Fintech · Payments · BNPL
ZazPay
Software, Infrastructure & Security Architect
Architecture of a mission-critical fintech platform across its whole lifecycle: design, development, infrastructure, security, deployment, monitoring and operation.
Senior DevSecOps & Payment Infrastructure Architect
Engineering the infrastructure behind financial technology.
I'm Elihu Camacho. Architecting secure, scalable and resilient financial systems, payment infrastructures and distributed platforms — from the architecture decision to the manifest that deploys it and the dashboard that watches it.
system.topologylive · abstract
- SaaS products
- MiAgendaPro · MiCatalogoPro · SmartMetering
- Payments
- ZazPay · multi-PSP orchestration
- Banking
- STP · SPEI · core banking
- Platform
- GKE · GitOps · AI agents
01/About
I design systems where correctness is not optional.
I'm a software, infrastructure and security architect. Most of my work happens where software meets money — payment flows, lending platforms, bank integrations and the infrastructure that keeps them running.
I work end-to-end. I don't stop at the edge of a discipline: I follow a decision from the architecture diagram to the service that implements it, the manifest that deploys it, the secret it depends on and the dashboard that tells us when it's wrong.
In fintech an error is not a bug report, it's someone's money. So I design for idempotency, traceability and reconciliation first, and for speed second. Security is part of the design, not an audit at the end — and reliability is a feature the business can sell.
Through Binarka Tech I also build and run my own SaaS products — MiAgendaPro, MiCatalogoPro and SmartMetering. Owning a product end to end keeps me close to the other half of engineering: pricing, onboarding, support, and deciding what not to build.
Currently
SaaS products & software studio
Binarka Tech
Founder & Solutions Architect
Builds and operates its own SaaS products — MiAgendaPro, MiCatalogoPro and SmartMetering — and Binarka Code Factory, an AI software factory, from architecture to production.
How I work
- 01Decisions written down with their evidence and trade-offs
- 02From discovery and regulation to the production runbook
- 03Ownership end-to-end — no blind spots between layers
02/Products
SaaS I build and run in production.
Products I designed, built and operate end to end — architecture, billing, mobile apps and support. Live in production.
- Livemiagendapro.com
MiAgendaPro
SaaS · appointment management
Multi-tenant SaaS for service businesses — salons, barbershops, clinics and spas — to run appointments, clients, services and staff, with Stripe subscriptions, a web app, an admin panel and a mobile app.
NestJS · Prisma · PostgreSQL · BullMQ · Socket.IO · Stripe · React · Expo · Firebase
- Livemicatalogopro.com
MiCatalogoPro
SaaS · digital catalogs & quotes
A digital catalog for manufacturers and workshops — ironworks, furniture makers, carpenters, jewelers — that turns one shareable link into a product gallery, WhatsApp conversations and quote requests.
Next.js · React · WhatsApp · Multi-tenant SaaS
- Livesmartmetering.mx
SmartMetering
SaaS · energy & utility metering
Metering platform for condominiums: meter readings, consumption per unit, allocation of the CFE electricity bill and individual receipts — plus analytics that flag water and gas leaks and underperforming solar panels.
NestJS · Prisma · PostgreSQL · React · Expo · Python · FastAPI · pandas · pvlib · Puppeteer
03/Now
What I'm building right now.
Current projects and interests, kept in one content file and updated as they move.
- Designing
Nucleus Pay
Not finished yet: designing the multi-tenant payment orchestration platform — provider abstraction, routing engine and a PCI-scoped vault.
Read the case study - Building
Centinela
Turning attack-surface and exposure data into structured, risk-ranked audit reports.
Read the case study - Building
Binarka Code Factory
Agent-driven software delivery with isolated sandboxes, quality gates and independent review — evidence over demos.
Read the case study - Learning
Rust for payment infrastructure
Learning Rust with the latency-critical parts of payment routing and vaulting in mind.
- Researching
Offensive security labs
Hands-on labs to sharpen how I design defenses — and how I explain risk in audit reports.
04/Expertise
Eight domains, one system.
The value isn't in any single technology — it's in knowing how payments, ledgers, infrastructure and security constrain each other, and designing for all of them at once.
01
Payment Infrastructure
Money movement that survives retries, timeouts and partial failure.
Multi-PSP integration, payment intents, card tokenization, recurring charges and automated collections — designed so every charge is idempotent, traceable and recoverable.
- Payment orchestration
- Tokenization
- Recurring billing
- Retries & recovery
Stripe · Openpay · Conekta · Kushki · Toku
02
Fintech Architecture
Lending and BNPL platforms where the ledger is the product.
Repayment systems, debt synchronization and core-banking integration with explicit consistency boundaries, audit trails and reconciliation built in from day one.
- BNPL & lending
- Core banking
- SPEI transfers
- H2H bank integration
Mambu · STP · SPEI · OAuth 2.0
03
Distributed Systems
Services that agree on what happened, even when the network does not.
Event-driven microservices with transactional outbox, idempotent consumers, poison-message handling, DLQs and graceful shutdown — so work is never silently lost.
- Event-driven design
- Outbox pattern
- Idempotency
- Hexagonal / DDD
Kafka · BullMQ · gRPC · Redis
04
Cloud & DevSecOps
Infrastructure that is declared, reviewed and reproducible.
GitOps delivery on GKE with Kustomize overlays and ArgoCD, secrets as code, automated image promotion and security gates inside the pipeline instead of after it.
- GitOps
- Infrastructure as Code
- Environment isolation
- Private networking
GCP · GKE · Cloud Run · ArgoCD · Terraform · GitLab CI
05
Cybersecurity
Security as an architectural property, not a final checklist.
Identity, least-privilege access, secret rotation, API security and controls aligned with PCI DSS and ISO 27001 — plus hands-on auditing of attack surface and exposure.
- AppSec & API security
- IAM & RBAC
- Secrets management
- Security auditing
Keycloak · OIDC / JWT · Vault · Secret Manager · SonarQube
06
Backend Engineering
Contracts first, frameworks second.
TypeScript and NestJS services with decoupled domain layers and shared internal abstractions that standardize messaging, data access and observability across services.
- NestJS microservices
- REST & gRPC APIs
- Shared SDKs
- Testcontainers
TypeScript · Node.js · NestJS · Prisma · Java · Spring
07
Database Architecture
The database enforces the invariants the code might forget.
PostgreSQL modeled for financial integrity: row-level security for tenancy, partial indexes, partitioning, chained audit logs and connection pooling under transactional load.
- Row-level security
- Partitioning
- Audit chains
- Query optimization
PostgreSQL · Redis · PgBouncer · Prisma
08
Mobile Engineering
The phone is the front door of a regulated product.
React Native and Expo apps with digital onboarding, KYC and biometric login, performance and accessibility audits, and release pipelines to both stores.
- Digital onboarding & KYC
- Biometric auth
- Performance
- Accessibility
React Native · Expo · Hermes · Firebase · Sentry
05/Selected work
Infrastructure that moves money — and proves it did.
Case studies from my SaaS products, ZazPay and my own initiatives. Diagrams are conceptual: they show how the pieces relate, never internal endpoints, identifiers or client data.
06/Payment lifecycle
What happens when someone pays.
One charge, six moments where a system can lose money or trust. Scroll to follow it through the architecture.
Step 1 of 6An intent with an idempotency key
An intent with an idempotency key
Checkout creates a payment intent and stores the client's key with it. A retry returns the same intent instead of creating a new charge.
Route the attempt
The orchestrator picks an eligible provider by rules — payment method, coverage and availability.
Charge through an adapter
The adapter translates the normalized request into the provider's API, carrying the same key.
The confirmation arrives later
The provider's webhook is verified and stored before anything else happens. Lost or duplicated webhooks are expected, not exceptional.
State changes, exactly once
The payment state and its event are committed together through the outbox; the ledger consumes it idempotently.
Verify against reality
Reconciliation matches the ledger against settlements and bank statements. Differences become owned exceptions.
07/Architecture
How I think about systems before writing them.
Six patterns I return to in every financial platform. Each diagram is original and conceptual — the decisions underneath are the part that matters.
Select any component in the diagram to see its role.
One payment model, many providers.
The product talks to a single payment contract. Providers live behind adapters, routing decides who processes each attempt, and every state change is an event.
Key decisions
- 1Idempotency key accepted at the edge and carried to every provider call
- 2Provider webhooks are verified, stored, then processed asynchronously
- 3Failover cascades to the next eligible provider without a second charge
08/Technology
Tools, honestly graded.
No percentages. Three levels that mean something: what I design with daily, what I have shipped and operated, and what I am learning now.
- CoreDaily tools. I design with them and answer for them in production.
- ProductionShipped and operated in real systems.
- ExploringActively learning and building with them.
Languages
Backend
Data
Messaging
Cloud & Infrastructure
DevSecOps & GitOps
Observability
Security
Mobile & Frontend
09/Terminal
Prefer the command line? Explore from here.
A working shell over the same content as this page. Try help, projects or open nucleus-pay.
zsh — elihu@portfolioTab completes · ↑↓ history
Type help to list the available commands.
10/Principles
The rules I don't negotiate with.
- 01
Security by design
Threats are modeled with the architecture, not audited after it ships.
- 02
Reliability over shortcuts
A shortcut in a money flow is a future incident with interest.
- 03
Architecture before implementation
Decide boundaries, contracts and failure modes first. Write them down with their trade-offs.
- 04
Financial integrity
Idempotent, traceable and reconcilable — or it does not move money.
- 05
Observability by default
Logs, metrics and health checks are part of done, not a follow-up ticket.
- 06
Automation first
If a human must remember to do it in production, it should be code.
- 07
Scalability with purpose
Scale the parts that need it. Complexity has to pay rent.
- 08
Engineering aligned with business
Regulation, unit economics and users shape the design as much as technology does.
11/Beyond engineering
What I study when nothing is on fire.
Cybersecurity research
Security labs, attack-surface analysis and turning findings into audits people can act on.
Rust
Learning it for the parts of payment infrastructure where latency and memory safety matter most.
Financial technology
Payment rails, open finance and the regulation that shapes how money moves in Latin America.
AI-assisted engineering
Building agent-driven software tooling with sandboxing, review gates and evidence — not demos.
System architecture
Reading postmortems and papers to understand how large systems fail and recover.
Continuous learning
Decision records, writing and teaching as the way to make knowledge last.
12/Contact
Have a complex system to build? Let's engineer something meaningful.
Payment infrastructure, platform architecture, DevSecOps or a second opinion on a design — I'm happy to talk it through.