PIX, cards, settlement and anti-fraud — built on patterns from systems processing R$1B+ monthly at 99.99% availability.
Most payment incidents aren’t outages — they’re silent drift between what your API said and what the bank actually did. We design payment systems where the ledger is the source of truth and every external call is reconciled against it.
From PIX rails to card acquirers to settlement and chargebacks, we build the infrastructure that lets product teams ship checkout features without worrying whether tomorrow’s reconciliation will balance.
double-charges on retry — idempotency keys at every boundary
settlement closes balanced, automatically
MTTR for stuck transactions via ledger-only recovery
auditability — every state transition is queryable
Click any capability to see how we approach it.
Real-time PIX with webhook reconciliation, dynamic QR codes, refunds and devolução handling.
Acquirer-agnostic card flow with tokenization, 3DS, recurring billing and chargeback hooks.
Daily settlement closures with three-way reconciliation: ledger, processor and bank statement.
Rules + score-based fraud screening with velocity checks, device signals and external API hooks.
Each engagement follows the same five-stage cadence — adapted to your stack, but never to your detriment.
We profile current transaction volume, P99 latency, retry rates and existing incident history — then map the failure modes we’ll design against.
We codify the transaction state machine, idempotency keys at every boundary and reconciliation invariants — so a retried PIX never debits twice and a stuck settlement is recoverable from the ledger alone.
PIX, card acquirer and settlement integrations wired with idempotent receivers, replayable webhooks and end-to-end sandbox certification before any production traffic.
Three-way reconciliation jobs, daily closing reports and finance-team dashboards. Discrepancies trigger alerts before they reach the books.
Canary rollout with kill switches, on-call rotation onboarding, runbook drills and SLO sign-off. We don’t leave until your team owns the pager.
Every external call is mirrored in the ledger before acknowledgment — so reconciliation always has somewhere to start.
Inbound request → validation → state transition → provider call → webhook receipt → ledger write → reconciliation.
Defaults — not dogma. We pick what survives your next year of volume.
Pick the engagement that fits your team — every shape ends with your team holding the pager.
A scoped payments build, a sprint to unblock a stalled integration, or a monthly retainer for new rails and maintenance — delivered as an external team.
From kickoff to a production-ready payments flow handling real money in canary.
Ledger, source, intellectual property and runbooks transfer to you. No lock-in, and no bodies to manage.
If yours isn’t here, ask us directly.
Tell us the volume, the rails and the SLO. We’ll come back with a shape and a timeline.