Fintech software development services

Trading platform, Nigeria

React Native, Laravel, AWS Kubernetes

This is a trading platform that lets users purchase assets on the Nigerian stock market and invest in mutual funds. Initially, our client had a working fintech app that had problems with both design and technical implementation. Their previous software development partner failed to deliver the needed results. It not only damaged the user experience and the company’s reputation but could also lead to serious consequences for business. The client requested us to conduct an app audit and stayed with us for a further rebuild of their mobile banking app.

Challenges

The audit revealed the codebase of both the mobile banking app and backend systems had several critical issues, including high-severity bugs, low test coverage, complex code structures, and security vulnerabilities. In such a scenario, refactoring wouldn’t provide the desired results, and we recommended a complete rewrite instead. As for the design, we figured that the interface was messy and lacked consistency.

Solutions

We simplified the interface, made all the components aligned with each other and got rid of the clutter. Our main goals for the fintech app development were to:

• Build a safe, flexible and reliable infrastructure using Kubernetes
• Implement KYC measures using local services
• Establish a high level of automation to ensure short time-to-market
• Build new processes for the client’s in-house team of to build a long-term sustainable fintech software development process that will produce the expected result

Local laws

To get stock exchange data in real time, we used the NGX group API. It’s a leading integrated market infrastructure in Africa that oversees the operations of the Nigerian financial market.

To implement KYC, we used a Nigerian service called NIN token — the solution lets us check users’ data in a secure way, sending it encrypted. To pass KYC, a user fills out a questionnaire, specifies their bank verification number (BVN) and phone number, takes a photo with their ID card, then the application sends the data to the local government service, the service checks everything and sends the user a text message with the results. After that, the user fills out a questionnaire about their experience with financial instruments and the fintech app creates their risk profile — it’s required by the Nigerian laws.

Results

The project went into production in November and entered a closed beta where verified users opened cards and made transactions. It passed App Store review in April. During that period, 1,285 accounts were opened by verified users. The product was later removed from both app stores.

The app is no longer active.

Neobank app, USA

React Native, Laravel, Cloud SQL

This is a neobank fintech software that helps US residents get a higher credit rating or just get a card and use it. The client contacted us for app development and UI/UX design — our task was to create a simple and attractive interface, build a stable and secure system and protect users' financial data.

Tasks

• Implement KYC measures
• Integrate the fintech software with Bond, a Banking as a Service (BaaS) solution that connects to major US banks
• Build a microservice architecture to separate our client’s isolated processes
• Ensure a high level of security and data privacy
• Take local regulations into account

Solutions

We use Persona KYC to verify the identity of new users through checking their SSN and ID, ensuring that the users are who they claim to be. Simultaneously, Sardine KYC runs fraud detection checks to ensure the new users are not associated with fraudulent activities or risky behaviors. Once the users pass the KYC checks, we use Bond BaaS to create and manage bank accounts, issue cards, and enable financial transactions via its banking APIs.

To ensure that individual processes don’t depend on each other, we have chosen a microservice architecture approach for software development. Thanks to this architecture, all data in the app is diversified, so it won’t make sense for intruders to steal it.

To protect users’ data even further, we used several approaches. First of all, we don’t store any private data on any servers — once we receive data from users, we immediately send it further for KYC verification and to the bank. Within our development company, we also use approaches such as least privilege approach and fine grained access. This means that only the DevOps engineer and team leaders have access to the production environment. Deployment happens automatically, developers don’t do anything manually, all files and data are encrypted. Finally, to prevent data from being lost, we use backups and set up replication in Cloud SQL.

Local laws

Our team passed the SOC 2 audit required for the engagement. We considered PCI DSS and ISO/IEC 27001 requirements when building the product, but the app did not hold separate certifications for those standards.

The app passed App Store review, which covered Apple's store policies rather than financial compliance.

Results

The project went into production in November and entered a closed beta where verified users opened cards and made transactions. It passed App Store review in April. During that period, 1,285 accounts were opened by verified users. The product was later removed from both app stores.

The app is no longer active.

Neobank app, UAE

A client from the UAE asked us to explore a mobile neobank concept while they evaluated BaaS providers. Our work covered product analysis, planning, and UI/UX design. We:

1. Helped to determine the type of program (credit/debit/CDA cards), and the type of planned investment app (crypto/fiat).
2. Helped to determine the criteria for choosing BaaS, indicating what our fintech software developers need. Explained which BaaS is a perfect match, which one is fine and which one definitely shouldn’t be used.
3. Made an Impact Map to understand where to start the software development from.
4. Identified a scope of features for the first version, and compiled a roadmap.
5. Estimated the costs and timeline for the design stage according to the scope. The app development stage was estimated approximately, we will make a precise estimate after the design stage is finished.

Now the project is successfully moving to the UI/UX design stage. We plan to finish the design by the time our client signs the contract with the selected BaaS — now the client's legal team is negotiating with different providers.

Why us?

Security and data privacy

Licensed banks or BaaS providers handle financial operations, while the app connects users to those services. We deploy on Amazon or Google infrastructure, which provides controls that can support a PCI DSS program. Compliance still has to be assessed for the complete product. We use GitLab and ArgoCD for controlled delivery, Laravel protections for risks such as SQL injection and CSRF, and infrastructure-level controls for DDoS attacks.

Approaches we use for security:

We use backups and Infrastructure as Code to make the system easier to reproduce and redeploy. These measures can shorten recovery after a security incident or data center outage. The actual recovery time and risk of data loss depend on the backup, replication, and disaster-recovery setup.

As a development company, we also use approaches such as least privilege approach and fine grained access. They help us to limit access of team members to specific parts of the project — only the DevOps engineer and team leaders have access to the production environment, while deployment happens automatically.

Microservice architecture

When product processes need to stay separate, we may use a microservice architecture. Independently deployed services can limit the impact of one component failing, although shared dependencies can still cause an outage. Separate service databases can reduce unnecessary data access, but every service still needs access controls and security monitoring.

Scalability is another requirement for financial software development, and microservices allow to scale specific services based on demand rather than scaling the entire application. Scaling actions in one service don’t directly affect others. It’s also possible to distribute instances of a microservice across multiple servers to handle increased load. Usually, we use Kubernetes as a container orchestration tool to automatically scale microservices up or down based on real-time traffic and performance metrics.

Considering regional specifics

Usually, each BaaS has a description of which regions it works in, we pay attention to this. for example, we can’t use a European BaaS for a UAE project, since there are both technical and legal nuances. As a development company, we can research BaaS solutions tailored for specific regions and collect a pool of solutions that can be suitable for your project technologically. Also, we always research the documentations of other third-party solutions we use to make sure that they are suitable for a particular region.

Ensuring fast time to market

Fintech applications need a short time to market. Such businesses roll out app updates very often — it can mean releasing every 3 days. Time to market strongly depends on the infrastructure and how the work is organized initially. We can work with your internal team and help them build new processes to organize a sustainable fintech software development process that will allow you to issue updates needed for the business quickly enough. Another important factor is quality assurance — testing the app manually every time is a huge amount of work and without a high level of automation it’s just impossible to test everything. Using the test-driven development approach, we automate the testing process and ensure 95% test coverage.

Avoiding vendor lock-in

In every app development project, we use reliable and well supported open-source solutions. This way, we avoid a vendor lock-in for our clients. Vendor lock-in occurs when a customer becomes dependent on a particular vendor for products or services, making it difficult to switch to another provider without spending significant time and costs. Moreover, the app code with all configurations is entirely in the ownership of our client. It means that you’re not tied to us as a fintech software development company and we can’t block the product’s progress or interfere with your business in any way.