Services / Fintech and financial institutions
FintechWe design and operate infrastructure for payments, audit, and peak traffic
We design, deploy, and operate infrastructure for payments, audit, and peak traffic. We start from your systems: gateways, queues, card data, RTO, and who reports an incident. Then we stand up an audit trail, SLO, a peak test, and two copy paths. We map DORA, KNF, and PCI onto control in the system. We stay for on-call, restore, and evidence.
How it fits together
From the payment systems to audit trail, peak, and restore
First we understand the payment path and the regulation. On that basis we put together detection, observability, load, and copies. Wazuh, Grafana, k6, and Proxmox Backup Server are what we use for that work every day.
- DORA, KNF, and PCI controls live in infrastructure and in rhythm, together with policy.
- FinOps savings stay inside SLO and CDE segmentation.
We keep an audit trail of change, access, and incident
Logs from hosts, cluster, cloud, and edge. FIM on payment configuration. SCA under CIS. An alert has a playbook and retention for the auditor. This is the DORA foundation in operations, next to the policy document.
Access
SSO, MFA, PAM to production. Every entry in the audit trail.
Change
Deploy, grant, SG change. Linked to a change ticket.
Incident
Priority, time to detect, time to respond. Material for reporting.
PCI
Segmentation, FIM on CDE, shortened access. Card scope is a separate zone.
We watch transaction SLO beside infrastructure SLO
Authorization p95, queue, database, issuer error. An alert has a runbook. A failover exercise has a metric, next to the protocol.
Path
Gateway, queue, issuer, webhook. Every jump has an owner.
Multi-AZ
Zone loss in the metric. RTO written and measured.
Change
Deploy is visible on the chart. Canary or a small change window.
Report
For risk and for engineering. The same SLO, a different language.
We run a peak test before the campaign
A scenario of transactions, tokenization, webhooks, and nightly reports. Soak for pool leaks. We tie the result to Grafana. Capacity is a decision before marketing starts the campaign.
Model
Traffic from production, with a share agreed with the product team.
Gates
Issuer timeout, retry, idempotency. The test shows it.
Change window
Test on staging with synthetic data. Production has separate generator limits.
Chaos
A separate session: loss of database, queue, AZ.
We keep restore within RTO, on separate keys
Two paths, immutability, an exercise restoring the gateway and the database. An offline playbook. DORA gets evidence from the calendar and from the report.
RTO and RPO
Per payment system and per supporting system. A different time budget.
Paths
Close and far, different accounts. Ransomware does not delete both.
Exercise
Restore calendar, a report for risk.
People
Who restores, which DNS, which secret, who communicates.
How we work
From the client payment systems to an exercise
We start from critical systems and card data. Then we stand up the audit trail and SLO. We run a peak test and a restore. We stay for on-call, evidence, and a report for risk.
- Map We check CDE, gateways, queues, providers, and RTO. That gives the scope: controls, resilience, and evidence.
- Controls We stand up IAM, FIM, logs, segmentation, and the edge.
- Resilience We put together multi-AZ, a dashboard, on-call, and communication.
- Evidence We run a load test, failover, and restore, then a report for risk and for engineering.
Talk
We will discuss the audit trail, SLO, and continuity
On that basis we will prepare a scope: controls, peak test, and restore.
Contact us