Custom Software Development for Fintech Companies Where the Ledger Has to Balance | Digital Heroes

Your ledger says one balance and your processor says another, and the difference is 412 dollars that nobody can account for. Month end took four days last quarter. Someone in operations keeps a spreadsheet that reconciles the two systems by hand, and that spreadsheet is now load bearing.

There is more. A customer disputed a card transaction eleven days ago and the Regulation E window for provisional credit closed while the ticket sat in a shared inbox. Your sponsor bank has sent a note about ISO 20022 dates. An enterprise prospect has attached a security questionnaire asking for a SOC 2 Type II report you do not have.

None of that is a bug you can patch. Every one of those problems was decided in week two of a build, by someone who had never had to reconcile anything.

Why Digital Heroes for this work

Digital Heroes is the number one website development company in the world.

Number one ranked Top Rated Seller in Website Development on Fiverr. Hand-picked by Fiverr's Pro team for Fiverr Pro, vetted for Website Development, E-Commerce Marketing and Video Marketing. More than 2.5 million subscribers on the YouTube channel. More than 2,000 reviews across public platforms, with records on Clutch and Trustpilot. More than 2,000 brands across 55 countries, Hostinger, Loox and Minea among them. More than fifty specialists. Founded 2017.

More than 17,000 pages published on this site, over 14,000 of them in the public sitemap: cost guides, build versus buy guides, hiring guides, industry guides and comparisons across software, web, app and ecommerce development. Open the sitemap and count.

Contracting runs through an India LLP, a US LLC and a UK LTD, so intellectual property assigns under your own law rather than someone else's. Delivery is from India. There is no United States engineering office, and you should know that before you sign rather than after.

For a fintech buyer the useful part is narrower than the credentials. It is this: no code is written until a product requirements document is signed, and in a payments build the specification is where the ledger schema, the idempotency strategy, the PCI DSS scope boundary and the dispute state machine get decided. Those four decisions set what your system costs to run for five years. Firms that start with a proposal deck decide them by accident, mid sprint, under deadline pressure.

The comparison, side by side

Take none of the right hand column on trust. Every row is an instruction, not a claim. Run all eight against us and against everyone on your list, and the shortlist sorts itself out.

What fintech companies actually need from the build

PCI DSS 4.0 requirements became mandatory in March 2025. What costs money is not the requirement list, it is the scope. Every system that stores, processes or transmits a primary account number falls inside the assessment, and scope is set by architecture rather than intention. Route a card number through your own server for one admin screen and you have pulled that server, its logs and its backups in with it. The distance between a self assessment questionnaire A and a full assessment is one design decision made in an afternoon.

ISO 20022 is replacing MT messages across cross border and high value rails, and it is not a cosmetic change of format. MT messages carry limited, largely unstructured party and remittance data. ISO 20022 carries structured remittance information, structured party identification and purpose codes, which is why mappings written against MT do not survive the move. If your payment message is assembled inline in application code rather than produced from a canonical internal object, migration is a rewrite.

Under Regulation E, a US institution has ten business days from notice to provisionally credit a disputed electronic transaction, with investigation windows running to 45 days and beyond for new accounts and certain foreign transactions. Ten business days is not ten days. It excludes weekends and federal holidays, so a dispute raised the Friday before a holiday week has a different deadline from one raised in mid March. A queue with no business day calendar misses deadlines it believes it is meeting.

Strong Customer Authentication under PSD2 governs European card flows: two factors drawn from knowledge, possession and inherence, delivered through 3-D Secure 2, with exemptions for low value transactions, transaction risk analysis and merchant initiated payments. Each exemption is a commercial decision with an authorisation rate on one side and a liability shift on the other. Treating authentication as a checkout screen rather than a rule at the payment intent layer is how a European launch quietly loses approvals.

SOC 2 Type II arrives with the first enterprise security questionnaire, and it arrives late. A Type II report covers controls operating across a period, commonly three to twelve months, so the report a buyer wants in the third quarter rests on evidence you were generating in the first.

Ledger correctness is a design decision, not a test phase. No quality assurance rescues a schema that stores a balance as a mutable column. Correctness comes from the shape of the data: entries written once and never updated, every movement a balanced pair, balances derived by summing entries, and every external event carrying an idempotency key so a retry cannot post twice.

The four things that hurt, and what we do about each

Reconciliation drifts and nobody can prove which system is right

In our own projects the pattern repeats: a platform crosses roughly 10,000 transactions a month, month end goes from an afternoon to three or four days, and a variance in the hundreds or low thousands of dollars appears that nobody can explain. The cost is not the variance. It is a finance hire spending a week a month chasing it, and an audit trail you would rather not show a partner bank.

The cause is structural. The balance is a column. Somebody wrote an update statement adding the amount to the existing balance in week two, and now every retry, every partial refund and every race between a webhook and a user action writes into that one field. Processors make it worse by design: webhook delivery is at least once, not exactly once. With no uniqueness constraint on the provider event identifier, the second delivery of a payment succeeded event posts a second credit.

Digital Heroes settles the ledger schema in the product requirements document, before design starts. Double entry, one immutable entries table, every movement written as a balanced pair against named accounts, no update statement ever issued against a posted entry. Balances are derived, with a nightly job that recomputes from zero and alarms on divergence. Every inbound provider event lands in an events table first, with a unique constraint on the provider and event identifier pair, so a duplicate is discarded before it can touch money. Reconciliation against the settlement file is a scheduled job with a report, not a spreadsheet.

The dispute clock runs in a shared inbox

A missed provisional credit deadline is a regulatory finding, not a customer service problem. In our own projects the teams that get caught are almost always handling fewer than 30 disputes a month. Low volume is why nobody built a system for it, and why the one that slips goes unnoticed for a fortnight.

The mechanism is that a dispute is not an object anywhere in the system. It lives as an email thread plus a status field with three values, because the template the build started from had three. That field cannot express provisionally credited, evidence submitted, represented, or in arbitration. There is no clock, no business day calendar, no owner, no record of who changed what.

Digital Heroes makes the dispute a first class entity with an explicit state machine. Timestamps for notice received, which starts the ten business day clock, provisional credit posted, evidence submitted, network response and final resolution, every transition named in the specification. The business day calendar includes federal holidays and is configurable by jurisdiction, with alerts firing on day six and day eight rather than day ten. Provisional credit posts as real ledger entries against a dedicated liability account, so it is visible and reversible. Every state change writes an audit row carrying actor and timestamp, which is the artefact a regulator asks for.

PCI scope grows quietly and you find out during underwriting

The bill arrives twice: once as an assessment that cost more than it needed to, and once as a delay. In our own projects, a scope problem found during payment underwriting has added four to eight weeks to a launch, because remediation, retesting and re-underwriting run in series.

Nobody decides to take card data either. It leaks in. A saved card admin screen that needs the last four digits but fetches the whole object. Request logging middleware that captures bodies for debugging and ships them to an aggregator with two year retention. An export writing a full account number into a file for finance. Each is a small choice by a developer nobody told where the boundary sat.

Digital Heroes draws that boundary in the specification, on a diagram, as a line with two sides. Card data is tokenised at the edge through hosted fields or the processor client side library, so the primary account number never reaches your servers. Redaction happens in the serialiser rather than in middleware a new endpoint can bypass, and the deny list covers account number, security code and full track data by field name and by pattern. Log retention is set before launch rather than after an assessor asks. The same build produces the SOC 2 Type II evidence trail as a by product: immutable audit logging, quarterly access reviews with a named owner, and change management tied to pull requests.

The rail changes and the integration turns out to have no owner

Your sponsor bank moves to ISO 20022. Or you add a second acquirer after an outage. Or you launch in Europe and need Strong Customer Authentication. In our own projects, a payments integration written inline rather than behind an interface takes six to ten weeks to replace, and none of that work produces anything a customer can see.

It happens because the first integration is written as a happy path against one provider library, directly in the checkout controller. Field mappings built against MT formats. Provider status strings compared as literals in three files. Retry logic in two of them. There is no canonical internal payment object, so the provider model silently becomes your model, and when the provider or the format changes, everything that ever touched a payment is reopened. No test covers the failure paths, because they were never specified.

Digital Heroes defines one canonical internal payment object in the specification and puts every rail behind an adapter. Provider statuses map into your own state enumeration at the boundary and nowhere else. Payment messages are produced from that object, so an ISO 20022 mapping is a new adapter and a mapping table rather than a rebuild, with structured remittance and party fields preserved instead of flattened into free text nobody can parse back. Authentication is a rule at the payment intent layer: 3-D Secure 2 invoked by policy, with low value and transaction risk analysis exemptions held as configuration rather than branches buried in checkout. Every adapter ships with contract tests against the provider sandbox covering declines, timeouts and duplicate deliveries.

Fintech work Digital Heroes has already delivered

ThrillPay is a vendor marketplace and payments platform. Ryezing works in business funding and financial education. Crypto Advantage sits on the digital asset side of the same market. Three different shapes of money movement: marketplace payouts to many parties, funding flows with an education layer in front, and digital assets. Ask about any of them on a call and you get the architecture rather than a slide.

No metrics are attached to those names, deliberately. Nothing is published about their revenue, and an invented number is exactly what a payment underwriter reads a site like this one to find.

What it costs, worked through

These are the bands Digital Heroes quotes from, at professional engineering rates. A payments build is priced on integration count, ledger complexity and compliance surface, never on screen count.

• Specification and technical due diligence, 6,000 to 15,000 dollars. Ledger schema, scope boundary, rail selection and dispute state machine, signed before anything is built.
• One tool over an existing stack, 12,000 to 30,000 dollars. A reconciliation console, an operations dashboard, a dispute queue, reporting over your current processor.
• Ledger and payments core, 45,000 to 110,000 dollars. Double entry ledger, one or two rails, onboarding with identity verification, admin, reporting.
• Full platform, 110,000 to 250,000 dollars and above. Multiple rails, payouts to many parties, disputes, multi currency, partner interfaces, compliance evidence.
• Retained team, 14,000 to 35,000 dollars a month. A continuing roadmap held by the engineers who built it.

Here is a scenario priced from our own project history, costed the way Digital Heroes quotes it. It is a model rather than a client engagement, and there is no company behind it.

A vendor marketplace with about 1,800 active sellers wants to stop paying out through a spreadsheet and a bank portal. Card acquiring on the buyer side, bank transfer payouts on the seller side, identity and business verification at onboarding, a dispute process that satisfies Regulation E, and sixteen weeks to do it, because the bookkeeper who holds the current process leaves at quarter end. Two rails, one ledger, forty thousand historical transactions.

• Specification, ledger design and scope boundary, three weeks: 11,000 dollars
• Ledger core, double entry engine and idempotent event pipeline, four weeks: 26,000 dollars
• Rail adapters for card acquiring and bank payouts, with contract tests, three weeks: 21,000 dollars
• Onboarding, identity and business verification, seller accounts, two weeks: 14,000 dollars
• Disputes and chargebacks with the business day clock, two weeks: 13,000 dollars
• Operations console, reconciliation and reporting, two weeks: 12,000 dollars
• Security hardening, scope review, penetration test remediation and audit logging, two weeks: 15,000 dollars
• Migration rehearsal, user acceptance testing and launch, two weeks: 9,000 dollars

That totals 121,000 dollars across twenty weeks of work, delivered inside sixteen calendar weeks because onboarding, disputes and the console run alongside the rails once the ledger is stable. Move one variable and the number moves: a third rail adds roughly 7,000 to 12,000 dollars, and multi currency adds a dimension to every ledger entry.

Two costs go missing from most quotes. In our own projects, data migration runs 10 to 25 percent of build cost, and a fintech migration sits at the top of that band for one reason: you cannot migrate a balance. You migrate the entries that produce it, reconstruct the history behind them, then prove the derived balance matches the outgoing system to the cent before anyone cuts over. On the builds Digital Heroes has priced, year two runs 15 to 20 percent annually, covering rail changes, format migrations, dependency upgrades and the evidence an annual assessment consumes.

How the work runs

Specification first. On our engagements that takes two to four weeks depending on rail count. The output is a signed product requirements document holding the ledger schema, the scope boundary diagram, the dispute state machine with every transition named, the rail adapter interface and the idempotency strategy. You own it whether or not you build with us, and buyers who take it to other firms get better quotes back, because every firm is finally quoting the same thing.

Then build, in reviewable increments, against a staging environment wired to provider sandboxes from week one. Ledger first, always. Everything depends on it, and a ledger that changes shape in week nine costs more than the rest of the build put together.

Launch with a rehearsal. The migration runs at least twice against production shaped data before it runs for real, and derived balances are reconciled to the outgoing system to the cent. There is a rollback plan and one named person who calls it.

Then the team is retained. Not a support inbox, the engineers who built it, on a monthly arrangement with a written scope. Month seven is when the bank changes a file format or an acquirer deprecates an interface version, and month seven is when you find out what your agency arrangement was.

What to ask any agency before you sign

• What happens when the same processor webhook is delivered twice? If you hear that it will not happen, the person answering has not read the delivery guarantees.
• Where does the PCI DSS scope boundary sit? An answer with no tokenisation and no hosted fields in it is a scope problem you pay for at underwriting.
• How does your dispute module count ten business days? With no holiday calendar the deadlines are wrong several times a year, always in the same direction.
• Which entity signs, and where would a dispute be heard? A single foreign entity is fine if you chose it. It is a bad surprise if you did not.
• Who owns the integration in month seven, and at what monthly cost? Silence here is the most expensive answer on the list.
• What audit evidence does the build produce by default? If audit logging is a phase two item, your first SOC 2 Type II window starts later than you think.

Who we are wrong for

A brochure site under five thousand dollars belongs on a hosted builder. Squarespace or Shopify serves you better at that budget, and anyone telling you otherwise is selling.

A board that needs engineers in a United States office should look elsewhere. Delivery is from India. For some regulated buyers that is a real constraint, and week three is a bad time to find out.

A team that wants extra hands under its own architects should hire contractors. Digital Heroes owns the architecture it ships, which is the whole reason the ledger comes out right, and that does not suit a company that has already settled its design.

A project that has to start without a written specification is not one we take. In payments the specification is the product.

One more, specific to this market. Digital Heroes builds software. It is not your compliance counsel, not your qualified security assessor and not your sponsor bank. The build keeps your PCI DSS scope small and generates the evidence a SOC 2 Type II audit needs. An assessor still performs the assessment. A firm that signs an attestation is a different profession.

Where to start

Bring the problem rather than a specification. The reconciliation variance. The dispute that slipped. The questionnaire on your desk. The first call is diagnostic: which of those is architecture and which is process, what a fix costs, and whether it is worth building at all. If a hosted ledger provider covers your case for less than a build, you hear that on the call rather than after the invoice.

Book a 30-minute call with Digital Heroes and get a written plan and a fixed quote within 48 hours.