System Architecture & Ingestion Strategy Options

The technical architecture is entirely in the ideation phase. Below are the key engineering options we need to debate and decide: how to ingest data cost-effectively, how to satisfy UAE data residency rules, and how to structure our database schema.

Proposed End-to-End Ingestion Flow Architecture Blueprint

1. CLIENT LAYER

• React Native (iOS & Android)

• Consented OAuth Hook

• WhatsApp Quick-Log Bot

2. API & AUTH

• Kong / AWS API Gateway

• Supabase Auth (JWT)

• Biometric Enclave Storage

3. INGESTION WORKERS

• In-Memory PDF Decryption

• Email Alert Regex Extractors

• Deduplication Fingerprinting

4. STORAGE & DB

• PostgreSQL (AES-256)

• Pgvector for Merchants

• 7-Day S3 PDF Purge Policy

5. ENGINES & MCP

• Cheque Guard Calculator

• Card Spend Cliff Rules

• Local MCP Server Endpoint

Decision Vector 1: Ingestion Rail Selection

OPTION A: ZERO-API BOOTSTRAP AED 0 Bank Fee

Consented Email & Statement PDF Parsing

Users grant read-only access to transaction alert emails via Google OAuth, or upload encrypted monthly PDF e-statements. Statements are decrypted in volatile memory using their birthdate/mobile passcode.

Pros: Zero aggregator API costs; no AISP banking license required on Day 1; 80%+ gross margins.

Cons: Cannot fetch live real-time account balances directly without an alert trigger.

OPTION B: OPEN BANKING Lean / Tarabut

Regulated Open Banking Aggregators

Integrate the Lean Technologies Link SDK or Tarabut Gateway under the CBUAE AlTareq Open Finance framework to directly pull settled ledger balances and transaction histories.

Pros: Direct bank sync; verified IBANs; accurate historical ledger balances.

Cons: Aggregator fee of $0.40–$0.75 per monthly active connection (burns early cash); potential connection timeouts.

Decision Vector 2: Compliance & Cloud Hosting

The UAE Central Bank enforces Circular No. 14/2021 (Consumer Protection Standards) and the Personal Data Protection Law (PDPL - Federal Decree-Law No. 45/2021). We have two architectural paths:

1. AWS UAE Region (`me-central-1`)

Host all RDS PostgreSQL instances, Redis caches, and ML vector stores within AWS data centers in Abu Dhabi / Dubai. Strictly ensures no financial ledger data leaves the UAE.

2. Ephemeral Storage Policy

Bank statement PDFs are processed in volatile memory, extracted into normalized transaction rows, and the original PDF is purged within 7 days. We never retain bank passwords.

Strategic Ingestion Trade-off (Cost vs. Automation)

Rail A: Consented Statement & Email Sync High Margin

Zero bank aggregator fees. The user connects read-only transaction alerts or uploads monthly statements. Preserves an 82% gross software margin and allows launching immediately without banking regulatory approvals.

Rail B: Regulated Open Banking (Lean / Tarabut) Zero Friction

Instant multi-bank linking in 30 seconds via CBUAE Open Finance. Directly pulls live ledger balances at ~$0.50/user/mo cost. Maximizes retention and user delight for our premium Pro tier.

← Previous: Competitor Landscape Next: Unit Economics & Financial Model →