What security controls matter in a system that handles payments or funds?
A normal business application should manage orders, its business ledger, and orchestration of payment instructions; actual collection, payment, allocation, and settlement should use a bank or lawfully licensed payment provider. Do not create an unlicensed pooled-money arrangement. Engineering controls include server-side pricing, signature and certificate verification, idempotency, append-only ledger entries, three-way reconciliation among channel, business ledger, and bank settlement, and separation of refund and withdrawal duties.
A success page is not proof of settlement, and one database “balance” field is not a ledger. Distinguish business order, provider transaction, bank settlement, refund, fee, and internal accounting state.
When translating compliance duties into evidence and controls, also compare How can we protect an idea or confidential requirement shared with a developer? and How can a software project provide credible security assurance?; the linked guidance adds context that should be considered in the same decision.
| Path | Money handled by | Decision |
|---|---|---|
| Merchant directly connected to bank/licensed provider | Provider settles to merchant account | Default for ordinary self-operated commerce |
| Provider marketplace/allocation product | Licensed product applies its merchant and split rules | Use for platforms only within official onboarding and settlement design |
| Self-built wallet or collected funds manually paid onward | Business company controls pooled money | Do not implement without specialist regulatory confirmation |
China's Regulations on Supervision and Administration of Non-bank Payment Institutions require approval to establish such an institution and prohibit unapproved or disguised payment business. Calling a flow “technical service” does not change its substance.
The server recalculates payable amount from product, contract, discount, and tax. Create unique business-order and payment-attempt identifiers; several attempts may exist, but only one valid success can settle the order. Verify asynchronous notification signature, certificate, timestamp, merchant, order, amount, currency, and event ID. A unique key and transactional idempotency must make 100 repeated callbacks post once. Browser redirects are for experience; server notification or verified query determines final state.
Refund, reversal, chargeback, and close are separate states. Validate original transaction, available refundable amount, and cumulative refunds. Require two-person approval for material or anomalous refunds. Provider acceptance is not completed receipt, so poll and reconcile. Retry with limits and backoff, then route to human review rather than repeat money movement indefinitely.
Derive balances from append-only entries that record account, direction, amount, currency, business type, source order, actor, and time. Correct with reversal or adjustment rather than overwriting history. Use integer minor units or appropriate fixed decimal types. Reconcile daily: business orders to internal payment ledger, internal ledger to provider statement, and provider settlement to bank receipt. Classify overage, shortage, duplicate, status, fee, and date differences. The target is zero unexplained monetary variance, not necessarily identical raw transaction counts.
Store keys and certificates in managed secrets, separate test and production, restrict service identity and egress, rotate before expiry, and use MFA. Support can inspect an order but not edit its ledger; refund initiation and approval are separated; developers lack default production access and cannot issue direct fund SQL.
Wavesteam can implement orders, ledgers, payment APIs, access, reconciliation, and monitoring, but does not replace a bank or licensed institution. Platforms, stored value, withdrawals, cross-border, or material funds require the client, provider, and qualified adviser to confirm the business model first. PCI DSS documents and OWASP ASVS support card-data and application controls; neither replaces licensing or financial reconciliation.