Case Study - Kotlin platform, card authorization, and banking product delivery for a US neobank.

Overview

Apex Financial is a US-based neobank serving small and mid-size businesses with business checking, corporate cards, and credit lines. Cedar Labs was embedded with the product engineering team from February through July 2026. This engagement is the Kotlin platform and banking product work. It is not the later native Android and iOS apps — those apps consume this backend.

The through-line was real-time card authorization. We bootstrapped a dedicated Kotlin service in February (webhook parsing, HMAC verification, balances, spending rules, authorization logs), then spent the spring putting a database, pub/sub, and partner-bank auth under it. The data model was rewritten so deposit cards and charge cards share one table. Vendor controls, high-value authorization alerts, and operator backfills followed. By July the isolated read models were gone: authorization reads canonical banking tables, and card ledger / wallet wiring sits with the rest of the money platform.

In parallel we unified two backend generations onto one Kotlin toolchain and internal service framework. That included Kotlin and Gradle upgrades, a reproducible developer toolchain, a single Gradle build and lint baseline, shared money / secrets / logging libraries, YAML-to-HOCON config, a modern Kotlin formatter, and an internal admin surface with OAuth. Mid-engagement we moved the SQL layer toward a typed ORM and replaced the legacy dependency-injection container so services start as one graph. Some ORM paths were reverted when they were not yet stable — the constraint was ship the product, not win the migration.

Banking product work rode the same platform. Credit-line drawdown monitors and capital-agreement generation. International payment consumers and bill-pay / payee audit paths. Cash-flow insights sync that no longer pins database connections across slow partner HTTP. Sales-demo query performance and a Redis cache in front of slow third-party APIs. Advertising-spend infrastructure for a product launch. Object-level authorization after a pentest handoff, including a transactions-endpoint IDOR fix.

Production systems had to keep up. CI was rebuilt for parallel, sharded builds and overlapping image push — about a 75% wall-clock cut on master. A pre-merge check started catching missing infrastructure changes. Staging connection-pool and CPU incidents were diagnosed and fixed. Deploy pipelines got a staging bake and stopped clobbering a newer manual deploy with an older automated one. An internal engineering docs site took runbooks and service READMEs out of Slack canvases. An operator backfill console replaced one-off scripts.

The result was one Kotlin backend that could authorize cards in real time, keep shipping capital and payments, and feed web plus native mobile without a second stack.

What we did

For privacy reasons, the client requested anonymizing the company name in this portfolio profile.