FurlPay Documentation & Architecture Blueprints

The Sovereign Digital Dollar Payment & Card Infrastructure

Enterprise-grade technical documentation, AWS cloud migration roadmaps, dedicated Agave v2.x Solana RPC specifications, Circle CCTP v2 cross-chain rails, Rain JIT card issuing blueprints, and comprehensive security audits.

---

System Architecture Overview

Figure 1: FurlPay Production Architecture — Multi-AZ Private VPC, Dedicated Solana RPC Nodes, ECS Fargate Next.js 15 Backend, Hardware-Isolated Nitro Enclaves, and Institutional Clearing Rails.

flowchart TD
    subgraph Clients["Client Applications & Edge Devices"]
        Android["Android Native Mobile App<br/>React Native / AndroidKeyStore / BiometricPrompt"]
        WearOS["Wear OS Companion App<br/>Jetpack Compose / Wearable Data Layer"]
        iOS["iOS Native Mobile App & SDK<br/>Swift / Secure Enclave / PassKit"]
    end

    subgraph Ingress["AWS Global Ingress & Protection"]
        CloudFront["AWS CloudFront Global CDN<br/>Edge TLS 1.3 Termination"]
        WAF["AWS WAF v2<br/>DDoS Shield, Bot Control, Rate Limiting"]
    end

    subgraph PrivateVPC["AWS Private Multi-AZ VPC (10.100.0.0/16)"]
        ALB["Application Load Balancer (ALB)<br/>Dual-Stack Multi-AZ Ingress"]
        
        subgraph ComputeCluster["Application Cluster (Amazon ECS Fargate)"]
            ECS["Next.js 15 App Router Backend Cluster<br/>- Gasless Relayers (EIP-3009)<br/>- Solana Actions & Blinks<br/>- Rain JIT Card Authorization Webhooks"]
        end

        subgraph DataTier["State, Caching & Relational Storage"]
            Valkey[("Amazon ElastiCache for Valkey<br/>Atomic Nonce Claims (kvSetNx)<br/>Rain JIT In-Memory Balance Locks")]
            Aurora[("Amazon Aurora PostgreSQL Serverless v2<br/>Double-Entry Ledger & Idempotency Storage<br/>Multi-AZ AWS KMS CMK Encryption")]
        end

        subgraph KeyIsolation["Hardware-Isolated Cryptography"]
            Enclave["AWS Nitro Enclaves (Isolated vsock)<br/>KMS Attestation Key Decryption<br/>Relayer & Circle CCTP Mint Signing"]
        end

        subgraph BlockchainTier["Dedicated Blockchain Node Subnet"]
            SolanaNode["Dedicated Solana RPC Node (EC2 i4i.8xlarge)<br/>Agave v2.2 Validator Engine<br/>3.75TB NVMe RAID-0 + 180GB tmpfs AccountsDB<br/>Yellowstone Dragon's Mouth gRPC Geyser"]
        end
    end

    subgraph Rails["Institutional Settlement & Card Networks"]
        Circle["Circle USDC & CCTP v2<br/>TokenMessengerMinterV2 & MessageTransmitterV2<br/>Circle Iris Attestation & Fast Transfers<br/>Circle Mint Fedwire / ACH Clearing"]
        Rain["Rain Card Rails<br/>Visa / Mastercard Principal Member<br/>Sub-110ms Just-in-Time Funding"]
    end

    Android --> CloudFront
    WearOS --> Android
    iOS --> CloudFront
    CloudFront --> WAF
    WAF --> ALB
    ALB --> ECS
    ECS --> Valkey
    ECS --> Aurora
    ECS --> Enclave
    ECS --> SolanaNode
    ECS --> Circle
    ECS --> Rain
    SolanaNode -.->|gRPC Slot Stream| ECS

Loading

Figure 2: End-to-End Stablecoin Payment Rails, Hardware Key Signing, and Sub-110ms Rain JIT Card Authorization Pipeline.

---

Master Documentation Index

0. Deployment & Environments (deploy/)

Operational runbooks for shipping each surface, and the environment contract they all share. Start here if you are moving the platform onto AWS.

• Environments — development, staging, production
  What an environment is in this codebase: the FURLPAY_ENV financial-mode switch, the Vercel-injected variables that stop existing on AWS (including the one that silently breaks passkeys), the five scheduled jobs, and the managed-service decisions the migration forces.

• AWS Security Baseline
  The controls that gate a go-live: multi-account topology with SCP boundaries, IAM Identity Center with no IAM users, Secrets Manager, KMS and Nitro Enclave key custody, detection, supply chain, and a go-live checklist.

• Web — Vercel → AWS
  ECS Fargate behind CloudFront for 314 API routes and 219 pages; why not Amplify, Lambda or App Runner; EventBridge for the crons; the cutover and rollback plan.

• Android Release Runbook · Play Store Signing
  EAS builds, keystore custody, and the Play App Signing step.

• iOS Release Runbook
  Currently blocked on an Apple Developer account. Covers the SDK floor, the watchOS and widget targets, and what App Store review asks a financial app.

• Wear OS Release Runbook
  Why the watch app shares the phone's applicationId, same-key signing, and the fingerprint registration that passkeys depend on.

---

1. Engineering Blog & Technical Articles (blog/)

• Scaling Stablecoin Payments to Millions: Why We Migrated FurlPay from Shared RPCs to Dedicated AWS Infrastructure
  In-depth architectural post analyzing $1.79T in monthly stablecoin volume, Visa/Allium real-economy data, Singapore's clearing hub, sub-3ms dedicated Agave Solana RPC nodes on EC2 i4i.8xlarge, sub-110ms Rain JIT card webhook processing, Circle CCTP v2 cross-chain burn-and-mint, and 51.2% FinOps cost reduction.

---

2. AWS Cloud & Dedicated Infrastructure Blueprints (aws/)

• Cross-Platform USDC Payment Engine & AWS Architecture (2026–2027)
  End-to-end USDC payment flow across Android Native (native-app), Wear OS (guardian), iOS (furlpay-swift), and AWS dedicated infrastructure. Details hardware Keystore/Secure Enclave signing, EIP-3009 gasless transfers, Solana v0 transactions, sub-110ms Rain JIT card authorizations, Circle CCTP v2 burn-and-mint, and AWS Nitro Enclaves.
• 1-Year Master Infrastructure & AWS Migration Blueprint (2026–2027)
  Complete 12-month engineering roadmap moving FurlPay from Vercel edge functions and managed RPC providers (Helius/QuickNode) to a private Multi-AZ VPC on Amazon Web Services (AWS).
• AWS Infrastructure Cost Optimization & FinOps Reduction Report
  FinOps engineering analysis slashing annual AWS infrastructure expenditures from $44,040/year down to $21,480/year (51.2% reduction) by eliminating io2 Block Express IOPS charges in favor of local Nitro NVMe SSDs (i4i.8xlarge), adopting ElastiCache for Valkey, and optimizing standby RPC failover.
• Zero-Cash AWS Blueprint & Production Solana Node Specification
  Running 100% free on AWS via capital stacking ($25,000–$100,000 AWS Activate credits + Solana Foundation grants). Contains official Agave v2.2 validator arguments, Linux sysctl tuning (21-agave-validator.conf), dual NVMe RAID-0 storage scripts, tmpfs AccountsDB setup, Yellowstone Dragon's Mouth gRPC configuration, and automated slot health monitoring.
• AWS Enterprise Security, Compliance & Infrastructure Blueprint (2026–2027)
  Advanced defense-in-depth architecture covering AWS Organizations multi-account governance, KMS envelope encryption with Nitro Enclave PCR attestation, production Terraform IaC modules (VPC, ECS Fargate, WAF v2), PCI-DSS v4.0 Level 1 / SOC 2 Type II compliance controls, multi-region disaster recovery runbooks, and SRE alerting matrices.

---

3. Security Audits & Vulnerability Assessments (audit/)

• Master Monorepo Security Audit Report
  Exhaustive code audit across Solana Anchor programs, Next.js API routes, Android/Wear OS native applications, and client SDKs. Uncovers and remediates critical vulnerabilities including the Solana escrow token drain in auto_release.rs, merchant wallet fallback to 1111...1111, WooCommerce/Magento HMAC bypass, Swift timing side-channel leaks, and Android SQLite encryption.
• Mobile Security Audit & Hardening Guide
  Analysis of Android and iOS cryptographic boundaries, reverse engineering protections, anti-hooking checks, and biometric authentication gates.
• x402 Micropayment Attack Vectors & Mitigation
  Facilitator-layer hardening for HTTP 402 AI agent payment rails, closing cross-resource substitution (F1) and duplicate settlement race conditions (F2).
• Transaction Security Standards
  Formal verification of transaction signing, nonce isolation, and replay defense mechanisms.

---

4. Mobile, Wearable & Client Protocols (docs/)

• Self-Custodial Wallet Architecture
  BIP-39, SLIP-0010 (Solana Ed25519), and BIP-44 (EVM Secp256k1) key generation, memory zeroization, and multi-account derivation.
• Android Native Release & Signing Runbook
  Google Play Console signing keys, APK optimization, and ProGuard/R8 obfuscation rules.
• Google Play Store Signing Runbook
  Step-by-step key registration, upload keystores, and app integrity verification.
• Certificate Pinning & Rotation Runbook
  Zero-downtime HPKP / mTLS certificate rotation for mobile network security configs.
• Hardware Wallet Research & Integration
  Tangem, Ledger, and NFC hardware-token signing integrations for high-net-worth accounts.

---

5. Protocols, Settlement & Custody Models (docs/)

• Production Go-Live Money Runbook
  Financial operation guidelines, liquidity provisioning, and treasury hot/warm/cold balance thresholds.
• Ledger Reconciliation & Invariant Checks
  Continuous double-entry verification between off-chain balances and on-chain token states.
• Balance Custody Mapping
  Taxonomy of self-custody vs. custodial escrow accounts across multi-chain rails.
• Custody Disclosure & Regulatory Disclaimers
  Compliant disclosure language for retail and institutional stablecoin holders.
• API v1 Surface Specification
  Public REST & WebSocket interface contracts for merchant integrations.
• Verified Protocol Claims
  Benchmarked performance figures: sub-500ms settlement, 58,000+ edge requests, 0% error rate.

---

6. Expansion Blueprints & Strategy (reports/)

• Singapore Expansion Master Blueprint
  MAS Major Payment Institution (MPI) compliance roadmap, SGQR / PayNow integration, and Southeast Asian cross-border settlement.
• USDC Travel Market & Tourism Rails
  Stablecoin travel spend analysis, merchant discount rate (MDR) disruption, and hotel direct-settlement protocols.
• USDC Travel Architecture & Security Blueprint
  Offline travel vouchers, MCC-locked virtual cards, and airline ticketing integration.
• Algorithmic Settlement & Competitive Disruption
  Comparative analysis against Stripe, RedotPay, and traditional acquiring networks.
• Partner Onboarding Master Report
  Technical guidelines for payment service providers (PSPs), independent sales organizations (ISOs), and payment gateways.

---

Technology Stack Breakdown

Layer	Technologies & Protocols
Cloud & Infrastructure	Amazon Web Services (AWS): EC2 i4i.8xlarge, ECS Fargate, CloudFront, ALB, Aurora PostgreSQL Serverless v2, ElastiCache for Valkey, AWS Nitro Enclaves, AWS KMS, Amazon SNS, CloudWatch, Terraform.
Dedicated Blockchain Node	Agave v2.2.x (Solana Validator Engine), Yellowstone Dragon's Mouth gRPC Geyser, Ubuntu 24.04 LTS, Nitro NVMe RAID-0, Linux tmpfs AccountsDB.
Cross-Chain & Stablecoins	Circle USDC, Circle CCTP v2 (MessageTransmitterV2, TokenMessengerMinterV2), Circle Iris Attestation API, Circle Mint API, Circle Programmable Wallets, Circle Arc.
Card Issuing Rails	Rain Cards (Visa/Mastercard Principal Member), Sub-110ms Just-in-Time (JIT) Funding Webhooks, ISO 8583 Authorization Bridge.
Backend Application	Next.js 15 (App Router), Node.js 22, TypeScript 5.5, Zod, Viem, @solana/web3.js, EIP-3009 Gasless Relay Engine, EIP-712 Typed Signing.
Mobile Applications	React Native / Expo (Android & iOS), Kotlin 2.1 (Android & Wear OS Compose), Swift 6.0 (iOS / Apple Watch), Google Play Integrity API, AndroidKeyStore, Apple Secure Enclave.
Security & Cryptography	Hardware-backed Biometric Authentication (Class 3 / Strong), Ed25519, Secp256k1, AES-256-GCM, Constant-Time HMAC-SHA256, Zeroization.

---

Community & Support

• GitHub Organization: github.com/FurlPay
• Developer Documentation: github.com/FurlPay/docs
• Security Inquiries: security@furlpay.com

---

_{Copyright © 2026 FurlPay Inc. All rights reserved. Sovereign financial rails for the next billion users.}