Building the foundation for trustworthy payments infrastructure
Payments across African markets involve different providers, rails, settlement processes and financial workflows. Heiish is building a payments orchestration platform that brings those connections together through one API, spanning collection, payouts, a double-entry ledger, settlement reconciliation, disputes and financial operations. Morphlix operates the Amazon Web Services (AWS) environment behind it under a managed-service arrangement, strengthening the cloud foundation, adding security and governance controls, and preparing the platform for its next step: verified production payment operations.
- Fintech
- Payments
- Cloud Governance
- Security
- Infrastructure as Code
- AWS
- Timeline
- 12–14 October 2026
- Team
- 3 specialists (frontend engineer, UI/motion designer, cloud engineer)
- Industry
- Fintech & Payments
- Engagement
- Managed cloud operations and governance
Results
12
governance controls in place
Up from two on the cloud plane, one of whose notifications reached nobody, to 12 controls, nine of them on the cloud plane.
17 of 21
AWS Config rules compliant
A configuration baseline across 12 resource types. The four rules not yet compliant at the audit snapshot form a concrete remediation backlog.
3
hidden issues surfaced
Once AWS Config was on, it found missing VPC flow logs, a bucket without a TLS-only policy, and an unmanaged default VPC with six public subnets and an internet gateway, none of which the initial audit had caught.
The Opportunity
Payments should be complex behind the scenes, not for every business that integrates them
A business connecting to several payment providers faces a fragmented landscape: different integration requirements, response formats, settlement processes and failure behaviour. Beyond accepting a payment, it needs to know whether a transaction succeeded, tell a genuine decline from an uncertain provider response, reconcile settlements, manage payouts and keep accurate financial records.
Heiish is being built to absorb that complexity in one API with a consistent operational model. For that model to be trustworthy, the platform needs more than working code: controlled access, a dependable audit trail, security monitoring, accurate financial records and clear operating procedures. Morphlix's role is to strengthen that foundation while the product moves through development towards production.
The Product
One integration. A connected payments workflow.
Heiish is designed around the idea that collecting a payment is only one part of the financial journey.
Connect to payment providers
A provider-adapter architecture gives supported providers, including Paystack and Flutterwave, a consistent integration layer, with routing and failover behind a common API. It distinguishes an explicit decline from an inconclusive response such as a timeout: treating an uncertain result as a decline can create risk when a payment is retried.
A reliable financial record
A double-entry ledger whose entries are append-only, enforced by database controls and restricted privileges. Corrections are recorded as compensating journal entries rather than rewriting history, so balances can be traced to their entries.
Settlement and reconciliation
Settlement reconciliation, dispute handling and chargeback operations are part of the intended scope. Production reconciliation hasn't been measured yet, and the automated end-of-day process still needs operational work.
Safer payouts
Maker-checker controls mean the person who creates a payout batch can't approve it. MFA and an additional payout verification factor are implemented and tested in the codebase, with deployment waiting on the operator enrolment experience. Recipient sanctions and politically exposed person screening are still to be built, and must be in place before payouts go into production.
Sensitive data protected by design
Card data stays with the payment providers and isn't stored by the platform. Bank account numbers are protected at rest, and API responses show only the last four digits. Amounts are held in integer minor units, with provider-specific conversions at the integration boundaries.
The challenge
A payments platform needs a foundation that can be trusted
The initial AWS governance review found gaps in the environment behind Heiish.
Limited audit visibility
There was no CloudTrail trail, so no record of account activity to investigate who changed a resource or when.
Alarms that reached nobody
Four CloudWatch alarms published to an Amazon SNS topic with no subscribers, so alerts had no route to anyone who could respond.
No configuration baseline
AWS Config wasn't enabled, leaving resource configurations and drift unevaluated.
Gaps in threat detection
GuardDuty and Security Hub were off, VPC flow logging was absent, and the public API had no AWS WAF protection.
Broad administrative access
An IAM user held administrator access through a long-lived credential without MFA, and the same credential ran production deployments.
Limited cost attribution
Resources carried basic naming tags but not the tagging needed for consistent attribution and cost analysis.
A payments platform needs to investigate changes, spot security concerns, route alerts to people and know what it is running. That made governance a practical priority.
The solution
From hand-managed infrastructure to governed cloud operations
Morphlix carried out a governance and security remediation between 12 and 14 October 2026.
A clear record of activity
AWS CloudTrail runs as a multi-Region trail with log-file validation and CloudWatch integration, giving a basis for investigating infrastructure changes.
Configuration oversight
AWS Config records supported resource types and evaluates 21 rules across 12 resource types, so configuration problems surface for investigation instead of relying on manual inspection.
Findings with a response path
GuardDuty and Security Hub are on, with GuardDuty findings routed through EventBridge and SNS to a person. CloudTrail metric-filter alarms cover root usage, IAM changes, trail changes, bursts of denied API calls and console sign-ins without MFA. The path was tested against a monitored address.
Protection at the edge
AWS WAF sits on the Application Load Balancer, with rate-based rules including on authentication endpoints. AWS managed rule groups run in count mode while false positives are tuned, a deliberate staging rather than full blocking. VPC flow logs are on.
Reviewed infrastructure changes
Terraform defines the infrastructure. GitHub Actions produces saved plans and applies the reviewed plan through a deployment-environment gate. Required-reviewer enforcement and least privilege for the deployment role are still on the remediation plan.
Operational documentation
Documented architecture, data classification, tagging standards, a risk register, runbooks, responsibilities and account lifecycle procedures. The resilience documentation separates defined recovery objectives from procedures not yet tested.
Cloud governance isn't a list of enabled services: it needs clear ownership, documented decisions and a process for exceptions.
Architecture
A cloud foundation for a payments platform
The architecture separates application, data and operations, with a governance layer for audit logging, configuration monitoring, threat detection and alerting.
Application
A Go API on Amazon ECS with AWS Fargate on ARM64, in non-root, distroless containers, behind an Application Load Balancer using TLS 1.3.
Data and services
Amazon RDS for PostgreSQL in an isolated subnet, with Amazon ElastiCache for Redis, Amazon DynamoDB, AWS Lambda, Amazon SQS, Amazon SNS, Amazon EventBridge, Amazon S3, Amazon SES, AWS Secrets Manager and AWS KMS.
Web properties
Three static web properties run on CloudFront and S3. The marketing site's apex domain is served by Vercel, outside the audited AWS estate.
Resilience today
The environment is live and its health endpoint responds, but it isn't yet a fully resilient payments platform: one Fargate task runs against a single-AZ database, a database restore hasn't been tested, recovery objectives haven't been demonstrated, and backups stay in one account and Region.
Technology stack
AWS services, managed as code
Application
- Go
- Amazon ECS on AWS Fargate (ARM64)
- Application Load Balancer
- Amazon ECR
- AWS Lambda
Data and messaging
- Amazon RDS for PostgreSQL
- Amazon ElastiCache for Redis
- Amazon DynamoDB
- Amazon S3
- Amazon SQS
- Amazon SNS
- Amazon EventBridge
- Amazon SES
Security and governance
- AWS CloudTrail
- AWS Config
- Amazon GuardDuty
- AWS Security Hub
- AWS WAF
- AWS Secrets Manager
- AWS KMS
Operations and delivery
- Amazon CloudWatch
- Amazon CloudFront
- Terraform
- GitHub Actions
Outcome
Governance progress, backed by evidence
These are measured infrastructure and governance results from the October 2026 audit. They are not claims about payment authorisation rates, production availability, settlement performance, cost savings or customer growth.
Where Heiish Stands
A live technical foundation, with production payment validation still ahead
Heiish's AWS infrastructure is deployed and its health endpoint responds. The application has a provider-oriented payment architecture, ledger protections, payout approval logic and a strong automated test suite.
The platform hasn't yet processed a production payment, refund or payout, so there is no basis yet for claims about transaction success rates, throughput, settlement turnaround or production reliability.
Important work remains open: the wallet domain isn't implemented, virtual accounts and escrow aren't built, checkout has outstanding critical requirements, and five console sections don't yet have backing APIs. Recipient sanctions and politically exposed person screening is unimplemented, and the payout second factor waits on the operator enrolment experience. This is the work between a deployed payments platform and one ready to process live financial activity safely.
What's Next
Turning a governed platform into a production-ready payments service
Complete the security remediation
Tighten the deployment role's permissions, restrict who can reach the deployment path, rotate outstanding secrets and strengthen preventive controls at the AWS Organizations level.
Validate recovery
Run a database restore exercise, record the actual recovery time and verify it against the documented recovery objectives.
Complete payout safeguards
Implement recipient screening and finish the operator enrolment experience needed to deploy MFA and the payout second factor.
Validate the financial workflows
Resolve the missing event publisher and scheduling dependencies, then run end-of-day reconciliation with real test or authorised production-like data before publishing any turnaround figure.
Controlled transaction validation
Once the controls and product requirements are in place, establish a controlled path to the first verified payment, refund and payout, capturing provider outcomes, failure modes, idempotency behaviour and reconciliation results.
Measure operational outcomes
Build a sustained evidence base: configuration compliance, findings and remediation time, alert acknowledgement, recovery performance and, in time, payment authorisation and reconciliation metrics.
The Bigger Picture
Trust is built into the infrastructure, not added at the end
Heiish is building a simpler way for businesses in African markets to integrate payment providers. Morphlix's role is to operate and strengthen the cloud environment behind that work: governance controls, security visibility and a disciplined approach to infrastructure change. The next milestone is to show that the payment workflows, operational safeguards and recovery procedures work together under realistic conditions.
The ambition is a simpler way to connect to payments. The work now is to make the infrastructure behind that promise ready for production.
More from the library.
All case studiesAI · Productivity
Seshira: AI-native project management
An engineering assistant on Amazon Bedrock AgentCore that plans sprints, turns PRDs into tasks and flags blockers, with about 80% less planning effort.
Education
Karatux: AI-native school operating system
One multi-tenant platform for K–12 school groups, with an AI teaching assistant on Amazon Bedrock AgentCore that cut lesson-prep time by about 60%.
Work with the studio
Ready to future-proof
your infrastructure?
Tell us what you are building and where the current stack is holding you back. We will come back with an architecture and a plan.