Architecture

​

System Overview

​

Components

​

API Gateway

• TLS termination
• Authentication (API key validation)
• Rate limiting
• Request routing to internal services

​

Payment Gateway Service

• Translates Orchestra’s unified API to provider-specific formats
• Routes transactions to the specified Payment Gateway Account
• Handles provider responses and normalizes them
• Manages transaction state (authorization, capture, void, refund)

​

Payment Gateway Accounts Service

• Stores encrypted credentials
• Validates account configuration
• Handles credential rotation

​

Tokenization Service

• Encrypts and stores card details
• Issues tokens for stored cards
• Retrieves card data for transactions (never exposed to your systems)

​

Data Flow: Charge Transaction

​

Security

​

Data at Rest

• All sensitive data (credentials, card numbers) encrypted with AES-256
• Encryption keys managed via HSM (Hardware Security Module)
• Database access restricted to service accounts

​

Data in Transit

• All API traffic over TLS 1.2+
• Provider communications over their required secure protocols
• No sensitive data in URLs or logs

​

PCI Compliance

​

Reliability

​

Availability

• Multi-region deployment
• Automatic failover between availability zones
• 99.9% uptime SLA

​

Failover

{
  "operation": "CHARGE",
  "paymentGatewayAccountId": "stripe-primary",
  "fallbackUpgs": [
    { "paymentGatewayAccountId": "adyen-backup" },
    { "paymentGatewayAccountId": "worldpay-fallback" }
  ],
  "amount": 99.99,
  "currencyCode": "USD"
}

async function chargeWithFailover(amount, currency, cardToken) {
  const providers = ['stripe-primary', 'adyen-backup'];

  for (const provider of providers) {
    try {
      const result = await charge(amount, currency, provider, cardToken);
      if (result.success) return result;
    } catch (error) {
      console.log(`${provider} failed, trying next`);
    }
  }

  throw new Error('All providers failed');
}

​

Latency

​

Related Guides