.svg "kloia.png"){kind=logo}
Action
kloia built the solution on the AWS Well-Architected Framework and delivered it in two phases over 10-13 weeks.
Architecture and Infrastructure
The core design applied a multi-region concept inside a single AWS Middle East region, spread across three Availability Zones for resilience.
Target architecture on AWS
Multi-account strategy. AWS Organizations separated environments and responsibilities:
- Management Account (Root): governance and consolidated billing.
- Network Account: central hub for hybrid connectivity (Direct Connect, VPN) and shared networking (Transit Gateway).
- Workload Accounts (Production/Staging): isolated accounts for application services.
- Security Account: centralized logging, auditing and security services.
Hybrid connectivity.
- AWS Direct Connect: a dedicated private link to NeoPay's on-premises data centers, routed through a Direct Connect Gateway for high-bandwidth, stable transfers.
- Site-to-Site VPN: a redundancy layer behind Direct Connect, keeping the network up if the physical link fails.
Compute and database stacks. The two workloads were separated for performance and manageability:
- Legacy/Core Services: Amazon EC2 on Windows Server with Amazon RDS for SQL Server, deployed Multi-AZ with automatic failover for a 99.95% database uptime SLA.
- Microservices: containerized applications on Amazon Aurora PostgreSQL-Compatible Edition for transactional data, with Amazon ElastiCache Redis for sessions and caching. All components span three AZs.
Load balancing and scalability. Application Load Balancers distribute traffic. Auto Scaling Groups scale compute up for peak payment loads and down during off-peak hours to control cost.
Security and Compliance
Security was the foundation, built around the UAE Central Bank data residency rule and PCI DSS.
Security and compliance controls
- Data residency enforcement: all services, storage (S3, RDS, Aurora) and backups are confined to the AWS Middle East region. Service Control Policies in AWS Organizations block any resource deployment outside it.
- Network segmentation (PCI scope reduction): strict VPC and subnet segregation. PCI-scoped components such as payment card environments sit in their own private subnets, reachable only through layered controls and Bastion Hosts for administrative access.
- Perimeter security: AWS WAF on the ALBs against common web exploits (SQL injection, XSS), with DDoS mitigation through AWS Shield Standard.
- Identity and Access Management: least privilege for all human and machine access. AWS Managed Microsoft AD provides centralized identity.
- Encryption: data encrypted at rest with AWS KMS customer-managed keys and in transit with TLS, meeting PCI DSS Requirement 3 (Protect Stored Cardholder Data).
- Continuous monitoring and audit: AWS CloudTrail logs all API activity to an S3 bucket with Object Lock for tamper-proof audit. Amazon GuardDuty provides continuous threat detection across network activity and account usage.
Managed Services and Operational Excellence
kloia wrapped the platform in a full managed service to move NeoPay to an automated operating model.
Managed services and operations model
- Infrastructure as Code: Terraform defines and provisions every cloud resource. Changes go through a GitOps workflow. The result: faster disaster recovery, consistent environments, simpler change management.
- 24/7 NOC and SLA: a dedicated Network Operations Center monitors and supports the platform 24/7/365 under a contractual 99.99% infrastructure uptime SLA.
- Monitoring and observability: Amazon CloudWatch plus third-party tools for metrics, centralized logging and proactive alerting. Critical alerts reach the NOC through automated runbooks to hold the RTO target.
- Patch management: AWS Systems Manager Patch Manager keeps operating systems current and shortens vulnerability windows in line with compliance policy.
Results
NeoPay now runs its digital payment services on a compliant, highly available AWS foundation.
Business value and results
|
Area |
Outcome |
|---|---|
|
Data safety |
Zero RPO and a 4-5 minute RTO for critical financial data |
|
Regulatory compliance |
Full alignment with UAE Central Bank data residency and PCI DSS |
|
Operational agility |
Automated scaling and Terraform-based IaC for new services without manual work |
|
Compute cost |
Projected 20-30% reduction through rightsizing |
|
Commitment savings |
Additional 30-40% through Reserved Instances and Savings Plans |
|
Audit effort |
80% less manual audit work through automated vulnerability scanning and compliance reporting |
|
Availability |
99.99% infrastructure uptime SLA under 24/7 NOC coverage |
On RTO and RPO: there is no standard figure we can apply across the estate. Both depend on how critical each workload is to the business and on the budget for the recovery design behind it. Once NeoPay agrees the targets for each workload, we can set out the design, cost and test plan needed to meet them.
What This Means for NeoPay
Security and compliance stopped being a cost center. Regulators and customers can trust the platform, which opens the door to new partnerships and wider market reach.
Terraform and the managed services model keep the platform ready for change. A CI/CD pipeline supports faster releases and continuous experimentation. NeoPay can adopt cloud-native services such as advanced analytics or machine learning for fraud detection and personalized customer experiences, and scale transaction volumes as the business grows.
Open-Source Observability Transformation on AWS
Open-Source Observability Transformation on AWS