System design
Integration & Architecture
REST API, webhook and batch patterns with separable private data zones, connector isolation, model services, decision engine, evidence store and audit controls.
Deployment choices
Private-first hybrid architecture with explicit data-location controls.
The prototype supports a design where sensitive documents and images can remain in a private environment while only minimized query attributes are passed to approved external intelligence connectors.
Finpay / OnboardingREST / batch / event
→
KYB API GatewayAuth, rate limit, schema validation
→
Workflow OrchestratorCase state + module fan-out
→
Decision & EDDRules, scoring, human review
Private Data ZoneRaw documents / images
↔
AI RuntimeOCR / vision / NLP
↔
Connector GatewayApproved external sources
↔
Evidence + AuditLineage, hashes, reason codes
Integration modes
REST APIReal-time onboarding
WebhookAsync completion / EDD status
BatchBulk re-screening / migration
SDKOptional helper for client apps
Security boundaries
- API mTLS/OAuth2 or enterprise IAM integration.
- RBAC/ABAC, PAM for privileged users.
- Encryption in transit and at rest.
- Separate keys and encrypted private document store.
- Immutable/tamper-evident audit events.
- Secret-management and connector egress allowlist.
Deployment options to validate
SaaS multi-tenantOptional / policy dependent
Private cloudPreferred target
On-premiseFor sensitive AI runtime
HybridPrivate documents + external licensed intel
Illustrative API sequence
POST /v1/kyb/cases
POST /v1/kyb/cases/{id}/documents
POST /v1/kyb/cases/{id}/run
GET /v1/kyb/cases/{id}
GET /v1/kyb/cases/{id}/modules/{module}
GET /v1/kyb/cases/{id}/evidence
POST /v1/kyb/cases/{id}/edd/disposition
POST /v1/kyb/cases/{id}/corrections
GET /v1/kyb/cases/{id}/audit
Webhook: kyb.case.completed | kyb.case.edd_required | kyb.case.updated