidentiality clauses on every engagement
• Practices aligned to ISO/IEC 27001 and OWASP ASVS. We are not currently certified to ISO/IEC 27001

// Double-entry posting — balanced or rejected.
// Idempotent by construction: same key, same result.
export async function post(entry: JournalEntry) {
  const sum = entry.lines.reduce(
    (a, l) => a + l.amountMinor, 0
  );
  if (sum !== 0)
    throw new LedgerError("unbalanced_entry");

  return db.tx(async (t) => {
    const prior = await t.findByKey(entry.idempotencyKey);
    if (prior) return prior;          // replay-safe

    const posted = await t.insertLines(entry.lines);
    await t.appendAudit({
      event: "journal.posted",
      actor: entry.actor,
      at:    t.serverTime,
    });
    return posted;
  });
}

Illustrative code written for this website. Not client code.