Architecture
The backend is a set of small, single-purpose services on AWS. Each owns one job and one slice of data, and services communicate through events. Any service can fail, restart, or be redeployed on its own, and a bug is contained to one job.
| Component | Job |
|---|---|
| Pricer | Streams prices from the exchange feeds, computes fair value, issues firm quotes behind the safety-gate chain |
| Scanner | Watches the chain, detects orders, runs the refusal checks, admits or skips |
| Settler | The only component that touches the desk's wallets; executes fills and claims, at most once each |
| Hedger | Plans, places, monitors, and unwinds hedge positions across exchanges; reconciles against exchange truth |
| Inventory | The exact-integer ledger of every balance and reservation |
| Offchain | Pushes order status to the app in real time |
| Partner API | Runtime configuration surface and keyed access for programmatic partners |
| Admin | Authentication and session security for the console |
| Monitoring | Dashboards, alarms, and severity-tiered alerting |
| Edge gateway | Public entry point: routing, rate limiting, connection handling |
Cross-cutting properties
These apply across all services:
- The chain is the source of truth. Services observe it and react; none holds authoritative state the chain contradicts. After any missed event, reconciliation rebuilds the correct picture from the ledger.
- Fail closed. Without a price feed there is no price, without confirmed hedge capacity there is no quote, and without a matching quote there is no fill.
- Redundant checks on the money path. The scanner's admission checks are re-run independently by the settler before capital moves, so a bug in one is caught by the other.
- Every funds-at-risk path has a dead-letter queue and an alarm: a failed message is captured rather than dropped, and a human is paged.
- Geo-redundant connectivity to exchanges, so a regional block or outage cannot silence all feeds at once.