Note: This project is under active development. Features and functionalities are continuously being enhanced to improve embedded finance capabilities and user experience.
Flowlet is a comprehensive cloud-agnostic embedded finance platform that enables businesses to seamlessly integrate financial services into their products. Built on a robust microservices architecture, Flowlet provides a complete suite of financial capabilities including digital wallets, payment processing, card issuance, KYC/AML compliance, and ledger management. The platform abstracts away the complexities of financial infrastructure, allowing businesses to focus on their core offerings while providing their customers with sophisticated financial services.
Designed with scalability, security, and compliance at its core, Flowlet connects to banking partners, payment processors, card networks, and regulatory services through a unified API layer. This architecture enables businesses from various sectors to embed financial services without the burden of building financial infrastructure from scratch or navigating the complex regulatory landscape alone.
Flowlet's developer-first approach includes comprehensive documentation, SDKs, and a robust developer portal that simplifies integration and accelerates time-to-market. The platform's modular design allows businesses to select only the components they need, creating a tailored embedded finance solution that grows with their requirements.
- Complete Embedded Finance Stack: Digital wallets, payment processing, card issuance, KYC/AML, and ledger management
- Cloud-Agnostic Microservices: Kubernetes-based infrastructure designed for high availability and scalability
- Developer-Friendly Integration: Comprehensive API gateway, SDKs, and developer portal
- Bank-Grade Security: End-to-end encryption, tokenization, and comprehensive audit trails
- Regulatory Compliance: Built-in workflows for GDPR, PSD2, FinCEN, and other regulatory frameworks
- AI-Enhanced Capabilities: Fraud detection, support chatbots, and developer assistance
- Operational Excellence: Robust DevOps automation, observability, and managed services
Flowlet's digital wallet system forms the foundation of the embedded finance platform, enabling businesses to provide their customers with secure, feature-rich financial accounts. The wallet infrastructure supports multiple currencies, real-time balance updates, and sophisticated transaction management capabilities.
The wallet system is designed with flexibility in mind, allowing businesses to create various wallet types tailored to specific use cases. Whether implementing a simple stored value account, a multi-currency business wallet, or a specialized escrow solution, Flowlet's wallet architecture accommodates diverse financial requirements while maintaining consistent security and compliance standards.
Each wallet is backed by a double-entry ledger system that ensures transactional integrity and provides comprehensive audit trails. The wallet service integrates seamlessly with other platform components, enabling smooth interactions with payment processing, card issuance, and regulatory compliance modules.
Flowlet's payment processing capabilities enable businesses to handle financial transactions across multiple channels and payment methods. The system supports both inbound and outbound payments, including bank transfers (ACH, SEPA, Wire), card payments, digital wallets, and alternative payment methods.
The payment infrastructure abstracts away the complexities of different payment processors and banking systems, providing a unified interface for all transaction types. This abstraction layer allows businesses to easily add new payment methods or switch processors without disrupting their core operations.
Real-time transaction monitoring and smart routing capabilities optimize payment flows for cost, speed, and success rate. The platform's event-driven architecture ensures that all payment events trigger appropriate notifications, ledger entries, and downstream processes, maintaining system-wide consistency and providing users with immediate feedback on their transactions.
Flowlet enables businesses to issue virtual and physical payment cards to their customers through integration with card issuing platforms like Marqeta. The card management system supports the complete card lifecycle, from issuance and activation to transaction processing and eventual deactivation.
Advanced card controls allow end-users to manage spending limits, enable or disable specific merchant categories, toggle online transactions, and freeze cards when needed. The platform also supports instant virtual card issuance, enabling immediate use in digital wallets and online transactions while physical cards are in transit.
The card service maintains synchronization between card transactions and the wallet system, ensuring consistent balance information and transaction history across all user touchpoints. Comprehensive dispute management workflows handle chargebacks and fraud claims efficiently, protecting both businesses and their customers.
Flowlet's compliance infrastructure streamlines the complex processes of Know Your Customer (KYC) and Anti-Money Laundering (AML) verification. The platform integrates with leading identity verification providers to offer flexible, risk-based compliance workflows that balance regulatory requirements with user experience.
The compliance engine supports various verification levels, from basic email verification to comprehensive identity checks including document scanning, biometric verification, and database screening. This tiered approach allows businesses to implement appropriate verification steps based on risk profiles, transaction volumes, and regulatory requirements.
Ongoing monitoring capabilities track transaction patterns and user behavior to detect suspicious activities, ensuring continuous compliance beyond the initial onboarding process. The compliance service maintains detailed audit trails of all verification steps and decisions, providing documentation for regulatory inquiries and internal reviews.
At the core of Flowlet's financial infrastructure is a robust double-entry ledger system that records all financial events with immutable audit trails. The ledger maintains the source of truth for all account balances and transaction histories, ensuring data consistency across the platform.
The accounting engine automatically generates the appropriate journal entries for various transaction types, handling complex scenarios like multi-currency operations, fee calculations, and settlement processes. The system supports real-time balance calculations and can generate financial reports including balance sheets, income statements, and cash flow analyses.
Reconciliation tools automatically match internal records against external sources like bank statements and payment processor reports, identifying and flagging discrepancies for review. This comprehensive approach to financial record-keeping ensures accuracy, auditability, and compliance with accounting standards.
Flowlet's developer-first approach is embodied in its comprehensive Developer Portal, which serves as the central hub for all integration resources. The portal provides interactive API documentation, SDKs for multiple programming languages, sample applications, and integration guides tailored to common use cases.
The API Gateway serves as the unified entry point for all service interactions, handling authentication, rate limiting, request routing, and response caching. This architecture simplifies integration by providing a consistent interface regardless of the underlying microservices being accessed.
The Developer Portal includes a sandbox environment that mimics production capabilities without affecting real financial systems, allowing developers to test integrations thoroughly before going live. Advanced features like the API Explorer enable interactive testing of endpoints directly from the documentation, accelerating the development process.
Flowlet leverages artificial intelligence to enhance various aspects of the platform, from fraud detection to developer support. The AI components are designed as independent services that integrate with the core platform through well-defined interfaces.
The AI Support Chatbot provides instant assistance to both developers and end-users, answering questions about platform capabilities, guiding users through common processes, and troubleshooting integration issues. The chatbot is trained on Flowlet's documentation and knowledge base, ensuring accurate and relevant responses.
The Fraud Detection Module uses machine learning algorithms to analyze transaction patterns and identify potentially fraudulent activities. The system continuously learns from new data, improving its accuracy over time while adapting to evolving fraud techniques. When suspicious activity is detected, the system can trigger various responses ranging from additional verification steps to temporary account restrictions.
Security is foundational to Flowlet's architecture, with multiple layers of protection safeguarding sensitive financial data and transactions. The platform implements end-to-end encryption for data both at rest and in transit, ensuring that information remains protected throughout its lifecycle.
Tokenization is employed for sensitive data like payment card details, replacing actual values with non-sensitive equivalents that can be safely stored and processed. This approach minimizes the scope of systems handling sensitive data, reducing compliance burden and security risks.
Comprehensive access controls govern all system interactions, with role-based permissions and multi-factor authentication enforcing the principle of least privilege. The security infrastructure includes advanced threat detection systems that monitor for unusual patterns or potential breaches, enabling rapid response to security incidents.
Flowlet is built on a cloud-agnostic microservices architecture designed for scalability, resilience, and security. The platform employs a Kubernetes-based infrastructure that enables consistent deployment across various cloud providers or on-premises environments, giving businesses flexibility in their hosting choices while maintaining operational consistency.
The architecture follows a domain-driven design approach, with services organized around business capabilities rather than technical functions. This organization ensures that each microservice has a clear, bounded context and can evolve independently while maintaining well-defined interfaces with other components. The resulting system is both modular and cohesive, allowing for targeted scaling and updates without disrupting the entire platform.
At the infrastructure level, Flowlet leverages containerization and orchestration technologies to ensure consistent environments across development, testing, and production. Infrastructure-as-Code practices using tools like Terraform enable reproducible deployments and simplified disaster recovery procedures. This approach also facilitates multi-region deployments for businesses with global operations or specific data residency requirements.
Communication between services primarily follows an event-driven pattern, with a robust message broker (Kafka) facilitating asynchronous interactions. This design choice enhances system resilience by allowing services to operate independently even when downstream components experience issues. For synchronous communication needs, services interact through well-defined REST APIs or gRPC interfaces, with the API Gateway providing a unified entry point for external integrations.
The platform's data architecture implements a polyglot persistence strategy, selecting the optimal database technology for each service's specific requirements. Transactional services utilize PostgreSQL for ACID-compliant operations, while analytics components leverage MongoDB for flexible data storage. Time-series data for monitoring and reporting is handled by specialized databases like InfluxDB, ensuring optimal performance for each data access pattern.
The Flowlet platform consists of several interconnected layers, each containing specialized components that work together to deliver the complete embedded finance solution:
-
API Layer: The entry point for all external interactions, comprising the API Gateway and Developer Portal. This layer handles authentication, request routing, rate limiting, and documentation.
-
Core Services Layer: The fundamental financial services including Wallet Management, Payment Processing, Card Services, KYC/AML, and Ledger. These components implement the core business logic of the platform.
-
Integration Layer: Connectors to external financial systems including Banking Partners, Payment Processors, Card Networks, and Compliance Vendors. This layer abstracts away the complexities of these integrations.
-
Data Layer: Specialized databases and data processing components that maintain the system's state and enable analytics. This includes transactional databases, document stores, and event streams.
-
Support Services Layer: Cross-cutting concerns like Authentication, Notification, Reporting, and AI Services that provide capabilities used by multiple core services.
-
Infrastructure Layer: The foundation of the platform, including Kubernetes orchestration, monitoring systems, CI/CD pipelines, and security components.
Each layer is designed with clear responsibilities and interfaces, enabling independent scaling and evolution while maintaining system cohesion. This architecture supports Flowlet's goal of providing a comprehensive yet modular embedded finance solution that can adapt to diverse business requirements.
The Wallet Service is the cornerstone of Flowlet's financial infrastructure, managing the creation, updating, and monitoring of digital wallets across the platform. Each wallet represents a financial account that can hold balances in one or multiple currencies, process transactions, and maintain a comprehensive transaction history.
The service implements a sophisticated state machine that tracks wallet status throughout its lifecycle, from creation and verification to active use and potential suspension or closure. This approach ensures that wallets always transition through valid states and that appropriate validations occur at each stage. For example, a wallet cannot process transactions until it has passed the required verification steps, and a suspended wallet cannot receive funds until its status is restored.
Wallet balances are calculated in real-time using the double-entry ledger system, ensuring that every transaction is properly accounted for and that balances accurately reflect all completed operations. The service supports various wallet types with different characteristics, including:
- User Wallets: Personal accounts for individual end-users
- Business Wallets: Accounts for merchants or corporate entities
- Escrow Wallets: Specialized accounts for holding funds during transaction settlement
- Operating Wallets: Internal accounts for platform operations like fee collection
The Wallet Service exposes APIs for wallet management, balance inquiries, transaction history, and administrative operations. It communicates with other services through both synchronous APIs and asynchronous events, ensuring that wallet state changes trigger appropriate actions throughout the system.
The Payments Service orchestrates the movement of funds both within the Flowlet ecosystem and between Flowlet and external financial systems. It handles various payment methods including bank transfers (ACH, SEPA, Wire), card payments, digital wallet transfers, and alternative payment methods.
For each payment type, the service implements specialized processing workflows that account for the unique characteristics of that payment method. For example, card payments require authorization, capture, and settlement steps, while ACH transfers involve batch processing and delayed settlement. These workflows are implemented as state machines that track each transaction through its lifecycle, ensuring proper handling of success, failure, and intermediate states.
The Payments Service integrates with multiple payment processors and banking partners, abstracting away their differences behind a unified interface. This abstraction layer enables smart routing capabilities that can select the optimal processing path based on factors like cost, speed, success probability, and geographic restrictions. The service also implements retry mechanisms and fallback strategies to maximize transaction success rates.
Payment events are published to the platform's event stream, triggering appropriate ledger entries, notifications, and downstream processes. This event-driven approach ensures system-wide consistency and provides users with immediate feedback on their transactions.
The Card Service enables businesses to issue virtual and physical payment cards to their customers, creating a direct link between wallet balances and card-based spending. The service integrates with card issuing platforms like Marqeta to handle the technical aspects of card issuance, activation, and transaction processing.
Card management capabilities include:
- Issuance: Creating virtual cards instantly and ordering physical cards
- Activation: Securely activating physical cards upon receipt
- Controls: Setting spending limits, merchant category restrictions, and geographic controls
- Status Management: Freezing, unfreezing, and permanently closing cards
- PIN Management: Secure PIN setting and resetting
- Dispute Handling: Managing chargebacks and fraud claims
The Card Service maintains synchronization between card transactions and the wallet system, ensuring that card purchases immediately reflect in wallet balances and transaction history. It also implements sophisticated authorization rules that can evaluate transactions against various criteria including available balance, merchant type, transaction location, and spending patterns.
For businesses implementing card programs, the service provides program management capabilities including card design customization, spending analytics, and compliance monitoring. These features enable businesses to create branded card experiences while maintaining control over their card programs.
The KYC/AML Service manages the complex processes of identity verification and regulatory compliance, ensuring that Flowlet-powered financial services meet legal requirements while providing a smooth user experience. The service implements risk-based verification workflows that can be tailored to different business models, user segments, and regulatory jurisdictions.
The core verification process includes:
- Basic Verification: Email and phone verification to establish initial identity
- Document Verification: Scanning and validating government-issued identification
- Biometric Verification: Facial recognition matching against ID documents
- Database Screening: Checking against sanctions lists, PEP databases, and adverse media
- Enhanced Due Diligence: Additional verification steps for high-risk cases
The service integrates with specialized KYC/AML providers to perform these verifications, abstracting away the complexities of different vendor APIs and data formats. This approach allows businesses to switch providers or implement multi-vendor strategies without disrupting their verification workflows.
Beyond initial verification, the KYC/AML Service implements ongoing monitoring capabilities that track user behavior and transaction patterns to detect suspicious activities. When potential issues are identified, the service can trigger various responses ranging from additional verification requirements to account restrictions or regulatory filings.
All verification steps and decisions are meticulously logged, creating comprehensive audit trails that demonstrate compliance with regulatory requirements. These records are structured to facilitate both internal reviews and regulatory examinations, reducing the burden of compliance reporting.
The Ledger Service maintains the financial system of record for the entire Flowlet platform, implementing a double-entry accounting system that ensures transactional integrity and provides comprehensive audit trails. Every financial operation within the platform results in at least two ledger entries—a debit and a credit—maintaining the fundamental accounting equation where assets equal liabilities plus equity.
The service organizes financial data into a hierarchical chart of accounts that can be customized to meet specific business requirements. This structure enables detailed financial reporting at various levels of granularity, from individual transaction details to aggregated financial statements. The ledger supports multiple currencies with proper handling of exchange rates and conversion gains or losses.
Key capabilities of the Ledger Service include:
- Journal Entry Creation: Automatically generating appropriate entries for various transaction types
- Balance Calculation: Real-time computation of account balances across multiple dimensions
- Financial Reporting: Generating balance sheets, income statements, and cash flow analyses
- Reconciliation: Matching internal records against external sources like bank statements
- Audit Support: Maintaining immutable records with comprehensive metadata
The ledger implements a temporal data model that preserves the history of all financial records, enabling point-in-time reporting and historical analysis. This approach ensures that financial reports remain consistent even as new transactions are processed, providing a reliable foundation for business decisions and regulatory compliance.
The API Gateway serves as the unified entry point for all external interactions with the Flowlet platform, providing a consistent interface regardless of the underlying microservices being accessed. This component handles cross-cutting concerns including authentication, authorization, rate limiting, request routing, and response caching.
The gateway implements a layered security model that validates requests at multiple levels:
- Authentication: Verifying the identity of the calling application or user
- Authorization: Checking permissions against the requested operation
- Input Validation: Ensuring request parameters meet format and business rule requirements
- Rate Limiting: Protecting against abuse by limiting request frequency
- Threat Detection: Identifying and blocking potentially malicious patterns
Beyond security, the API Gateway provides operational capabilities that enhance the developer experience and system reliability. These include request logging for debugging, response caching for performance optimization, and circuit breaking to prevent cascading failures during service disruptions.
The gateway also handles API versioning, allowing services to evolve while maintaining backward compatibility for existing integrations. This approach enables continuous platform enhancement without disrupting businesses that have already integrated with Flowlet.
The Developer Portal serves as the central hub for all integration resources, providing comprehensive documentation, interactive tools, and support resources for businesses implementing Flowlet's embedded finance capabilities. The portal is designed to accelerate integration efforts and reduce the technical barriers to offering financial services.
Key components of the Developer Portal include:
- Interactive API Documentation: Comprehensive endpoint descriptions with request/response examples
- SDKs and Libraries: Pre-built integration components for popular programming languages
- Sample Applications: Working examples demonstrating common integration patterns
- Sandbox Environment: A fully functional test environment that mimics production capabilities
- API Explorer: Interactive tool for testing API calls directly from the documentation
- Integration Guides: Step-by-step instructions for implementing specific use cases
- AI Documentation Assistant: Intelligent chatbot that answers integration questions
The portal implements a role-based access model that allows businesses to manage developer accounts and control access to different resources. This approach enables secure collaboration among development teams while maintaining appropriate separation of concerns.
For businesses in the integration process, the Developer Portal provides real-time status dashboards showing API availability, service health, and upcoming maintenance windows. These operational insights help development teams plan their work and troubleshoot integration issues effectively.
Flowlet's architecture leverages a carefully selected technology stack that balances innovation with reliability, ensuring the platform can deliver bank-grade financial services while remaining adaptable to evolving requirements. The technology choices reflect a commitment to scalability, security, and developer experience.
- TypeScript/Node.js: Primary language for microservices, offering strong typing and modern JavaScript features
- Python: Used for data processing, machine learning components, and specialized financial calculations
- Go: Employed for performance-critical services requiring low latency and high throughput
- NestJS: Structured framework for building scalable server-side applications
- Express.js: Lightweight framework for specific microservices with simpler requirements
- FastAPI: Python framework for high-performance API services, particularly in data-intensive components
- PostgreSQL: Primary relational database for transactional data requiring ACID compliance
- MongoDB: Document store for flexible data models and analytics
- Redis: In-memory data store for caching, session management, and real-time features
- InfluxDB: Time-series database for monitoring metrics and performance data
- Apache Kafka: Backbone of the event-driven architecture, handling service communication and event sourcing
- RabbitMQ: Message broker for specific synchronous messaging requirements
- Redis Streams: Lightweight streaming for real-time notifications and updates
- TensorFlow/PyTorch: Frameworks for fraud detection models and advanced analytics
- scikit-learn: Library for traditional machine learning algorithms and data preprocessing
- Hugging Face Transformers: NLP models powering the AI chatbots and documentation assistants
- React: Library for building dynamic user interfaces for admin portals and dashboards
- TypeScript: Strongly-typed language enhancing code quality and developer experience
- Redux Toolkit: State management for complex application flows
- Material-UI: Component library providing consistent design language
- D3.js: Data visualization library for interactive charts and graphs
- React Native: Cross-platform framework for iOS and Android applications
- Expo: Toolchain for streamlining React Native development
- Native Base: UI component library optimized for React Native
- Redux: State management consistent with web applications
- Docker: Container platform for consistent environments across development and production
- Kubernetes: Container orchestration for automated deployment, scaling, and management
- Helm: Package manager for Kubernetes applications
- GitHub Actions: Continuous integration and deployment automation
- Terraform: Infrastructure as code for cloud resource provisioning
- ArgoCD: GitOps continuous delivery for Kubernetes
- Prometheus: Metrics collection and alerting
- Grafana: Visualization of metrics and operational dashboards
- Elastic Stack (ELK): Log aggregation, search, and analysis
- Jaeger: Distributed tracing for performance monitoring
- Vault: Secrets management and data protection
- Cert-Manager: Certificate lifecycle management
- OPA (Open Policy Agent): Policy-based control for Kubernetes
- Falco: Runtime security monitoring
Flowlet's cloud-agnostic architecture supports deployment on major cloud platforms:
- AWS: Amazon Web Services for comprehensive cloud infrastructure
- GCP: Google Cloud Platform with strong data processing capabilities
- Azure: Microsoft's cloud offering with robust enterprise integration
- Private Cloud: Support for on-premises or dedicated hosting environments
This technology stack provides a robust foundation for Flowlet's embedded finance capabilities while maintaining the flexibility to incorporate new technologies as they emerge. The platform's modular architecture allows individual components to evolve independently, enabling continuous improvement without disrupting the overall system.
Getting started with Flowlet involves several steps to set up your development environment, configure the necessary services, and begin integrating the platform into your application. This guide provides a comprehensive walkthrough of the process, from initial setup to your first transaction.
Before setting up Flowlet, ensure you have the following prerequisites installed and configured:
- Docker and Docker Compose (version 20.10+)
- Kubernetes cluster (version 1.22+) or local alternative like Minikube
- Helm (version 3.8+) for Kubernetes package management
- Node.js (version 16+) for running the admin tools and SDKs
- kubectl configured to access your Kubernetes cluster
- Terraform (version 1.0+) for infrastructure provisioning
- Git for version control and deployment workflows
Additionally, you'll need access credentials for the Flowlet container registry and configuration repository, which will be provided during the onboarding process.
For development environments, Flowlet provides a streamlined setup script that automates the installation process:
# Clone the Flowlet repository
git clone https://github.com/flowlet/flowlet-platform.git
cd flowlet-platform
# Run the setup script with your environment name
./setup.sh --env development --namespace flowlet-dev
# Verify the installation
kubectl get pods -n flowlet-devThe setup script performs several actions:
- Creates the necessary Kubernetes namespace
- Sets up configuration secrets from environment variables or prompt
- Deploys core Flowlet services using Helm charts
- Configures networking and ingress controllers
- Initializes the database schemas and seed data
- Deploys the Developer Portal and admin interfaces
After running the script, you can access the Developer Portal at http://localhost:8080/developer and the Admin Dashboard at http://localhost:8080/admin using the default credentials provided during setup.
For production environments or customized deployments, a manual installation process gives you more control over the configuration:
Create the necessary cloud infrastructure using the provided Terraform modules:
cd infrastructure/terraform
terraform init
terraform apply -var-file=environments/production.tfvarsThis will provision the required resources including Kubernetes clusters, databases, message brokers, and networking components.
Configure the secrets management system to store sensitive credentials:
# Install and configure Vault
helm repo add hashicorp https://helm.releases.hashicorp.com
helm install vault hashicorp/vault --namespace flowlet-system --create-namespace
# Initialize Vault and store the unseal keys securely
kubectl exec -it vault-0 -n flowlet-system -- vault operator init
# Set up the required secrets
kubectl apply -f kubernetes/secrets/flowlet-secrets.yamlDeploy the core Flowlet services using Helm:
cd kubernetes/helm
helm dependency update flowlet
helm install flowlet ./flowlet --namespace flowlet --create-namespace -f values/production.yamlSet up connections to external services like banking partners, payment processors, and KYC providers:
# Apply the integration configurations
kubectl apply -f kubernetes/config/integrations/Run the initialization jobs to set up databases and create initial admin accounts:
kubectl apply -f kubernetes/jobs/init-system.yaml
kubectl wait --for=condition=complete job/flowlet-init -n flowletEnsure all components are running correctly:
kubectl get pods -n flowlet
kubectl get services -n flowlet
kubectl get ingress -n flowletFlowlet's behavior can be customized through various configuration options, stored in a hierarchical structure:
- System Configuration: Platform-wide settings affecting all tenants
- Tenant Configuration: Settings specific to each business using the platform
- Service Configuration: Settings for individual microservices
- Integration Configuration: Connection details for external services
The configuration can be managed through:
- YAML files applied to Kubernetes as ConfigMaps
- Environment variables for container-specific settings
- The Admin Dashboard for runtime configuration changes
- API calls for programmatic configuration updates
Key configuration areas include:
- Banking Connections: Credentials and endpoints for banking partners
- Payment Processors: API keys and webhook configurations
- KYC/AML Settings: Verification workflows and provider credentials
- Fee Structures: Transaction fee configurations and revenue sharing rules
- Notification Templates: Email and SMS templates for user communications
- Compliance Rules: Transaction monitoring and reporting thresholds
Once Flowlet is set up, you can begin integrating it into your application:
-
Create an API Client: Access the Developer Portal and create a new API client to obtain your API keys.
-
Install the SDK: Add the Flowlet SDK to your application:
npm install @flowlet/sdk
-
Initialize the Client:
import { FlowletClient } from '@flowlet/sdk'; const flowlet = new FlowletClient({ apiKey: 'your_api_key', environment: 'sandbox', // or 'production' });
-
Create a Wallet:
const wallet = await flowlet.wallets.create({ ownerId: 'user-123', type: 'individual', currency: 'USD', metadata: { userEmail: 'user@example.com', }, });
-
Process a Payment:
const payment = await flowlet.payments.create({ sourceWalletId: wallet.id, amount: 1000, // $10.00 currency: 'USD', description: 'Test payment', metadata: { orderId: 'order-123', }, });
-
Monitor Events:
flowlet.events.subscribe('payment.completed', (event) => { console.log('Payment completed:', event.data); // Update your application state });
The Developer Portal provides comprehensive guides for more complex integration scenarios, including card issuance, compliance workflows, and advanced payment features.
Flowlet provides comprehensive API documentation to facilitate seamless integration with the platform. The API follows RESTful principles with consistent patterns across all endpoints, making it intuitive for developers to work with different platform capabilities.
The Flowlet API is organized around core resources that represent the fundamental entities within the platform. Each resource supports standard HTTP methods for creating, reading, updating, and deleting entities:
- GET: Retrieve a resource or list of resources
- POST: Create a new resource
- PUT/PATCH: Update an existing resource
- DELETE: Remove a resource
All API requests require authentication using API keys or OAuth tokens, which can be generated and managed through the Developer Portal. Requests and responses use JSON format with consistent structures for error handling, pagination, and metadata.
The Wallets API enables the creation and management of digital wallets, which serve as the foundation for financial operations within the platform.
GET /v1/wallets # List wallets
POST /v1/wallets # Create a wallet
GET /v1/wallets/{id} # Retrieve a wallet
PUT /v1/wallets/{id} # Update a wallet
DELETE /v1/wallets/{id} # Delete a wallet
GET /v1/wallets/{id}/balance # Get wallet balance
GET /v1/wallets/{id}/transactions # List wallet transactions
Example wallet creation request:
POST /v1/wallets
{
"type": "individual",
"ownerId": "user-123",
"currency": "USD",
"metadata": {
"userEmail": "user@example.com",
"userPhone": "+15551234567"
}
}The Payments API handles the movement of funds between wallets and external financial systems, supporting various payment methods and workflows.
GET /v1/payments # List payments
POST /v1/payments # Create a payment
GET /v1/payments/{id} # Retrieve a payment
POST /v1/payments/{id}/cancel # Cancel a pending payment
GET /v1/payment-methods # List payment methods
POST /v1/payment-methods # Create a payment method
Example payment creation request:
POST /v1/payments
{
"sourceType": "wallet",
"sourceId": "wallet-123",
"destinationType": "external_account",
"destinationId": "account-456",
"amount": 1000,
"currency": "USD",
"description": "Invoice payment",
"metadata": {
"invoiceId": "inv-789"
}
}The Cards API enables the issuance and management of virtual and physical payment cards linked to wallets.
GET /v1/cards # List cards
POST /v1/cards # Issue a card
GET /v1/cards/{id} # Retrieve card details
PUT /v1/cards/{id} # Update card settings
POST /v1/cards/{id}/activate # Activate a physical card
POST /v1/cards/{id}/freeze # Freeze a card
POST /v1/cards/{id}/unfreeze # Unfreeze a card
DELETE /v1/cards/{id} # Cancel a card
Example card issuance request:
POST /v1/cards
{
"walletId": "wallet-123",
"type": "virtual",
"cardholderName": "John Doe",
"billingAddress": {
"line1": "123 Main St",
"city": "San Francisco",
"state": "CA",
"postalCode": "94105",
"country": "US"
},
"metadata": {
"department": "Engineering"
}
}The KYC API manages identity verification workflows for individuals and businesses, supporting regulatory compliance requirements.
POST /v1/verifications # Start a verification process
GET /v1/verifications/{id} # Check verification status
PUT /v1/verifications/{id} # Update verification data
POST /v1/verifications/{id}/documents # Upload verification documents
GET /v1/verification-templates # List verification templates
Example verification initiation request:
POST /v1/verifications
{
"type": "individual",
"entityId": "user-123",
"level": "enhanced",
"callbackUrl": "https://example.com/webhooks/kyc",
"personData": {
"firstName": "John",
"lastName": "Doe",
"dateOfBirth": "1980-01-01",
"email": "john@example.com",
"phone": "+15551234567",
"address": {
"line1": "123 Main St",
"city": "San Francisco",
"state": "CA",
"postalCode": "94105",
"country": "US"
}
}
}The Ledger API provides access to financial records and accounting data, enabling detailed tracking and reporting of all transactions.
GET /v1/accounts # List ledger accounts
POST /v1/accounts # Create a ledger account
GET /v1/accounts/{id} # Retrieve account details
GET /v1/accounts/{id}/balance # Get account balance
GET /v1/journal-entries # List journal entries
GET /v1/journal-entries/{id} # Retrieve a journal entry
GET /v1/reports/balance-sheet # Generate balance sheet
GET /v1/reports/income-statement # Generate income statement
Example ledger account creation request:
POST /v1/accounts
{
"name": "User Deposits",
"type": "liability",
"currency": "USD",
"externalId": "user-deposits-001",
"metadata": {
"department": "Treasury"
}
}Flowlet uses webhooks to notify your application about events happening in real-time. This enables your systems to react to changes without polling the API for updates.
To use webhooks:
- Register webhook endpoints in the Developer Portal
- Configure the events you want to receive
- Implement handlers for these events in your application
- Verify webhook signatures to ensure authenticity
Example webhook payload:
{
"id": "evt-123456",
"type": "payment.completed",
"created": "2025-05-23T12:34:56Z",
"data": {
"id": "payment-789",
"amount": 1000,
"currency": "USD",
"status": "completed",
"sourceId": "wallet-123",
"destinationId": "wallet-456"
}
}Flowlet follows semantic versioning for the API, with the version specified in the URL path (e.g., /v1/wallets). This approach ensures backward compatibility while allowing the platform to evolve.
Major version changes (e.g., v1 to v2) indicate breaking changes that require client updates. Within a major version, new features and non-breaking changes are added continuously without requiring client modifications.
The Developer Portal provides detailed documentation for each API version, including migration guides when moving between major versions.
To simplify integration, Flowlet provides official SDKs for popular programming languages:
- JavaScript/TypeScript: For web and Node.js applications
- Python: For data science and backend services
- Java: For enterprise applications
- Go: For high-performance services
- Ruby: For Ruby on Rails applications
- PHP: For PHP-based web applications
These SDKs handle authentication, request formatting, error handling, and response parsing, allowing developers to interact with the API using native language constructs rather than raw HTTP requests.
Example using the JavaScript SDK:
import { Flowlet } from '@flowlet/sdk';
const flowlet = new Flowlet({
apiKey: 'your_api_key',
environment: 'sandbox'
});
// Create a wallet
const wallet = await flowlet.wallets.create({
type: 'individual',
ownerId: 'user-123',
currency: 'USD'
});
// Process a payment
const payment = await flowlet.payments.create({
sourceId: wallet.id,
sourceType: 'wallet',
destinationId: 'wallet-456',
destinationType: 'wallet',
amount: 1000,
currency: 'USD'
});
// Subscribe to events
flowlet.events.on('payment.completed', (event) => {
console.log('Payment completed:', event.data);
});The Developer Portal provides comprehensive documentation for each SDK, including installation instructions, API references, and code examples for common use cases.
Security and regulatory compliance are foundational elements of Flowlet's architecture, reflecting the platform's commitment to protecting sensitive financial data and meeting the complex requirements of financial services regulation. This comprehensive approach ensures that businesses using Flowlet can confidently offer embedded finance capabilities while maintaining the highest standards of security and compliance.
Flowlet implements a defense-in-depth security strategy with multiple layers of protection:
Data security begins with comprehensive encryption strategies that protect information throughout its lifecycle:
-
Encryption at Rest: All sensitive data is encrypted in databases and file storage using AES-256 encryption. Database-level encryption is complemented by application-level encryption for particularly sensitive fields like account numbers and personal identification information.
-
Encryption in Transit: All network communications use TLS 1.3 with strong cipher suites, ensuring that data cannot be intercepted during transmission between services or between Flowlet and external systems.
-
Tokenization: Payment card data and bank account details are tokenized immediately upon receipt, replacing sensitive information with non-sensitive tokens that can be safely stored and processed. The original data is securely stored in specialized vaults with strict access controls.
-
Data Minimization: The platform follows the principle of collecting and retaining only the data necessary for business operations, reducing the scope of sensitive information that must be protected.
Flowlet implements a sophisticated access control system that enforces the principle of least privilege:
-
Role-Based Access Control (RBAC): Granular permissions are assigned based on user roles, ensuring that individuals can access only the resources and operations necessary for their responsibilities.
-
Multi-Factor Authentication (MFA): Administrative access requires multiple verification factors, typically combining something the user knows (password) with something they possess (mobile device) or something they are (biometric verification).
-
Just-In-Time Access: Privileged access to production systems is granted temporarily and with specific scope, reducing the window of opportunity for potential misuse.
-
Audit Logging: All access attempts and administrative actions are logged with detailed context, creating comprehensive audit trails for security monitoring and compliance reporting.
The platform's infrastructure incorporates multiple security controls:
-
Network Segmentation: Services are organized into security zones with controlled communication paths between zones, limiting the potential impact of security breaches.
-
Web Application Firewall (WAF): API endpoints are protected by WAF rules that detect and block common attack patterns like SQL injection, cross-site scripting, and request forgery.
-
DDoS Protection: The platform includes distributed denial-of-service protection that can absorb and mitigate large-scale attack traffic while maintaining service availability for legitimate users.
-
Container Security: All services run in hardened containers with minimal attack surface, regular vulnerability scanning, and runtime protection against unauthorized behavior.
Flowlet's security is actively maintained through ongoing operational processes:
-
Vulnerability Management: Regular automated scanning and manual penetration testing identify potential vulnerabilities, which are prioritized and remediated based on risk assessment.
-
Security Monitoring: A Security Information and Event Management (SIEM) system collects and analyzes logs from across the platform, using correlation rules and anomaly detection to identify potential security incidents.
-
Incident Response: A formal incident response process ensures rapid detection, containment, eradication, and recovery from security events, with clear communication protocols for affected parties.
-
Security Updates: The platform follows a rigorous patch management process that quickly applies security updates while maintaining system stability and availability.
Flowlet is designed to support compliance with various financial regulations across different jurisdictions:
The platform incorporates features that facilitate compliance with data privacy regulations like GDPR and CCPA:
-
Data Mapping: Comprehensive documentation of data flows and processing activities provides visibility into how personal information is handled.
-
Consent Management: Flexible mechanisms for capturing, storing, and honoring user consent preferences regarding data collection and processing.
-
Data Subject Rights: Built-in workflows support data access, correction, portability, and deletion requests from individuals.
-
Data Retention Policies: Configurable retention periods ensure that personal data is not kept longer than necessary for its intended purpose.
Flowlet supports compliance with financial regulations through specialized features:
-
KYC/AML Compliance: Customizable verification workflows implement risk-based approaches to customer due diligence, supporting compliance with anti-money laundering regulations like FinCEN requirements in the US and AML directives in the EU.
-
Transaction Monitoring: Automated systems detect potentially suspicious activities based on configurable rules and risk models, generating alerts and supporting required regulatory reporting.
-
Payment Services Regulations: The platform incorporates controls required by payment services regulations like PSD2 in Europe, including strong customer authentication and secure communication standards.
-
Financial Reporting: Comprehensive record-keeping and reporting capabilities support regulatory requirements for financial transparency and accountability.
Flowlet maintains extensive documentation to support businesses in their compliance efforts:
-
Compliance Controls Matrix: Mapping of platform features to specific regulatory requirements, helping businesses understand how Flowlet supports their compliance obligations.
-
Security Certifications: The platform undergoes regular third-party assessments against industry standards like SOC 2, PCI DSS, and ISO 27001, with certification reports available to customers.
-
Audit Support: Detailed logs and reports facilitate regulatory examinations and audits, reducing the burden on businesses when demonstrating compliance.
-
Policy Templates: Sample policies and procedures that businesses can adapt for their specific regulatory context, accelerating compliance implementation.
Beyond built-in compliance features, Flowlet offers Compliance as a Service capabilities that actively support businesses in meeting their regulatory obligations:
-
Regulatory Monitoring: Ongoing tracking of regulatory changes across jurisdictions, with proactive updates to platform capabilities to address new requirements.
-
Compliance Advisory: Access to financial compliance experts who can provide guidance on regulatory questions and implementation approaches.
-
Automated Reporting: Generation of required regulatory reports based on platform data, reducing the manual effort involved in compliance reporting.
-
Compliance Testing: Regular simulated transactions and scenarios to verify that compliance controls are functioning as expected.
This comprehensive approach to security and compliance enables businesses to confidently offer embedded finance services while managing regulatory risk effectively. By building these capabilities into the platform core, Flowlet allows businesses to focus on their unique value proposition rather than the complexities of financial compliance.
Flowlet's development and deployment processes are designed to balance rapid innovation with the stability and reliability required for financial services. The platform employs modern DevOps practices and tools to ensure consistent, repeatable deployments while maintaining high quality standards.
Flowlet follows a structured development workflow that promotes code quality and collaboration:
All platform code is managed in Git repositories with a branching strategy that supports parallel development:
- Main Branch: The stable branch containing production-ready code
- Development Branch: Integration branch for features being prepared for release
- Feature Branches: Short-lived branches for individual feature development
- Release Branches: Created for release preparation and stabilization
- Hotfix Branches: For critical fixes that need immediate deployment
This branching strategy allows multiple teams to work concurrently while maintaining a clear path to production for new features and fixes.
Several automated processes ensure code quality throughout development:
- Linting: Automated code style and quality checks using ESLint for JavaScript/TypeScript, Flake8 for Python, and similar tools for other languages
- Static Analysis: Identification of potential bugs, security vulnerabilities, and performance issues using tools like SonarQube
- Unit Testing: Comprehensive test coverage for individual components using Jest, PyTest, and JUnit
- Integration Testing: Verification of component interactions using contract tests and API-level integration tests
- End-to-End Testing: Validation of complete user journeys using tools like Cypress and Playwright
These quality gates are integrated into the CI/CD pipeline, providing immediate feedback to developers and preventing problematic code from reaching production.
Flowlet employs several practices to facilitate collaboration among development teams:
- Pull Requests: All code changes are reviewed through pull requests before merging
- Design Documents: Significant features begin with design documents that outline approach and architecture
- API-First Development: APIs are designed and documented before implementation begins
- Feature Flags: New capabilities are developed behind feature flags for controlled rollout
- Documentation as Code: Documentation is maintained alongside code and follows the same review process
These practices ensure that development efforts are coordinated and that knowledge is shared effectively across the organization.
Flowlet's Continuous Integration and Continuous Deployment pipeline automates the process of building, testing, and deploying the platform:
The build process creates deployable artifacts from source code:
- Code Checkout: Retrieval of source code from the Git repository
- Dependency Resolution: Installation of required libraries and packages
- Compilation: Transformation of source code into executable form
- Asset Building: Processing of static assets like CSS and JavaScript
- Package Creation: Bundling of compiled code and assets into deployable packages
- Container Building: Creation of Docker images for microservices
- Artifact Publishing: Storage of build outputs in artifact repositories
This process runs automatically for every code change, ensuring that deployable artifacts are always available for testing and deployment.
The CI/CD pipeline includes multiple testing phases:
- Unit Tests: Verification of individual components in isolation
- Integration Tests: Validation of component interactions
- Security Scans: Identification of vulnerabilities in code and dependencies
- Performance Tests: Measurement of system performance under load
- Compliance Checks: Verification of regulatory compliance requirements
- End-to-End Tests: Validation of complete user journeys
Test results are collected and reported, with failures blocking progression through the pipeline until resolved.
Deployments are fully automated to ensure consistency and reliability:
- Environment Preparation: Configuration of target environment
- Deployment Strategy Selection: Choice of deployment approach (blue-green, canary, etc.)
- Artifact Deployment: Installation of new software versions
- Database Migrations: Application of schema changes
- Service Verification: Confirmation that services are operational
- Rollback Preparation: Configuration of rollback mechanisms in case of issues
The deployment process supports multiple environments (development, staging, production) with appropriate controls for each.
Flowlet employs a structured approach to environment management:
The platform uses several environment types for different purposes:
- Development: Individual environments for feature development
- Integration: Shared environment for testing feature interactions
- Staging: Production-like environment for final validation
- Production: Live environment serving real users
- Sandbox: Isolated environment for partner testing and integration
Each environment type has specific characteristics and access controls appropriate to its purpose.
All environments are defined and managed using Infrastructure as Code (IaC) principles:
- Terraform: Used for provisioning cloud resources
- Kubernetes Manifests: Define the deployment configuration for services
- Helm Charts: Package Kubernetes applications for consistent deployment
- Ansible: Handles configuration management for non-containerized components
This approach ensures that environments are consistent, reproducible, and documented as code.
Flowlet implements a hierarchical configuration system:
- Base Configuration: Default settings applicable to all environments
- Environment-Specific Configuration: Settings that vary by environment
- Secret Configuration: Sensitive values stored in secure vaults
- Runtime Configuration: Settings that can be adjusted without redeployment
This layered approach balances consistency across environments with the flexibility to adapt to specific requirements.
Comprehensive monitoring ensures the health and performance of the Flowlet platform:
The platform collects various metrics to track system health:
- System Metrics: CPU, memory, disk, and network utilization
- Application Metrics: Request rates, response times, error rates
- Business Metrics: Transaction volumes, user activity, conversion rates
- SLA Metrics: Availability, latency, and other service level indicators
These metrics are collected using Prometheus and visualized through Grafana dashboards.
Centralized logging provides visibility into system behavior:
- Application Logs: Service-specific operational logs
- Access Logs: Records of API requests and responses
- Audit Logs: Documentation of security-relevant events
- Change Logs: Records of configuration and deployment changes
Logs are aggregated using the ELK stack (Elasticsearch, Logstash, Kibana) for searching and analysis.
Tracing capabilities track requests as they flow through the system:
- Request Tracing: End-to-end tracking of individual requests
- Dependency Mapping: Visualization of service interactions
- Performance Analysis: Identification of bottlenecks and optimization opportunities
- Error Correlation: Linking of errors across multiple services
Jaeger provides distributed tracing capabilities, integrated with the overall observability stack.
Automated alerting notifies operators of potential issues:
- Threshold Alerts: Notifications when metrics exceed defined thresholds
- Anomaly Detection: Identification of unusual patterns in metrics
- Predictive Alerts: Warnings based on trend analysis
- Composite Alerts: Notifications based on multiple conditions
Alerts are routed through PagerDuty or similar services to ensure timely response to incidents.
Flowlet includes comprehensive disaster recovery capabilities:
Regular backups protect against data loss:
- Database Backups: Regular snapshots of all databases
- Configuration Backups: Preservation of system configuration
- Incremental Backups: Frequent partial backups to minimize data loss
- Offsite Storage: Backup storage in separate geographic locations
Backups are regularly tested through restoration exercises to verify their effectiveness.
The platform architecture ensures continued operation during component failures:
- Service Redundancy: Multiple instances of each service
- Database Replication: Synchronized copies of databases
- Load Balancing: Distribution of traffic across service instances
- Automatic Failover: Seamless transition to backup components
These high availability features minimize disruption from individual component failures.
Documented procedures guide the recovery process:
- Service Recovery: Steps for restoring individual services
- Data Recovery: Processes for data restoration from backups
- Full System Recovery: Procedures for rebuilding the entire platform
- Communication Plans: Templates for stakeholder communication during incidents
Regular disaster recovery drills ensure that these procedures are effective and that teams are prepared to execute them when needed.
Comprehensive testing is essential for maintaining the reliability and security of the Flowlet platform. The testing strategy encompasses multiple levels and approaches to ensure that all aspects of the system function correctly and securely.
Flowlet employs a multi-layered testing approach that covers different aspects of the system:
Unit tests verify the behavior of individual components in isolation, using mocks or stubs to replace dependencies. These tests focus on validating business logic, edge cases, and error handling within specific functions or classes.
Each microservice maintains its own suite of unit tests, typically achieving code coverage of 80% or higher. These tests run automatically on every code change, providing immediate feedback to developers about the correctness of their implementations.
Key technologies used for unit testing include:
- Jest for JavaScript/TypeScript services
- PyTest for Python components
- JUnit for Java services
- Go testing package for Go services
Integration tests validate the interactions between components, ensuring that they work together correctly. These tests focus on API contracts, database interactions, and message passing between services.
The integration testing approach includes:
- Contract Testing: Verifying that service interfaces adhere to their specifications
- API Testing: Validating the behavior of REST and GraphQL endpoints
- Database Testing: Confirming proper data persistence and retrieval
- Message Testing: Ensuring correct handling of events and messages
Integration tests run in isolated environments with containerized dependencies, allowing them to verify actual interactions without affecting production systems.
End-to-end tests validate complete user journeys through the system, simulating real-world usage patterns. These tests interact with the system through its external interfaces, just as users or integrating applications would.
The end-to-end testing suite covers critical flows including:
- Wallet creation and management
- Payment processing across different methods
- Card issuance and transaction handling
- KYC verification workflows
- Reporting and analytics functions
These tests run in staging environments that closely mirror production, using test accounts with banking and payment processor sandboxes.
Performance tests evaluate the system's behavior under various load conditions, identifying bottlenecks and verifying that the platform can handle expected transaction volumes with acceptable response times.
The performance testing regime includes:
- Load Testing: Measuring system performance under expected load
- Stress Testing: Evaluating behavior under extreme conditions
- Endurance Testing: Verifying stability during extended operation
- Scalability Testing: Confirming that performance scales with resources
Performance tests use tools like k6, JMeter, and custom load generation scripts to simulate realistic usage patterns.
Security testing identifies vulnerabilities and verifies that security controls function correctly. This testing combines automated scanning with manual penetration testing to provide comprehensive coverage.
The security testing program includes:
- Static Application Security Testing (SAST): Analyzing code for security issues
- Dynamic Application Security Testing (DAST): Testing running applications for vulnerabilities
- Dependency Scanning: Identifying vulnerabilities in third-party libraries
- Penetration Testing: Simulating attacker techniques to find weaknesses
- Compliance Testing: Verifying adherence to security standards and regulations
Security testing occurs continuously through automated scans and periodically through manual assessments by internal and external security experts.
Flowlet prioritizes test automation to ensure consistent, repeatable validation of the platform:
All tests are integrated into the CI/CD pipeline, with different test types running at appropriate stages:
- Unit and some integration tests run on every commit
- Complete integration test suites run before merging to development branches
- End-to-end tests run before deployment to staging and production
- Performance tests run on a scheduled basis and before major releases
- Security scans run continuously with different frequencies based on test type
This approach ensures that issues are identified early in the development process when they are easiest to fix.
Effective testing requires appropriate test data that reflects real-world scenarios without exposing sensitive information:
- Data Generation: Synthetic data creation for various test scenarios
- Data Masking: Obfuscation of production-like data for testing
- Data Versioning: Management of test data sets for reproducibility
- Environment Reset: Capabilities to restore environments to known states
These practices ensure that tests have the data they need while maintaining security and privacy.
Comprehensive test reporting provides visibility into system quality:
- Test Results Dashboard: Visualization of test outcomes across the platform
- Trend Analysis: Tracking of test metrics over time
- Failure Analysis: Tools for diagnosing and categorizing test failures
- Coverage Reporting: Measurement of code and feature coverage
Test reports are available to all team members and are reviewed regularly as part of the development process.
Flowlet follows industry best practices for financial software testing:
Testing begins early in the development process, with requirements and designs evaluated for testability before implementation starts. This approach identifies issues when they are least expensive to fix.
Testing resources are allocated based on risk assessment, with critical components receiving more intensive testing than lower-risk areas. This approach maximizes the effectiveness of testing efforts.
Controlled experiments introduce failures into the system to verify its resilience. These tests confirm that the platform can handle unexpected conditions gracefully.
Testing occurs throughout the development lifecycle rather than as a separate phase at the end. This approach provides ongoing feedback about system quality.
For critical components, tests are written before implementation code, ensuring that requirements are clearly understood and that code is designed for testability.
These practices ensure that the Flowlet platform maintains the highest standards of quality and reliability, essential characteristics for a financial services platform.
Flowlet's development roadmap outlines the platform's evolution, focusing on expanding capabilities, enhancing existing features, and responding to market trends in embedded finance. This forward-looking plan ensures that Flowlet remains at the forefront of financial technology innovation while continuing to meet the evolving needs of businesses and their customers.
The immediate roadmap focuses on strengthening the foundation of the Flowlet platform:
Enhanced Payment Capabilities The payment infrastructure will be expanded to support additional payment methods and optimize existing flows. Key developments include real-time payments integration across more regions, enhanced recurring payment capabilities with smart retry logic, and improved cross-border payment options with competitive FX rates.
Advanced Fraud Prevention Building on the existing fraud detection system, this phase will introduce more sophisticated machine learning models that adapt to emerging fraud patterns. The enhanced system will incorporate behavioral biometrics, device fingerprinting, and network analysis to identify potentially fraudulent activities with greater accuracy while minimizing false positives that could impact legitimate users.
Developer Experience Improvements The Developer Portal will receive significant enhancements focused on accelerating integration and troubleshooting. New features will include interactive API explorers with live testing capabilities, expanded SDK coverage for additional programming languages, and AI-assisted code generation for common integration patterns.
The next phase will broaden Flowlet's product offerings:
Credit and Lending Infrastructure A new Credit Service will enable businesses to offer lending products through the Flowlet platform. This infrastructure will support various lending models including buy-now-pay-later, revolving credit lines, and term loans. The service will include underwriting APIs, repayment management, and credit reporting integration.
Enhanced Card Issuance The Card Service will be expanded to support additional card types and features, including multi-currency cards, corporate expense cards with advanced controls, and specialized cards for specific verticals like healthcare spending accounts or education financing.
Global Expansion Platform capabilities will be extended to support additional regions, with localized compliance frameworks, payment methods, and banking integrations. This expansion will focus initially on APAC and LATAM markets, complementing the existing coverage in North America and Europe.
This phase focuses on deriving greater value from financial data:
Business Intelligence Platform A comprehensive analytics suite will provide businesses with actionable insights into their financial operations. The platform will include customizable dashboards, advanced reporting capabilities, and predictive analytics to identify trends and opportunities within transaction data.
Personalization Engine New capabilities will enable businesses to deliver personalized financial experiences based on user behavior and preferences. This engine will support targeted offers, customized user journeys, and adaptive interfaces that respond to individual usage patterns.
Open Banking Integration Enhanced connectivity with open banking APIs will enable account aggregation, financial data enrichment, and improved payment experiences. This integration will allow businesses to provide their users with a more comprehensive view of their finances while enabling new use cases like account-to-account payments and financial health monitoring.
The longer-term roadmap focuses on building a broader financial ecosystem:
Marketplace and Partner Network A curated marketplace will connect businesses using Flowlet with complementary service providers, including specialized KYC vendors, alternative data sources for credit decisions, and vertical-specific solution providers. This ecosystem approach will allow businesses to easily extend their financial offerings beyond Flowlet's core capabilities.
Embedded Investment Platform New investment infrastructure will enable businesses to offer savings and investment products to their users. This platform will support various investment vehicles including fractional shares, ETFs, and managed portfolios, with appropriate regulatory frameworks and custody arrangements.
Blockchain and Digital Asset Integration Selective integration with blockchain networks and digital asset platforms will enable businesses to incorporate these emerging technologies into their financial offerings when appropriate. This integration will focus on practical use cases with clear business value, such as stablecoin payments, programmable money, and tokenized assets.
Throughout all roadmap phases, ongoing investment will continue in these critical areas:
Security and Compliance Continuous enhancement of security measures and compliance capabilities to address evolving threats and regulatory requirements. This includes adoption of emerging security technologies, expansion of compliance frameworks to new jurisdictions, and streamlining of compliance processes to reduce operational burden.
Performance and Scalability Ongoing optimization of platform performance and scalability to support growing transaction volumes and user bases. This includes database optimization, caching strategies, and infrastructure improvements to maintain response times and system reliability under increasing load.
Operational Excellence Continuous refinement of operational processes and tools to enhance platform reliability and efficiency. This includes improved observability, automated incident response, and enhanced deployment automation to minimize operational overhead and maximize system uptime.
This roadmap represents Flowlet's current development priorities based on market trends and customer feedback. The specific timing and scope of features may evolve in response to changing market conditions, regulatory requirements, and emerging opportunities in the embedded finance landscape.
Flowlet welcomes contributions from the developer community. This section outlines the process for contributing to the platform, whether you're fixing bugs, adding features, or improving documentation.
When contributing to Flowlet, please follow these guidelines to ensure a smooth collaboration process:
-
Fork the Repository: Create your own fork of the relevant Flowlet repository.
-
Create a Branch: Make your changes in a new branch based on the
developmentbranch:git checkout -b feature/your-feature-name development
-
Follow Coding Standards: Adhere to the established coding standards for the repository:
- Use consistent formatting and naming conventions
- Write comprehensive unit tests for new functionality
- Ensure all existing tests pass
- Add appropriate documentation for new features
-
Commit Guidelines: Write clear, descriptive commit messages following the conventional commits format:
type(scope): description [optional body] [optional footer]Where
typeis one of: feat, fix, docs, style, refactor, perf, test, chore -
Submit a Pull Request: Open a pull request against the
developmentbranch with a clear description of the changes and any relevant issue references. -
Code Review: Participate in the code review process, responding to feedback and making necessary adjustments.
Improvements to documentation are highly valued contributions:
-
Documentation Fixes: For simple documentation fixes, you can edit the file directly on GitHub and submit a pull request.
-
Substantial Documentation: For more substantial documentation changes, follow the same process as code contributions.
-
Documentation Standards: Follow the established documentation style guide, maintaining consistent formatting and tone.
High-quality issue reports help the team understand and address problems efficiently:
-
Search Existing Issues: Before creating a new issue, search to see if it has already been reported.
-
Issue Template: Use the provided issue template to ensure all necessary information is included.
-
Reproduction Steps: Provide clear steps to reproduce the issue, including environment details, expected behavior, and actual behavior.
-
Supporting Materials: Include relevant logs, screenshots, or other materials that help illustrate the issue.
To set up a development environment for contributing to Flowlet:
-
Clone the Repository:
git clone https://github.com/abrar2030/Flowlet cd Flowlet -
Install Dependencies:
npm install
-
Set Up Local Environment:
cp .env.example .env # Edit .env with appropriate values -
Run Development Services:
docker-compose -f docker-compose.dev.yml up -d
-
Start Development Server:
npm run dev
All contributions go through a structured review process:
-
Initial Review: A maintainer will review the contribution for alignment with project goals and quality standards.
-
Technical Review: The code or documentation will be reviewed for technical accuracy and adherence to standards.
-
Automated Checks: CI/CD pipelines will run automated tests and quality checks.
-
Iteration: Based on feedback, you may need to make adjustments to your contribution.
-
Acceptance: Once approved, your contribution will be merged into the appropriate branch.
-
Recognition: All contributors are acknowledged in the project's contributors list.
Flowlet maintains a welcoming and inclusive community:
-
Code of Conduct: All contributors are expected to adhere to the project's code of conduct, which promotes respect, inclusivity, and constructive collaboration.
-
Communication Channels: Engage with the community through official channels including GitHub discussions, the community forum, and scheduled community calls.
-
Mentorship: New contributors can request mentorship from experienced community members to help navigate their first contributions.
By contributing to Flowlet, you help build a more robust, feature-rich platform that serves the needs of businesses implementing embedded finance solutions. We appreciate your interest and look forward to your contributions.
Flowlet is licensed under the MIT License, a permissive open-source license that allows for broad use, modification, and distribution of the software.
Copyright (c) 2025 Flowlet, Inc.
Permission is hereby granted, free of charge, to any person obtaining a copy
of this software and associated documentation files (the "Software"), to deal
in the Software without restriction, including without limitation the rights
to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
copies of the Software, and to permit persons to whom the Software is
furnished to do so, subject to the following conditions:
The above copyright notice and this permission notice shall be included in all
copies or substantial portions of the Software.
THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
SOFTWARE.
Flowlet incorporates various third-party libraries and components, each with its own license. A comprehensive list of these dependencies and their respective licenses is available in the NOTICE file included with the source code.
While the Flowlet platform code is open-source under the MIT License, businesses using Flowlet for commercial purposes should be aware of the following considerations:
-
Banking Relationships: The use of Flowlet may require establishing relationships with banking partners, which typically involve separate commercial agreements.
-
Payment Processors: Integration with payment processors will require separate agreements with those providers.
-
Compliance Requirements: Businesses using Flowlet must independently ensure compliance with relevant financial regulations in their jurisdictions.
-
Support Services: Commercial support, hosting, and managed services for Flowlet are available through separate agreements.
The Flowlet name and logo are trademarks and may not be used without permission in contexts that could imply endorsement or affiliation. Guidelines for acceptable use of Flowlet trademarks are available in the TRADEMARK file included with the source code.
By contributing to the Flowlet project, contributors agree that their contributions will be licensed under the same MIT License that covers the project. This ensures that the entire codebase maintains consistent licensing terms.
-
Generate Your Own API Gateway Developer Portal | AWS Compute Blog https://aws.amazon.com/blogs/compute/generate-your-own-api-gateway-developer-portal/
-
Embedded Finance Architecture and Integration: An In-Depth Guide https://www.itmagination.com/blog/embedded-finance-architecture-and-integration-in-depth-guide
-
Fundamentals of FinTech Architecture: Challenges, and Solutions https://sdk.finance/the-fundamentals-of-fintech-architecture-trends-challenges-and-solutions/
-
Multi-cloud architecture: Three real-world examples from fintech https://www.cockroachlabs.com/blog/fintech-multi-cloud-architecture/
-
Payment tokenisation: What it is and how it works | Stripe https://stripe.com/en-es/resources/more/payment-tokenization-101
-
Part 2: Digital Wallet : The Architecture | by Abhishek Ranjan | Medium https://medium.com/@abhishekranjandev/part-2-payment-gateway-like-razorpay-the-architecture-3f00b62b5d37
-
Regulatory compliance: PSD2, GDPR, KYC/KYB, AML | SDK.finance https://sdk.finance/start-paas/regulatory-compliance/
-
Building your own Ledger Database - by Oskar Dudycz https://www.architecture-weekly.com/p/building-your-own-ledger-database
-
Fintech chatbots: The benefits and uses of AI agents in finance https://www.zendesk.com/blog/fintech-chatbot/
GET /v1/wallets/user/{user_id} # Get all wallets for a specific user
POST /v1/wallets/{id}/freeze # Freeze/suspend a wallet
POST /v1/wallets/{id}/unfreeze # Unfreeze/activate a wallet
POST /v1/wallets/{id}/transfer # Transfer funds between wallets
The Payments API handles the movement of funds and various transaction types:
POST /v1/payments/deposit # Deposit funds into a wallet
POST /v1/payments/withdraw # Withdraw funds from a wallet
POST /v1/payments/bank-transfer # Process bank transfer (ACH, SEPA, Wire)
POST /v1/payments/card-payment # Process card payment
GET /v1/payments/transaction/{id} # Get transaction details
PUT /v1/payments/transaction/{id}/status # Update transaction status
GET /v1/payments/exchange-rate/{from_currency}/{to_currency} # Get exchange rate
POST /v1/payments/currency-conversion # Convert amount between currencies
Flowlet is committed to upholding the highest standards of the financial industry, ensuring robust security, data integrity, compliance, and auditability across all its services. Our Wallet and Payment APIs are meticulously designed and implemented with these principles at their core.
The Wallet API incorporates comprehensive measures to safeguard digital wallets and their associated transactions:
- Enhanced Security: All sensitive wallet data and transaction details are protected through industry-standard encryption protocols, both at rest and in transit. Access is strictly controlled via Role-Based Access Control (RBAC) and secure token-based authentication, with rigorous input validation to prevent vulnerabilities.
- Guaranteed Data Integrity: Financial operations are ACID-compliant, ensuring that all transactions are processed reliably. The system employs double-entry accounting principles for every financial movement, providing an immutable and verifiable audit trail. Monetary values are handled with
Decimaltypes to guarantee precision and prevent inaccuracies. - Regulatory Compliance: The API supports compliance with key financial regulations such as KYC, AML, GDPR, and PSD2. Wallet activities are continuously monitored for suspicious patterns, integrating with fraud detection systems for real-time analysis and alerting.
- Comprehensive Auditability: All wallet-related events are recorded as immutable entries in a detailed audit log, capturing actions, timestamps, and changes. Unique reference IDs are assigned to all transactions for easy traceability and reconciliation.
The Payment API is engineered to handle financial transactions with the utmost security and reliability, meeting stringent industry requirements:
- Secure Transaction Processing: Payments are processed over secure, encrypted channels. Sensitive card details are tokenized, minimizing data exposure and reducing PCI DSS compliance scope. Advanced AI/ML-driven fraud detection mechanisms continuously analyze transaction patterns to identify and prevent fraudulent activities.
- Atomic Data Integrity: All payment operations are atomic, ensuring that transactions are either fully completed or entirely rolled back, preventing partial updates. Double-entry accounting is rigorously applied to all payment transactions, creating balanced and immutable ledger entries. Monetary amounts are exclusively processed using
Decimaldata types for exact precision. - Regulatory Compliance: The API facilitates compliance with AML and CFT regulations through robust data generation for regulatory reporting and real-time sanctions screening against global watchlists. Transaction flows adhere to specific rules of various payment schemes (e.g., ACH, SEPA, SWIFT) to ensure interoperability and compliance.
- Detailed Auditability: Every payment transaction is accompanied by comprehensive, immutable audit trails, recording all critical information and status changes. Unique reference IDs enable seamless tracking and reconciliation across internal and external systems. Precise timestamping of all events provides a clear chronological record for forensic analysis and regulatory audits.
These integrated measures ensure that Flowlet's Wallet and Payment APIs provide a secure, reliable, and fully compliant foundation for embedded finance solutions.
Detailed documentation for user authentication and authorization:
Comprehensive guide to integrating with various banking systems for account and transaction management:
Detailed documentation for the double-entry ledger system and financial reporting:
Documentation for AI-powered features including fraud detection and the support chatbot:
Documentation for API key management, audit logging, data tokenization, and security scanning: