Five areas of technical focus. Each one is described by the mechanism it uses, so an engineer can tell whether it is real.
Double-entry ledgers with invariants enforced in code: entries that must balance, immutable postings, derived balances, holds, and idempotency guaranteed by database constraints rather than by application checks. Integer minor units end to end.
Agents given narrow, revocable authority inside systems that record what they did. Policy is evaluated server-side and denies by default; anything above a threshold waits for a human; every decision leaves an audit record.
HTTP surfaces with explicit trust domains, signature verification before parsing, exception-to-status mapping, and retry semantics that assume the caller will retry. Provider adapters are injectable, so they can be tested without the provider.
Secrets out of source and out of argv, hashed and peppered credentials, constant-time comparison on anything an attacker can guess, fail-closed defaults, and public surfaces reduced to the one route that has to exist.
The unglamorous half of operating a system: reconciliation that tells a human when it needs them, health endpoints that report schema state, backups that are verified by restoring them, and deployment that is one command and repeatable.
An inbound notice from a payment provider is hostile input until its signature says otherwise. This is the whole public surface of a deployment: one route, authenticated on every request, failing closed.
POST /v1/webhooks/provider content-length=412
signature header present ................ yes
hmac-sha256 over raw body .............. compare_digest
verdict ................................ accepted
event id ............................... evt_8c1d2f (first delivery)
payout reference ....................... PO-91D4 (status: successful)
hold captured .......................... 125,000.00 NGN
ledger entry ........................... LE-4F82C1 (sums to 0.00)
POST /v1/webhooks/provider content-length=412
signature header present ................ yes
hmac-sha256 over raw body .............. mismatch
verdict ................................ 401 rejected, body never parsed
POST /v1/webhooks/provider content-length=412 (replay of evt_8c1d2f)
signature header present ................ yes
verdict ................................ accepted, claim already held
effect ................................. none · no second captureFails closed: an unsigned or mis-signed notice is rejected before the JSON is parsed, and a replay changes nothing.
A switchboard operator could connect any two lines in the building and no other. That is the shape of a good credential: narrow, explicit, and impossible to widen from the handset.
Agent, human and administrative authority are separate trust domains in these systems, and the HTTP layer keeps them apart before any handler runs.
| Control | Value | State |
|---|---|---|
| Per-transaction ceiling | ₦250,000.00 | set |
| Rolling daily cap | ₦500,000.00 · ₦125,000.00 used | set |
| Rolling monthly cap | ₦3,000,000.00 | set |
| Daily payout count | 12 · 3 used | set |
| Daily reset | 00:00 Africa/Lagos | zone-correct |
| Payee allowlist | 4 payees | enforced |
| Approval threshold | above ₦100,000.00 | human required |
| Agent freeze | off | available |
Evaluated before funds are held. With no ceiling set, every payout is refused.
Corebank is Python standard library only. Every dependency is something to audit, patch and trust.
Not that the happy path returns 200, but that the invariant holds under concurrency, retries and hostile input.
Each venture ships a list of what it does not do. It is the fastest way to tell whether a system was built by someone who ran it.
Infrastructure the operator controls, on hardware and domains they own, with the keys in their hands.
The interface fragments on this site are illustrative models of the mechanisms described, rendered in the browser from sample data. They are not live systems and show no real transaction, customer or balance.
If you are an engineer, the fastest way to judge this company is to ask what happens on the unhappy path: a duplicate webhook, a retried request, a provider that reports success twice, a daily cap at midnight in the wrong timezone.
We answer every serious message.
Expect a reply within two business days, from a person.