Architecture you can see, code you can read
How the four systems work together, how third-party services plug in, and how the core rules are implemented. The code windows show real excerpts from the core platform, redacted and reviewed one by one.
Architecture
Veloziq Core is the core platform; the H5 app, landing pages and supervisor portal all talk to it over APIs, and every third-party callback is signature-verified.
Code tour
Pick a file from the tree and read the key logic step by step. Highlighted lines belong to the current step.
The 4-layer KYC pipeline
Didit's status is pre-processed first: reject outright, flag for manual review, or continue.
Score → limit
High and low bands auto-approve with a limit; review and reject bands get none.
Fraud rules (structure)
Reject if the same ID number was already approved for another user.
Robot review: weighted risk score
Each rule's score is multiplied by its weight and summed; rules that error are skipped.
4 overdue modes
Month and year terms add calendar months; day terms can count the disbursement day.
Auto-lending pipeline
Each tenant with the workflow enabled runs in isolation — one failure doesn't stop the rest.
Pre-payout checks
After the failure cap it skips and hands off to staff instead of piling up failures.
Waterfall allocation
Overdue fee → penalty, in a fixed order.
Schedule generation
Equal instalments, interest-first and equal principal each have a generator.
Upgrade rule matching
Among rules whose thresholds are met, the highest percentage wins; ties go to the lowest id.
Resolving the tenant
The X-Tenant-Domain header wins, so packaged apps still resolve their tenant.
Curlec callback verification
Recalculated from the specified fields with the channel key.
Didit webhook signature
HMAC-SHA256 over the raw body, compared with X-Signature-V2 using hash_equals.
RAFFTECH envelope encryption
The request payload is AES-encrypted first.
Scheduled jobs
Hourly check of overdue loans, updating days and penalties.
- Code from the core platform, redacted: risk thresholds and similar parameters are replaced with config keys.
Tech stack
Core platform
- PHP 8.2+
- Laravel 12
- Filament 4
- Octane
- Sanctum
- Scribe
- spatie/activitylog
- PostgreSQL
- Redis
Front-ends
- Next.js 16
- React 19
- TypeScript
- Tailwind CSS 4
- shadcn/ui
- next-intl
- Zustand
- PWA
Infrastructure
- AWS S3
- Nginx
- Cloudflare
- Laravel Scheduler
- Queues
- Blade (Supervisor)
Integrations
- Didit
- Curlec Payout
- Razorpay
- RAFFTECH
- AWS SES
- AWS SNS
- Web Push
- BlueBird
- NXCloud
Automation
Jobs driven by the Laravel Scheduler — all withoutOverlapping, critical ones onOneServer.
Auto-lending pipelineEvery minute
Auto-disbursement scanEvery 3 min
RAFFTECH signing reconciliationEvery 5 min
Overdue checkHourly
Activity log cleanupDaily 01:00
Service usage log cleanupDaily 01:30
Global statisticsDaily 02:00
Expired OTP log cleanupDaily 03:00
RAFFTECH log cleanupDaily 03:00
Cache warm-upDaily 04:00
Expired contract cleanupDaily 05:00
Repayment remindersDaily 09:00
API overview
About 100 REST endpoints in 27 business groups, documented with Scribe.
Auth
Authentication
Users
User-Management
KYC
KYC
Face recognition
Face-Recognition
Loan products
Loan-Products
Applications
Loan-Application
Loans
Loan-Management
Agreements
Loan-Agreement
Flow choice
Loan-Flow-Choice
Consultation
Loan-Consultation
Contracts
Contract
Sign video
Sign-Video
Repayments
Repayment
Payments
Payment
Bank cards
Bank-Cards
Addresses
Address
Notifications
Notification
Push
Push-Notification
OTP
OTP
Registration
Registration
Theme
Theme
Languages
Language
Platform terms
Platform-Terms
Service config
Service-Config
Support
Customer-Service
Image upload
Image-Upload
S3 upload
S3-Upload
Security by design
Encryption
Sensitive fields encrypted with hashed lookup; the supervisor portal uses AES-256.
Signature checks
Didit HMAC-SHA256 and Curlec checksums compared with hash_equals in constant time; RAFFTECH payloads carry a MAC.
Rate limiting
OTP, login and form endpoints limited by IP and tenant.
Tenant isolation
Global model scopes filter by tenant_id; platform admins can impersonate a tenant to debug.
Audit
Operation, admin-access and adjustment logs — all traceable.
See what it can do for your business
We'll run a full demo tailored to your country, products and process, and share deployment and pricing options.