Move $3.5M a month across 25 borders without losing a cent or a customer. PCI-grade cross-border payments that settle in under three seconds and never lose their place.
A cross-border transfer touches a sender's bank, an FX provider and a foreign payout partner, any of which can time out mid-flight. We model every transfer as a Temporal workflow, so a debit that succeeds but a payout that stalls never leaves money in limbo.
Each step is idempotent and individually retryable. A worker can die mid-settlement and another picks up exactly where it left off, which is how we hold 99.9% on operations that span three external systems.
Raw card and account numbers are tokenized at ingest and never persisted in the clear. Everything sensitive is envelope-encrypted with AWS KMS data keys before it hits PostgreSQL.
That design keeps the bulk of our services out of PCI audit scope, shrinking the attack surface and the compliance burden at the same time.
| Component | Technology | Why |
|---|---|---|
| Orchestration | Temporal | Durable workflows survive crashes and retry each payment leg exactly once. |
| Encryption | AWS KMS | Envelope encryption keeps PANs out of PCI scope and rotates keys automatically. |
| Payments rails | Stripe | Tokenized card and bank capture across multiple regions out of the box. |
| System of record | PostgreSQL | ACID ledgers make double-entry reconciliation auditable and exact. |
| Runtime | Node.js | Async I/O handles high-concurrency corridor calls with low latency. |
Corridor-specific rates are held for the transfer window so neither party is surprised at settlement.
Temporal guarantees each debit, conversion and payout runs once, even across worker failures.
AWS KMS data keys protect every sensitive field with automatic key rotation.
PostgreSQL records every leg so reconciliation against partner books is exact and auditable.
Mismatched legs are flagged and retried or held without manual intervention.
Each route plugs in its own FX source and payout partner behind one settlement engine.
“A worker can die mid-transfer and the money still lands, durability is the feature, not the footnote.”
The result is a remittance platform that moves $3.5M+ every month across 25+ corridors, settles in under three seconds, and holds 99.9% on workflows that depend on three external systems at once. By making transfers durable Temporal workflows, keeping PANs tokenized and KMS-encrypted out of PCI scope, and reconciling every leg against an ACID ledger, the system stays fast, auditable, and impossible to leave money stranded in.