Case study
DevOps Engineering and 24x7 Operations for a Contactless Payment Platform
Plexteq provided a dedicated DevOps team to a Copenhagen-based FinTech company, taking ownership of AWS infrastructure development, PCI-regulated operations, and round-the-clock support for their mobile payment acceptance platform.
Project Highlights
Industry
FinTech, Payments, Mobile
Market
Denmark / EU
Compliance
PCI DSS, PCI Secure SLC, PCI PIN, PCI MPoC
Cooperation
2023 – now
Technologies
AWS, Terraform, Docker, Python, Bash, Aurora, ElastiCache, Elasticsearch, Bitbucket, Jira
Business Challenge
Our client is a fast-growing FinTech company headquartered in Copenhagen that is changing the way merchants and consumers make contactless payments. Instead of relying on traditional physical payment terminals, the company delivers a mobile software solution that turns off-the-shelf smartphones into fully certified payment acceptance devices - effectively disrupting the established POS hardware market.
The company works with all major payment schemes and a range of acquirers, banks, and partners, and its revenue doubled over the past year. That growth put significant pressure on the platform behind the product: a microservices-based backend running on AWS that must remain highly available, scalable, and continuously compliant with some of the strictest security standards in the payment industry.
Turning consumer mobile devices into payment terminals places the platform squarely within the scope of several PCI programs at once. The infrastructure and the processes around it had to satisfy the requirements of PCI DSS for the cardholder data environment, PCI Secure SLC for the software delivery lifecycle, PCI PIN for PIN-entry-related services, and PCI MPoC (Mobile Payments on COTS) for the software-based acceptance solution itself.
At the same time, a payment acceptance platform cannot tolerate downtime. Merchants take payments around the clock, so incidents must be detected and resolved at any hour, not just during business hours.
The client needed an engineering partner able to combine three roles that are usually split across separate teams: hands-on infrastructure development, deep familiarity with PCI-regulated environments, and a reliable 24x7 operations function. Based on a successful evaluation of Plexteq's expertise in FinTech infrastructure and managed services, the client established a long-term partnership with us.
Key Challenges
Dual-Track Infrastructure: PCI and Non-PCI Environments
Build, operate, and continuously optimize AWS-hosted infrastructure for both PCI and non-PCI segments, keeping the environments strictly separated while allowing development teams to deliver changes quickly and safely.
Compliance Across Four PCI Programs
Maintain simultaneous compliance with PCI DSS, PCI Secure SLC, PCI PIN, and PCI MPoC - embedding security controls, audit readiness, hardening, and evidence collection directly into infrastructure-as-code and CI/CD pipelines rather than treating compliance as a periodic exercise.
Always-On Operations for a Live Payment Platform
Guarantee round-the-clock availability of a live payment platform by establishing a 24x7 shift-based operations model with mature alerting, monitoring, observability, and incident response practices.
Solution Delivered
Plexteq assembled a dedicated DevOps team that took end-to-end responsibility for the client's infrastructure and operations, working as an integrated extension of the in-house engineering organization.
Infrastructure development and automation
The backend consists of Java-based microservices operated on AWS. Our team owns the full infrastructure layer and, beyond day-to-day operations, delivered a series of major infrastructure development initiatives:
-
Migration from EC2 to ECS - we re-platformed the workloads from individually managed EC2 instances to container orchestration on Amazon ECS, moving services into Docker and eliminating manually maintained servers in favor of declarative, reproducible deployments.
-
Full Terraform automation - the entire infrastructure, including the new ECS platform, is described as code using Terraform, with peer-reviewed changes flowing through Bitbucket and tracked in Jira; environments can be rebuilt from code, and configuration drift is eliminated
-
Improved scalability and resiliency - the ECS migration enabled service auto-scaling, self-healing task replacement, rolling deployments without downtime, and multi-AZ distribution of workloads, allowing the platform to absorb traffic spikes and infrastructure failures gracefully
-
Enhanced monitoring for failure detection - we reworked the existing monitoring system to detect failures earlier and more reliably: container- and service-level health signals, refined alert thresholds, and improved observability across infrastructure, middleware, and application layers
-
JVM tuning for containers under high load - we tuned how the Java-based services behave in ECS under high load, right-sizing container memory and CPU reservations against JVM heap and garbage collection settings so that services stay stable and predictable at peak transaction volumes instead of being throttled or OOM-killed
-
Operation and tuning of the data layer - Aurora relational databases, ElastiCache (Redis) caching, and Elasticsearch for search and log analytics - plus extensive Python and Bash tooling for provisioning, self-healing routines, and operational tasks
PCI-regulated environment operations
A defining aspect of this engagement is that the team operates inside a multi-standard PCI scope. We designed and now maintain clear segmentation between PCI and non-PCI environments and embedded compliance into the daily engineering workflow:
​
-
PCI DSS - network segmentation, access control, key management support, logging and log retention, vulnerability management, hardening baselines, and continuous audit-evidence collection for the cardholder data environment
-
PCI Secure SLC - secure software lifecycle controls integrated into CI/CD: change management, code review gates, dependency and image scanning, and traceability from ticket to production deployment
-
PCI PIN - operational controls and infrastructure support for PIN-related services and their strictly controlled environments
-
PCI MPoC - infrastructure and monitoring for the backend systems (attestation and monitoring components) that a software-based mobile acceptance solution depends on
​
Security work also covers OWASP-aligned practices, regular participation in external audits and assessments, and remediation of findings as part of the normal engineering cadence rather than as one-off projects.
24x7 shift-based operations
Because merchants accept payments at all hours, we established a follow-the-sun shift model providing genuine 24x7 coverage:
​
-
Multi-layered alerting, monitoring, and observability across infrastructure, middleware, and application metrics, with actionable alerts routed to the on-shift engineer
-
Documented runbooks and escalation paths, so incidents are handled consistently regardless of who is on shift
-
Incident response with defined severity levels, postmortems, and a feedback loop that turns recurring incidents into automation and reliability improvements
-
Continuous capacity and performance management to stay ahead of the client's rapid transaction growth​
Key Results
Reliable 24x7 operation of a live payment platform
with incidents detected and resolved around the clock by shift-based engineers
Sustained compliance across four PCI programs
PCI DSS, PCI Secure SLC, PCI PIN, and PCI MPoC - with audit evidence produced from automated pipelines
Successful EC2-to-ECS migration with Terraform automation
replacing manually maintained servers with a containerized, reproducible platform delivered via peer-reviewed CI/CD
Scalability and resiliency matching 2x annual growth
achieved through ECS auto-scaling, JVM tuning for high-load, improved failure detection, and continuous optimization of data layers
Business Outcome
With Plexteq operating its infrastructure, the client's in-house teams can focus on product development while relying on a platform that is secure, compliant, and available at all times.
↳ Compliance as an enabler, not a bottleneck
Because PCI DSS, Secure SLC, PIN, and MPoC controls are built into infrastructure-as-code and delivery pipelines, the client passes assessments without freezing product development — an important competitive advantage in a heavily regulated industry.
↳ Confidence to grow
The automated, continuously optimized AWS platform absorbed a doubling of business volume without architectural crisis, giving the client confidence to keep expanding to new markets, schemes, and partners.
↳ Always-on service for merchants
The 24x7 shift model means merchants can accept payments at any time of day with the assurance that the platform behind them is actively watched and supported.