Workflow & processing

How your business runs day-to-day. Order handling, approvals, customer escalations, and exception workflows — structured, auditable, and faster than the process you run today.

Intelligent automation

The machine-learned edge. Churn prediction, fraud detection, personalized triggers, retention playbooks — running on your data automatically, so your team can focus on growth.

Payments orchestration

We don't process payments — we orchestrate them. Your PCI-certified PSPs do the regulated work; we sit in front, route dynamically, retry on failure, and reconcile every provider against one internal ledger — so you convert more, charge back less, and always know where the money is.

Always-on reliability

The one part most businesses underestimate. 24/7 operations, proactive monitoring, and an engineering team on call — so incidents are caught and resolved before your customers notice them.

Operational visibility

Total visibility across the operation. Business health, customer behavior, revenue flows, and platform status — all in one place, for your team and ours.

Consumer platforms at scale

High-volume consumer businesses where payments, retention, and support have to work perfectly, every day. The most battle-tested environment we run — every piece of the stack is already live in production.

Fintech and payment businesses

Identity, screening, multi-provider routing, reconciliation, and fraud tooling — the operational infrastructure behind payments, financial services, and transaction-heavy platforms.

SaaS, marketplaces and digital products

Subscription logic, marketplace mechanics, user lifecycle, retention, analytics — the operational core of any digital business that lives or dies on execution.

Predictable enterprise licensing

A steady, transparent licence fee that scales with the platform footprint, not your transaction volume. You get budget certainty; we get the freedom to invest in the technology rather than chasing usage metrics.

Selective by design

We work with enterprise-grade operators only. No low-ticket, high-churn clients dividing our attention. The result is a small, focused client base — and a platform team that goes deep on each engagement.

Tech-quality first

Our incentive isn't to upsell modules or drive consumption — it's to keep delivering the best infrastructure our partners can run on. Long-term licences mean we win when the platform stays the best in its category.

An append-only ledger in front of every PSP.

Routing across multiple payment providers is the easy part. Reconciling what each of them did into one trusted view of financial state is the part that quietly costs operators engineers and credibility.

We don't move money — the regulated PSPs do — but every event they emit lands in one internal reconciliation ledger on our side. Each authorisation, capture, refund, settlement and fee row arrives as a typed double-entry against one canonical transaction ID, no matter which provider produced it. Idempotency keys propagate from edge to database, so retries are safe at every hop. Provider statements reconcile against our ledger via scheduled CDC jobs — not the other way round — so unmatched lines surface as alerts within minutes and disputes have a defensible, replayable answer.

Why our session layer isn't a vendor.

Buying a hosted auth platform looks like an easy win until you need every session event in your own data plane in real time, with no extra hop to an external API on the critical path.

We own the session boundary. Short-lived signed access tokens are issued at the edge with rotating kids; an opaque server-side session reference is the actual unit of trust, so revocation is instant across the fleet. Device and behavioural signal flow into an in-process feature store, so risk decisions run inline with the request rather than via a vendor round-trip. Third parties (document review, sanctions, behavioural scoring) sit off the hot path, called asynchronously and reconciled back through the same event log everything else feeds.

An event log as the system of record.

Most "real-time" pipelines are batches with shorter intervals. We treat events as the system of record. Every other table — operational, warehouse, dashboards — is a derivation of it.

Producers write to one append-only event log. Stream processors derive the operational views (customer state, balances, session tables, fraud features); analytical views land in the warehouse via the same log, not a parallel ETL. Schemas are versioned and validated at write time; forward-compatible evolution is enforced in CI through a contract test against every registered consumer, so no producer ships a breaking change without it being a typed error in someone else's build. "Where did this number come from?" always has exactly one answer.

Carrying the pager without burning the team.

The reason most teams can't sustain round-the-clock operations is structural, not cultural. The on-call rotation is downstream of the system design. Fix the design and the rotation stops eating senior engineers.

Every alert is bound by ID to a runbook entry in version control; every runbook step is either automated or annotated with the reason it isn't. The on-call engineer's job is to confirm the automation made the right call, not to remember what to do at 3 a.m. Pages that fire more than twice without action become a backlog item, not a habit. The people who wrote the code carry the pager for it — no separate ops team, no outsourced NOC. If something pages you tonight, you own the fix tomorrow.

One adapter interface in front of every third party.

External vendors — verification, screening, communications, fraud signal — each come with their own format, cadence, and definition of "done". Wire them straight into the product surface and you end up rewriting flows every time a contract changes.

A thin normalisation layer sits between the product and the vendor estate. Every external check implements the same adapter interface and resolves to a typed status (pending, passed, failed, needs_review). A circuit breaker per vendor with hedged requests handles flakiness without escalating to the user. New vendors are shadow-evaluated against live traffic for weeks before any percentage is routed to them. Compliance gets one audit trail, legal gets one place to express jurisdiction rules, and commercial renegotiations stop being existential.

The reconciliation tax most stacks pay forever.

Every "best-of-breed tool" added to the stack carries a quiet headcount cost whose only job is to make the numbers line up between systems. Nobody hires for it on day one. By year three it's one of the larger line items in operations — split across data, finance, and platform engineering so no single budget owner ever sees the whole bill.

A unified backbone collapses the tax because there's nothing to reconcile in the first place. The same canonical event drives the customer record, the ledger, the warehouse row, and the operator dashboard. CRM, billing, product DB and BI are derivations of one log, not independent systems that have to be argued into agreement at month end. Engineering hours that used to be spent making systems agree get spent on the product instead — and that recovered capacity is the single largest hidden return we see when we replace a partner's legacy stack.

Cardholder data, out of scope by design.

We do not store, process, or transmit primary account numbers in our platform. Cardholder data is handled exclusively by PCI-DSS Level 1 certified payment partners through tokenised flows — our systems only ever see vendor tokens and the last-four metadata required to reconcile a transaction. The PCI obligation sits where the regulator wants it: with the certified processor.

Data protection under Cyprus & EU law.

CRAE GROUP LTD is established in Cyprus (HE 391918) and operates as a data processor under enterprise DPAs with every partner. A DPO is appointed and reachable directly at privacy@craegroup.com. Subject access, deletion, portability, and breach notification procedures are all documented and SLA-bound in the partner agreement.

Engineered to carry your certification, not ours.

The platform's controls — access management, change control, monitoring, supplier risk, incident response — are designed against the same control sets these frameworks require. Certification itself is a question for the operating company, not the technology backbone. When a partner pursues their own attestation, we contribute the technical evidence and spearhead the application work alongside their compliance team.

Detailed disclosures, behind the partnership line.

Architecture diagrams, control evidence, sub-processor lists, the DPA, BCP/DR summaries and the full product library are made available once a partnership is on contract. This is an IP-protection measure, not a transparency one — the controls themselves are summarised here in full.

EU residency

Primary region in Frankfurt (eu-central). Operational headquarters in Limassol (CY). Backups replicated within the EU. No personal data leaves the EU at rest or in processing — including support, analytics, and observability tooling.

Encryption in transit

TLS 1.3 enforced on all external endpoints. Strict cipher policy, HSTS preloaded. Internal service-to-service traffic uses mutual TLS with short-lived certificates issued by an internal CA, rotated automatically.

Encryption at rest

AES-256 at the volume layer for every datastore. Application-layer envelope encryption for sensitive fields (KYC documents, payment metadata, agent notes). Keys managed in a dedicated KMS with hardware-backed roots, rotation and access logged.

Least-privilege by default

SSO with hardware-key MFA mandatory for all employees. Production access is just-in-time, time-boxed, and reviewed against a documented business reason. All privileged actions are logged to an append-only audit store separate from production. Quarterly access reviews against the principle of least privilege.

Every change is reviewed and traceable

All code goes through peer review and CI before merge. Infrastructure is described as code; nothing reaches production by hand. Every deployment is reversible within minutes via the same pipeline that shipped it. Schema changes are gated by automated migration tests against production-shaped data.

24/7 detection & response

Continuous monitoring of authentication, privileged actions, network egress, and anomalous data access. On-call engineers paged on signal, not noise. Median acknowledgement under four minutes, around the clock. Engineering, not a separate SOC, owns the response — the people who built it are the people who fix it.

Patch fast, test honestly

Dependency scanning on every build, SCA gating in CI, and an internal SLA on CVE remediation: critical within 24 hours, high within 7 days. Annual third-party penetration test against the production platform; remediation tracked publicly to our partners. Coordinated disclosure programme open to researchers.

Hosting & compute

Tier-1 EU cloud provider (Frankfurt, eu-central-1 region). ISO 27001, SOC 2 Type II, C5 attested. EU data residency contractually guaranteed.

Payment providers

PCI-DSS certified PSPs handle authorisation, capture, settlement and payouts — we provide the gateway and orchestration layer in front. The provider set is chosen per partner to match regional regulatory coverage and operating model; routing is dynamic across risk, cost, and availability; the mix is disclosed in the partner DPA.

KYC & sanctions screening

Vetted document verification and sanctions providers, abstracted behind a single internal endpoint (see Insights #05). Vendor list disclosed in the DPA.

Email & SMS delivery

Transactional delivery via EU-hosted providers. Marketing communications routed only after explicit opt-in captured at source.

Logs, metrics & tracing

Self-hosted within the EU region. No customer PII shipped to third-party observability vendors — at all. Operational telemetry only.

Internal tooling

EU-residency configurations enforced on every collaboration tool. Customer data is not stored in productivity tools; only metadata required for operating the partnership.

Signal first, page second

Continuous monitoring paged engineers in under four minutes (median) across the last 12 months. Suspected security events trigger a dedicated playbook separate from operational incidents — different responders, different containment first.

Partners notified inside 24h

Confirmed security incidents that affect a partner are communicated within 24 hours of confirmation — direct from engineering, not via a PR channel. GDPR Article 33 notification handled by the DPO within 72 hours as required.

Public post-mortem

Every P1 results in a blameless written post-mortem shared with affected partners: timeline, contributing factors, remediation, and the action items we own to prevent recurrence. We track those action items publicly to our partners until they close.