A strongly-consistent, double-entry ledger written in Rust that retires a decades-old mainframe, settling 8,000 transactions per second with five-nines availability and sub-50ms posting latency.
Money cannot be created or destroyed, so every post writes a balanced set of debit and credit entries inside one serializable PostgreSQL transaction. If debits don't equal credits, or an account would breach its overdraft limit, the whole transaction aborts, there is no partial state.
The journal is append-only and immutable. Balances are a materialized projection of that journal, which means any balance can be re-derived from first principles and audited line by line.
Rust lets the posting core run hot at 8,000 TPS without garbage-collection stalls polluting the p99. Connection pooling, prepared statements and batched commits keep PostgreSQL saturated but never blocked.
A transactional outbox bridges the database and Kafka: events are written in the same transaction as the journal entry, then relayed once durably committed, so downstream consumers see exactly what the ledger sees, in order.
| Component | Technology | Why |
|---|---|---|
| Posting core | Rust | Memory-safe, no GC pauses, predictable sub-50ms tail latency. |
| System of record | PostgreSQL | Serializable isolation enforces debit=credit and no-overdraft atomically. |
| Event backbone | Kafka | Transactional outbox gives exactly-once delivery to downstream systems. |
| Client API | gRPC | Strongly-typed contracts and streaming for low-overhead, high-fanout calls. |
| Runtime | Kubernetes | Multi-AZ scheduling and rolling deploys sustain five-nines availability. |
Every transfer posts balanced debit/credit pairs or fails atomically, the ledger always sums to zero.
PostgreSQL serializable transactions eliminate phantom reads and lost updates on hot accounts.
Client-keyed deduplication makes safe retries trivial and double-posting impossible.
Journal entry and Kafka event commit together, guaranteeing exactly-once downstream delivery.
A background reconciler replays the journal to prove materialized balances never drift.
Append-only journal gives regulators a complete, replayable history of every cent.
“Debits equal credits, or nothing happens, there is no third state in a ledger.”
The result is a core banking ledger that does what the mainframe did, only faster, cheaper to operate, and provably correct: 8,000 transactions per second at sub-50ms latency, five-nines availability across multi-AZ Kubernetes, and 2M+ accounts migrated with zero balance discrepancies. By treating correctness as a hard invariant enforced inside the database rather than a property to test for, the system turns "the books always balance" from a hope into a guarantee, and gives the business a modern, auditable foundation it fully owns.