Technology
A marketplace is the easy half.
The hard half is money: moving it, recording it, and being able to prove afterwards that what happened is what the ledger says happened. That is the part we build most carefully.
3000The ledger
Every movement has two sides
A balance is not a number the system edits. It is the consequence of entries, each of which records where value came from as well as where it went. Debits on the left, credits on the right, equal every time.
That constraint is what makes the system auditable. An entry that does not balance is not saved, so there is no state in which the book is quietly wrong and waiting to be discovered.
One advance drawn against vaulted collateral, as it appears in two accounts. The 72,000.00 appears twice because it is one movement seen from both sides.
Illustrative
Posting path
Where a dollar goes
Each hand-off is a place something can fail, so each one is designed to be retried, matched and proven after the fact.
- 01
Money movement
A customer pays in, draws down or gets paid out.
- 02
Double-entry ledger
The movement posts as a balanced entry.
- 03
Payments & banking
Providers execute the instruction.
- 04
Reconciliation
Provider statements are matched back to the book.
- 05
Lending
Collateral is assessed and credit is drawn.
- 06
Repayment
The loan winds down and collateral is released.
- 07
Customer balances
What the customer sees, derived from the book.
Controls
The properties, in full
Transaction correctness
Every movement of money posts as a balanced pair, or it does not post.
- Money is never represented as a number that some part of the system increments. It moves as journal entries whose debits equal their credits, written in one transaction. A partial write is not a state the ledger can be left in.
Idempotency
The same instruction submitted twice moves money once.
- Payment providers retry. Networks time out mid-request. Customers double-click. Every write that touches money carries an idempotency key, so a repeated instruction returns the original result instead of creating a second one.
Concurrency
Two things happening to one balance at once still produce one right answer.
- An auction settling while a loan draws against the same collateral is an ordinary Tuesday. Balances are updated under constraints that make conflicting writes fail loudly rather than interleave quietly.
Data consistency
What the customer sees and what the ledger holds are the same number.
- Balances are derived from posted entries rather than cached alongside them, so there is no second copy to drift. Where a read model exists for speed, it is rebuildable from the journal.
Reconciliation
The internal ledger is checked against the bank, continuously.
- Provider statements are matched against internal entries on a schedule, and breaks are surfaced as work rather than absorbed. A discrepancy that nobody is looking at is a discrepancy that grows.
Payment reliability
A provider having a bad day does not become a customer having a bad day.
- Payment and banking integrations are treated as unreliable by default: timeouts, retries with backoff, and a durable record of intent that survives a failed call so nothing is lost between systems.
Loan lifecycle
Origination through repayment and release, tracked as one object.
- A loan is not a row that gets edited. Application, collateral assessment, origination, servicing, repayment and release are recorded events, so the position at any past date can be reconstructed rather than inferred.
How we think about correctness
Assume the worst about the network
Payment providers time out. Requests get retried. Two operations land on the same balance in the same millisecond. None of these are edge cases in a system that moves money. They are the ordinary weather, and a design that only works when the network behaves is a design that does not work.
So writes that touch money are idempotent, conflicting updates fail loudly rather than interleave, and intent is recorded durably before a provider is ever called. When something does go wrong, the goal is that it is visible and recoverable rather than silent and permanent.
Reconciliation is the backstop. Internal entries are matched against provider statements on a schedule, and breaks become work for a person instead of a rounding difference nobody notices for a quarter.
Want the longer version?
If you are evaluating us as a counterparty or as an employer, we are happy to go deeper than a marketing page reasonably can.