Architecture

​

System Overview

​

Components

​

API Gateway

• TLS termination
• Authentication (API key validation)
• Rate limiting
• Request routing to internal services

​

Payment Gateway Service

• Translates Orchestra’s unified API to provider-specific formats
• Routes transactions to the specified Payment Gateway Account
• Handles provider responses and normalizes them
• Manages transaction state (authorization, capture, void, refund)

​

Payment Gateway Accounts Service

• Stores encrypted credentials
• Validates account configuration
• Handles credential rotation

​

Tokenization Service

• Encrypts and stores card details
• Issues tokens for stored cards
• Retrieves card data for transactions (never exposed to your systems)

​

Data Flow: Charge Transaction

​

Security

​

Data at Rest

• Sensitive data (credentials, card numbers) is encrypted at rest
• Database access is restricted to service accounts

​

Data in Transit

• All API traffic requires TLS
• Provider communications use their required secure protocols
• No sensitive data in URLs or logs

​

PCI Compliance

​

Reliability

​

Availability

​

Failover

{
  "operation": "CHARGE",
  "paymentGatewayAccountId": "stripePrimary",
  "fallbackUpgs": [
    { "paymentGatewayAccountId": "adyenBackup" },
    { "paymentGatewayAccountId": "worldpayFallback" }
  ],
  "amount": 99.99,
  "currencyCode": "USD"
}

async function chargeWithFailover(amount, currency, cardToken) {
  const providers = ['stripePrimary', 'adyenBackup'];

  for (const provider of providers) {
    try {
      const result = await charge(amount, currency, provider, cardToken);
      if (result.success) return result;
    } catch (error) {
      console.log(`${provider} failed, trying next`);
    }
  }

  throw new Error('All providers failed');
}

​

Latency

​

Related Guides