Decision 01
Extract the ledger first, not the app.
The app was the visible problem; the ledger was the actual one. Fixing it first meant six more weeks before anything looked different to users.
TradeoffA quiet first sprint we had to defend twice.
A ledger split out from under a live wallet, without a maintenance window.
A regulated wallet whose month-end load had outgrown a single deployable. We split the ledger, rebuilt the app, and cut over without a maintenance window.
Client
A regulated e-money and wallet provider
Industry
Regulated fintech
Duration
14 weeks + run
Team
2 senior · 3 mid · 1 SRE
Stack
Flutter · Spring Boot · Postgres · AWS
Engagement
Dedicated team
The situation
Settlement, statements and payroll disbursement all landed in the same 48 hours, against a single deployable sharing one connection pool with the customer-facing API. Support tickets spiked on those two days, and the store rating was falling with them.
The previous vendor had proposed a full rewrite on a two-year horizon. The regulator’s reporting deadline was in five months.
Constraints we worked inside
Regulatory
Ledger immutability and a seven-year audit trail; no downtime window longer than four minutes.
Legacy
Two integrations we could not modify, both synchronous, both owned by third parties.
Deadline
Regulator reporting live in five months — non-negotiable, with penalties attached.
Budget
A ceiling that ruled out running two full platforms in parallel for more than one quarter.
Architecture
What we shipped, anonymised.
strangler pattern · 6 cutovers
Clients
Flutter app — iOS
Flutter app — Android
Agent back-office (web)
Edge
API gateway — routing, mTLS, idempotency keys, per-tenant rate limits new
Services
Ledger extracted
Settlement extracted
Reporting new
Legacy core retired wk 14
Events
transaction.posted → settlement.batched → report.generated
Data
Postgres — append-only ledger
Read replicas — reporting
Object store — 7yr archive
Decisions & tradeoffs
The calls we made, and what each one cost.
Decision 02
Postgres, not a purpose-built ledger database.
The client’s team already ran Postgres in production. A specialist store was faster on paper and unsupportable in practice once we left.
TradeoffPartition maintenance we now own.
Decision 03
Six small cutovers instead of one big one.
Each cutover was reversible in under four minutes. One of them did roll back — the write-up is in our post-mortem.
TradeoffDual-write complexity for eleven weeks.
What we’d do differently
We ran dual writes for eleven weeks when eight would have done. We were protecting a reconciliation edge case that, on the evidence, never occurred — and it cost the client roughly three weeks of engineering time.
Next case study
Four OEM portals and a spreadsheet, replaced by one fleet record.
Read it →Got a system like this one?
Ask us for a code sample or an architecture walkthrough from a comparable project. Anonymised, no NDA required, no sales call attached.
Scope your projectTell us what’s stuck.
A senior engineer reads every one of these. If we’re not the right fit we’ll say so, and point you at someone who is.
Start the conversation
No spam, no drip sequence. A senior engineer replies within one business day.