▸ prd.vault

vault

24 — List of IT Systems

docs/24-IT-Systems.mdtype: compliance-referenceupdated: 2026-08-17

List of IT Systems

Consolidated systems / asset register — one place to look up ownership, criticality and environment presence for every system and vendor the platform depends on. Previously this lived only piecemeal, split across the External Providers, AWS Deployment and Network Model references and 12-Environments. Those are internal documents, available on request, and remain the source of truth for integration detail, auth and failure behaviour; this page does not repeat it — see 20-Data-Flows#Integration surface for the call-by-call detail behind each provider row below.

Criticality

  • Critical — compromise or outage can stop money movement, breach a custody/compliance obligation, or cause unrecoverable data loss.
  • High — compromise or outage degrades security, delivery or operability, without itself misstating or stopping money movement.
  • Medium — compromise or outage is disruptive but carries no compliance or financial-integrity impact.

Dev / Beta / Prod in the Environment column means the system is present in all three per 12-Environments#The three environments.

Systems register

System Purpose Owner Environment Criticality Data Provider
DAX Platform / Application Client, merchant and admin product surfaces — the only place business logic runs Head of IT Unit Dev / Beta / Prod Critical Account, transaction, wallet, ledger and audit data — the platform's own system of record Internal
PostgreSQL (Amazon RDS) The platform's only datastore: ledger, pg-boss queues, sessions, rate limits, webhook inbox, audit log Head of IT Unit Dev / Beta / Prod Critical All of the above; the single backup/DR target Amazon Web Services (AWS)
AWS compute & networking (VPC, EC2, ALB, Route 53) Runtime hosting, edge routing, DNS Head of IT Unit Dev / Beta / Prod Critical Infrastructure configuration, network metadata Amazon Web Services (AWS)
AWS WAF Edge request filtering, rate-based rules, admin-hostname IP allowlist Head of IT Unit Dev / Beta / Prod High Request metadata, source IPs, security events Amazon Web Services (AWS)
AWS Secrets Manager Runtime secrets: provider API keys, the Fireblocks private key, DB credentials Head of IT Unit Dev / Beta / Prod Critical Credentials and provider secrets — no customer data Amazon Web Services (AWS)
AWS KMS Encryption keys for Secrets Manager, RDS storage, and (Prod) the DR replica Head of IT Unit Dev / Beta / Prod Critical Cryptographic key material and metadata Amazon Web Services (AWS)
Amazon CloudWatch Log group + metrics for the app/worker containers Head of IT Unit Dev / Beta / Prod High Application and infrastructure logs, metrics Amazon Web Services (AWS)
Amazon ECR Container image registry, scan-on-push Head of IT Unit Dev / Beta / Prod High Application container images Amazon Web Services (AWS)
Amazon S3 (internal buckets) ALB access logs, exports, generated artifacts — never the primary datastore Head of IT Unit Dev / Beta / Prod Medium Access logs, export files, generated artifacts Amazon Web Services (AWS)
Fireblocks Wallet custody, deposit-address allocation, payout/send signing and broadcast Head of IT Unit Dev / Beta / Prod Critical Wallet addresses, transaction instructions, custody balances Fireblocks
Fireblocks API Co-Signer callback handler (services/cosigner-callback) Answers the Co-Signer's approval and signing requests only after the application attests them: automated whitelist approval and one-time-address payout verification (28-External-Wallet-Strategy) Head of IT Unit Custody account (serves Beta / Prod) Critical Fireblocks request metadata (wallet ids, addresses, amounts), decision log — no customer identity Internal, on AWS Fargate
Sumsub KYC/KYB identity verification and onboarding checks Compliance Dev / Beta / Prod Critical Verification verdict, name, country — identity documents stay with Sumsub, never stored by the platform Sumsub
Elliptic Batch AML risk scoring for payout rows (24 h cache) Compliance Dev / Beta / Prod Critical Wallet/payee addresses, AML risk scores Elliptic
Mercuryo Card acquiring and fiat on/off-ramp for Buy / Sell Finance lead Dev / Beta / Prod High Charge status, payment metadata, wallet address — no card PAN (PCI scope sits with Mercuryo) Mercuryo
CEX.IO Crypto/EUR rate oracle — quotes, invoice rate-freeze, convert pricing Head of IT Unit Dev / Beta / Prod Medium Public market/pricing data only CEX.IO
Resend Transactional email — auth mail, notifications, payout/invoice mail Head of IT Unit Dev / Beta / Prod Medium Recipient email address, message content and metadata Resend
Better Stack Log/trace ingest, uptime monitors, worker heartbeat, public status page Head of IT Unit Dev / Beta / Prod High Application and infrastructure logs, metrics, traces, heartbeat/health data Better Stack
GitHub Source control for the entire codebase Head of IT Unit Dev / Beta / Prod High Source code, configuration, development metadata GitHub
GitHub Actions CI (test/build on PR) and CD (image build, push to ECR, deploy via OIDC-assumed AWS role) Head of IT Unit Dev / Beta / Prod High Build artefacts, deployment metadata; no long-lived AWS keys GitHub
Blockchain connectivity (through Fireblocks) Address validation, fee estimation, broadcast, on-chain lookups Head of IT Unit Dev / Beta / Prod Critical On-chain addresses and transaction data Fireblocks — folded in, no separate node/RPC vendor
Real-time sanctions & risk scoring (screenAddress, lib/aml) Per-address sanctions/score check at payee whitelisting and single-send time Compliance Dev / Beta / Prod Critical Wallet addresses, sanctions/score results Elliptic — folded in, no separate AML/sanctions vendor