Fintech Software Development Company
Payments, wallets, ledgers and reconciliation systems engineered correctly.
What Building With Orixa Looks Like
In systems we build for retailers, connectivity drops are normal, not exceptional — so payments must survive them by design. Our engineering documentation on offline-first POS sync describes the queue-and-sync pattern we use: transactions captured locally with pending states, replayed against server-side idempotency keys after reconnection, and reconciled against the ledger in a nightly job so no sale is lost or double-charged.
Payment Gateway Integrations
bKash checkout, Nagad API integration, and card payments via SSLCOMMERZ — implemented against sandbox first, with token management, signed webhooks, idempotency keys, refunds and voids, and production certification handled end-to-end.
Digital Wallets
Customer wallets with add-money, spend, transfer, and cash-out flows; balance snapshots, transaction histories, per-device session security, and limits enforced server-side for regulatory and fraud control.
Ledger & Reconciliation Systems
A double-entry ledger as the single source of truth: every payment, fee, refund, and adjustment posts balanced entries. Automated jobs match gateway settlements against internal records nightly and route mismatches to an exception queue.
Lending & Credit Systems
Loan origination, amortization schedules, EMI calculation, late-payment penalties, restructuring, and collections tracking — with a credit ledger that survives audits and configurable rules for rate caps.
KYC/Compliance Workflows
NID verification steps, document capture, approval queues, audit trails, and risk flags — structured so compliance evidence is exportable when regulators or partners ask questions.
Real-Time Financial Dashboards
Live views of float, settlement status, success rates by channel, failure reasons, and liquidity positions — so operations spots a stuck payout in minutes instead of at month-end.
Fraud Prevention Basics
Velocity limits, device fingerprinting, duplicate-detection on amounts and counterparties, manual review queues, and full audit logging — pragmatic controls sized for your transaction volume.
Offline-Tolerant Payment Flows
Queue-and-sync architecture for weak connectivity common across Bangladesh: transactions are captured locally with pending states, synced safely when the network returns, and reconciled automatically — no lost or double-charged payments.
Payment Integration Approaches
| Capability | Manual Process | Gateway-Only Build | Orixa-Built System |
|---|---|---|---|
| bKash/Nagad | Personal QR codes, manual cash-out | Single widget, no raw API control | Direct bKash/Nagad APIs with verified callbacks |
| Cards | Not accepted, or keyed in by hand | Checkout form only | SSLCOMMERZ integration with 3DS and refund flows |
| Reconciliation | Spreadsheet matching at month-end | Gateway exports joined manually | Automated ledger matching with exception queue |
| Offline support | Paper receipts | Fails without internet | Queue-and-sync flows for weak connectivity |
| Settlement reporting | Manual totals per merchant | Basic payout statement | Per-merchant settlement with fee breakdown and exports |
Source: Orixa engineering documentation (/engineering/offline-first-pos-sync) — last reviewed August 2026.
Reference Payment & Reconciliation Flow
POS terminals / mobile channels
| (offline queue-and-sync)
v
Payment queue ---- idempotency keys
|
v
Gateway adapters -- bKash | Nagad | cards (SSLCOMMERZ)
|
v
Double-entry ledger (balanced entries only)
|
v
Nightly reconciliation job --> exception queue
|
v
Settlement + merchant reportsSource: Orixa engineering documentation (/engineering/offline-first-pos-sync) — last reviewed August 2026.
Security Without Client-Data Exposure
Fintech work demands a higher standard of confidentiality, and our process reflects that. We develop against sandbox credentials only — production keys are never shared with us unless you explicitly rotate them post-launch. Test data is synthetic or masked; real customer records never sit on developer machines, in repositories, or in third-party AI tools.
Access follows least privilege under NDA, secrets live in encrypted vaults rather than code, every change lands through reviewed pull requests with an audit trail, and we build in the OWASP-aligned practices — input validation, encrypted transport, session hardening, dependency scanning — that financial systems require. You get the engineering discipline of a regulated environment without handing over your data.
Frequently Asked Questions
How do you integrate bKash and Nagad APIs?
We start in the provider sandbox: app registration, token issuance and refresh handling, then the payment lifecycle — create, execute, query status, refund, and void — each call wrapped with idempotency keys so network retries cannot charge twice. Callbacks and webhooks are signature-verified before any state change is trusted. After sandbox sign-off we support your production certification with the provider, run a staged rollout (internal transactions, then a percentage of live traffic), and wire every settled transaction into your reconciliation ledger from day one.
How do you prevent double-charging when networks fail mid-payment?
Every transaction carries a unique idempotency key generated server-side before the gateway is touched. If a response is lost, the payment enters a pending state — never a failed one — and a background job polls the gateway status endpoint using that same key until the true outcome is known. Offline clients queue locally and replay against the same key after reconnection, so replays resolve to the original transaction instead of creating a new charge. A nightly reconciliation pass compares gateway settlements against the ledger and surfaces any orphaned charges into an exception queue with automatic refund triggers.
Can you build lending logic — interest, schedules, and penalties?
Yes. We implement configurable amortization schedules (flat or declining balance), EMI generation, grace periods, late-payment penalty rules, early-settlement calculations, and restructuring flows. Every accrual posts to a double-entry credit ledger rather than being overwritten in place, so historical statements can be regenerated exactly as they appeared on any past date. Rate caps, fee limits, and disclosure requirements are configuration values — not hardcoded constants — so policy changes ship without code deploys, and every calculation path is covered by automated tests against known-good schedules.
How do you handle client data confidentiality during development?
We work under NDA with least-privilege access scoped to named engineers. Development runs entirely on sandbox credentials and synthetic or masked datasets — production databases are never copied to laptops, staging environments hold no live customer records, and secrets are stored in encrypted vaults, not committed to git. Code never leaves approved review tooling, and we do not paste client business logic or data into third-party services. If your compliance framework requires specific attestations, access logs, or data-handling agreements, we work to those terms from the first sprint.
Ready to Build Your Fintech Product?
Book a free consultation. We will review your payment flows and architecture — under NDA.
Book Free Consultation