How AUTHYPAY holds, moves and protects funds
A step-by-step technical architecture, custody model, compliance framework and operational runbook set for a lean team building a global, multi-currency payment platform.
Internal wallet core
Double-entry ledger, per-user sub-accounts, multi-sig treasury and cold reserves.
Defense in depth
Envelope encryption at rest, mTLS in transit, RBAC, MFA and continuous scanning.
Global rails
FX and payout partners plus bank aggregation for multi-currency deposits and withdrawals.
Compliance by design
KYC/AML at onboarding, sanctions screening, immutable audit trails, regulator-ready reporting.
1 · Platform architecture
Six layers, each with its own blast radius and its own controls.
| Layer | Components | Security controls |
|---|---|---|
| Edge | Cloudflare WAF, DDoS L3-L7, bot scoring, global CDN | Rate limits per IP/user/key, geo rules, TLS 1.3 only |
| API | Stateless payment/auth/ledger services, idempotent endpoints | OAuth2 + short-lived JWT, HMAC-signed webhooks, request signing, Zod validation |
| Ledger | Postgres double-entry ledger, append-only journal, outbox events | Row-level security, serializable transfers, hash-chained entries |
| Custody | Hot float (2-of-3 MPC), warm ops wallet, cold vault (3-of-5, offline) | HSM/KMS key shards, quorum approvals, withdrawal allowlists, time locks |
| Data | Encrypted Postgres, object storage for KYC docs, log lake | AES-256 envelope encryption, per-tenant DEKs, 90-day key rotation |
| Observability | SIEM, anomaly detection, on-call paging, status page | Immutable logs, real-time velocity rules, auto-freeze triggers |
Buyer app ──QR intent──▶ Edge (WAF, rate limit)
│
▼
Auth service ──MFA / passkey──▶ session
│
▼
Risk engine (Sift + internal rules)
│ approve │ hold / step-up
▼ ▼
Ledger (double-entry) Review queue ──▶ analyst
│
▼
Rail router ──▶ Stripe | PayPal | FX partner
│
▼
Custody: hot float ⇄ warm ops ⇄ cold vault (multi-sig)
│
▼
Outbox events ──▶ SIEM · audit log · reconciliation2 · Secure internal wallet system
Keys are split, privileges are scoped, and every sensitive action needs a second human or a second factor.
3-of-5 offline signers, 24h time lock
2-of-3 MPC, daily cap, allowlisted destinations
Automated, per-txn $50 pilot cap, auto-refill
Signer shards live in separate HSM/KMS regions held by different officers; no single person or machine can produce a valid signature.
- At rest: AES-256 envelope encryption, per-tenant data keys in KMS, 90-day rotation, encrypted backups.
- In transit: TLS 1.3 externally, mTLS between services, signed webhooks, no plaintext PANs — wallet tokens only.
- RBAC: viewer, support, ops, treasury, admin — stored in a dedicated roles table, never on the user profile.
- MFA: TOTP via Authy or Google Authenticator, passkeys preferred, SMS as a fallback with SIM-swap heuristics.
- Treasury actions require quorum approval plus a fresh step-up factor, logged with actor, IP and device.
MFA providers authenticate people. They never hold keys, balances or customer funds.
Continuous
Dependency + container scans, secret scanning, IaC policy checks in CI
Daily
Reconciliation of ledger vs custody, anomaly review, access-log sampling
Quarterly
Access recertification, DR game day, key-rotation drill
Annual
External penetration test, SOC 2 audit, PCI validation, policy refresh
3 · Risk management & custody
Custody is a controls problem, not a banking relationship. AUTHYPAY runs its own segregated ledger on top of a regulated custodian.
Client funds sit in segregated for-benefit-of accounts and insured custody wallets, separate from operating capital.
AUTHYPAY's ledger is the source of truth for entitlements; the custodian is the source of truth for assets. They are reconciled daily.
Automated risk monitoring: velocity, device, geo-velocity, counterparty concentration, and float-ratio breaches.
Breach of any threshold auto-throttles outbound flow before a human is paged — fail closed, never open.
Loss-provision reserve funded from a fixed share of fee revenue, reviewed monthly.
4 · Cross-border & multi-currency
Partner rails for FX and local payouts; AUTHYPAY keeps the ledger, the risk model and the customer relationship.
5 · Compliance & legal framework
Onboarding, monitoring and reporting built to survive an examiner's questions.
Identity + document verification and liveness through Trulioo; business KYB with UBO resolution for merchants.
Sanctions, PEP and adverse-media screening at onboarding and continuously thereafter.
Risk-tiered CDD: enhanced due diligence for high-risk geographies, volumes or corridors.
Transaction monitoring rules plus Sift ML scores; structuring and smurfing detection.
SAR/STR workflow with a named compliance officer and documented decisions.
Append-only, hash-chained audit trail for every balance change, admin action and consent event; 5-7 year retention.
Terms of service, acceptable use, privacy notice and a published fund-safety statement.
Dispute flow: 24h acknowledgement, evidence upload, 10-business-day decision, chargeback representment via the rail.
Regular reporting packs: reconciliation, suspicious-activity volumes, uptime and complaint metrics.
Data protection: GDPR/CCPA rights handling, data-residency options, DPA with every sub-processor.
6 · Phased delivery plan
Ship narrow and safe first; widen limits and geography only as controls and evidence mature.
Double-entry ledger, sub-accounts, idempotency keys and reconciliation jobs
RBAC roles (viewer / support / ops / treasury / admin) in a dedicated roles table
MFA rollout: TOTP (Authy, Google Authenticator), passkeys, SMS as fallback only
Stripe + PayPal single-currency (USD) in/out with $50 transaction cap
KYC/AML via Trulioo, Sift device + behavioural scoring on every transfer
MPC/multi-sig custody with a regulated provider (Fireblocks, BitGo or Anchorage)
Cold vault procedures, quorum approvals, withdrawal allowlists and time locks
Segregated client-funds accounts; daily proof-of-reserves vs ledger attestation
First external penetration test plus SOC 2 Type I readiness assessment
Currencycloud or Wise Platform for FX quotes, locked rates and local payouts
Per-currency wallet balances with FX spread and slippage guardrails
Plaid / Tink / Yodlee bank linking for verified deposits and withdrawals
Travel Rule and cross-border reporting workflows per corridor
Regional data residency, active-active failover, quarterly DR game days
SOC 2 Type II, PCI DSS SAQ-D validation, per-market licensing (MSB/EMI)
Raise transaction limits by risk tier as loss data matures
7 · Lean vendor stack & user trust
Buy regulated capability, build the ledger and the experience.
| Need | Recommended | Why |
|---|---|---|
| Custody | Fireblocks / BitGo (MPC + cold) | Insured, regulated, no bank dependency |
| KYC / AML | Trulioo + ComplyAdvantage | Global coverage, ongoing sanctions monitoring |
| Fraud | Sift | ML risk scores, usage-priced |
| FX / payouts | Currencycloud or Wise Platform | Mid-market rates, 40+ currencies |
| Bank linking | Plaid (US/CA/UK) + Tink (EU) | Verified account ownership |
| MFA | Authy / Google Authenticator / passkeys | Authentication only — never fund custody |
| Cloud | AWS primary, Cloudflare edge | KMS, GuardDuty, WAF, multi-AZ |