Architecture

High-level view

Investors ─► Broker-Frontend ───┐
Operators ─► Broker Admin ──────┴─► Broker-Backend ─┬─► Agora brktrdapi (gRPC)
                                                    ├─► Custodian / CSD API (HTTP, IPO settlement)
                                                    ├─► NotificationService (email / SMS)
                                                    └─► VeroAuth, MetaKyc

Operators ─► Exchange-AdminPanel ─► Exchange-Backend ─► CSD-Backend
                                     (via csdIntegrationService)

Operators ─► CSD-AdminPanel ──────► CSD-Backend

Tenant server ─► VeroCompliance API ─► session token ─► VeroComplianceSDK (browser)
VeroCompliance ─► tenant webhooks

Domains and ownership

The platform follows strict domain ownership. Each domain has its own backend, database and admin panel, and must not take over another domain’s responsibilities.

• Broker owns the investor journey: onboarding, KYC orchestration, payments (pay-in / pay-out), portfolios, IPO subscriptions and the broker order flow.
• Exchange owns order books, order matching, market data, FIX sessions, fees and trade operations. It does not own custody, registers, bank money, minting or investor KYC.
• CSD owns participant admission, securities reference data, accounts, settlement, the register of holdings, treasury, corporate actions and on-chain evidence. It does not own order books, matching, broker OMS or investor onboarding.
• VeroCompliance is an isolated black box. Other systems are just tenants of it.

Broker

• Broker-Frontend is the investor-facing Next.js app. It calls the Broker API and the Vero gateway.
• Broker-Backend/Backend is a .NET 9 ASP.NET Core API using Clean Architecture (Api → Application / Infrastructure → Domain).
  • PostgreSQL via EF Core; every entity is soft-deleted.
  • Async work uses the outbox pattern with Hangfire jobs (for example PaymentOutbox and the IPO settlement outbox).
  • Entity changes are audited to ClickHouse.
  • External calls: Agora brktrdapi over gRPC, the custodian (CSD) HTTP API for IPO settlement, NotificationService, VeroAuth and MetaKyc.
• Broker-Backend/Admin is the Next.js back-office for the Broker API.
• Broker-Backend/documents holds the step-by-step investor journey design. Design documents lead the code: new outboxes, workers or consumers need a step document first.

Exchange and CSD

Both backends are Go monorepos with the same shape:

• One Go module in src/, one directory per microservice (src/<service>/cmd/server), with internal/{domain,repository,service,handler,router} layers.
• Shared code in src/common/: config, the { "data" } / { "error" } response envelope, pagination, correlation and idempotency headers, JWT and messaging.
• Each service has its own PostgreSQL schema.
• Services talk synchronously over HTTP/REST with service JWTs, and asynchronously through RabbitMQ topic exchanges for events and sagas. There is no gRPC.
• OpenAPI specs and SQL schemas in each repo (docs/ for CSD, instruction/ for Exchange) are the source of truth.

The Exchange reaches the CSD only through its csdIntegrationService, using its own service credentials.

The Exchange and CSD admin panels are Next.js apps built from the same scaffold. Each backend service has its own route group, API client and generated TypeScript types.

Shared services

VeroCompliance

A .NET 10 modular monolith with two deployables: the API and a Hangfire Worker (risk recalculation, webhook delivery). There is also a Next.js cockpit.

• Multi-tenant: shared database with a TenantId on every row.
• Two integration surfaces only:
  1. Inbound: a server exchanges an API key and secret for a short-lived SDK session token.
  2. Outbound: tenant webhooks.
• The VeroComplianceSDK React package runs the KYC flow in the browser using that session token. The SDK API contract is frozen.

NotificationService

A Laravel 11 (PHP 8.3) API that sends email and SMS on behalf of registered products (POST /notify/{product}, POST /notify-sms/{product}). It includes a Nova admin, Horizon queues and a MySQL database. It is served at notify.tokenise.io.

Infrastructure and deployment

• Tokenise-Infrastructure is OpenTofu for Azure. modules/ holds reusable modules, and live/<env>/ has one root per environment, each with its own state and subscription.
• VeroCompliance and the Broker apps run on Azure Container Apps. Runtime configuration and secret references for them are owned by the infrastructure repo.
• NotificationService runs on Azure App Service, provisioned by Bicep in its own repo.
• The Exchange and CSD backends include an AWS (ECR / EKS) deployment path under deploy/, and each has a docker-compose.yml for running the full stack locally.
• CI/CD runs on Azure Pipelines (azure-pipelines.yml in each repo).