An enterprise crypto payroll and payout operations platform for a financial services group — batch salary disbursement over crypto payment rails with maker-checker approvals, funding reconciliation, refund handling, in-house payslip generation, and 11-currency support, engineered to bank-grade control standards.
A financial services group operating crypto-settled payroll across multiple client companies and currencies needed a system where control was structural, not procedural: approvals that cannot be bypassed, funding that must reconcile before anything moves, failures that resolve without ever paying twice, and a complete record of who did what. This case is published with the client's identity withheld.
Every batch moves through a strict state machine — draft, director approval, funding, disbursement, paid, plus explicit failure and refund branches — with legal transitions enforced in the database. HR drafts and submits, the single active Director approves or rejects, Finance funds and releases payment; each role sees a task queue of exactly its pending work, with dashboard exception counts deep-linking to pre-filtered lists.
Maker-checker separation, single-active-owner constraints, and money arithmetic all live in the database layer as constraints and atomic procedures — integer cents, no floating point, no application-level trust. Every fund-moving action additionally requires a passkey (WebAuthn) step-up from the acting user.
Each batch gets a dedicated deposit reference; confirmation is event-driven with scheduled verification as a backstop, and incoming events are never trusted at face value — balances are independently re-verified before any state changes. Over- and under-funding are detected and routed to structured resolution, including refunds with their own approval gates — every refund and fee movement recorded as balanced journal lines that must sum to zero.
Retries are bounded and guarded against double-spend; executions stranded by crashes are found and resolved by recovery sweeps; anything that exhausts its retries escalates to a manual-intervention queue. A six-dimension reconciliation scan runs daily and reports drift before it becomes a discrepancy.
Built on a modern TypeScript stack with a Postgres core — 177 database migrations, ~100 serverless functions, atomic integer-cents money logic in database procedures, row-level security, scheduled reconciliation and recovery jobs, and hardened authentication (email one-time codes on every login, mandatory passkey enrollment, passkey step-up on every fund action) — delivered through a multi-gate review process covering spec, code, contracts, and security.
If your operations move money — or anything else you can't afford to get wrong — tell us how it works today. Undertide will assess fit and recommend the right scope.
