BodaPlus: core banking for motorcycle-taxi savings cooperatives
Replacing paper, WhatsApp screenshots and cash with an auditable, multi-tenant banking platform.
The problem
Boda boda (motorcycle-taxi) riders across Kenya pool their savings through SACCOs: member-owned cooperatives that collect contributions, issue loans and run welfare funds. Most run on paper records, WhatsApp screenshots and cash, so balances are hard to audit and loans take days.
The platform had to give every SACCO a full banking back end on shared infrastructure, without any tenant's data ever touching another's.
Architecture
All traffic enters through one gateway, the only place tokens are verified. Services discover each other via Eureka, publish events through a transactional outbox to Kafka, and every business service gets its own database per tenant.
What I built
- 01A ledger engine with five invariantsEvery money movement goes through one posting engine that enforces idempotency (M-Pesa IDs as keys), balanced debits and credits, row locks on accounts and wallets, atomicity with the caller's transaction, and immutability: a database trigger blocks edits, so corrections are reversals.
- 02Hard multi-tenancy, provisioned automaticallyOnboarding a SACCO creates a database for each service and announces it over Kafka so services seed roles and templates. At runtime, the tenant code from the gateway routes each request to its database; pools and Flyway migrations are created on first use. Offboarding blocks the tenant at the gateway before tearing down.
- 03A gateway built as the trust boundaryECDSA-signed tokens verified against cached public keys, sessions bound to device fingerprint and IP subnet in Redis, client-injected identity headers stripped before trusted ones are written, plus Redis rate limiting and retries with exponential backoff.
- 04Reliable events with a transactional outboxEvents are saved in the same transaction as the business change, published immediately after commit, and swept by a poller across all tenants every five seconds. Row locks guarantee exactly one publisher per event.
- 05A loan engine with pluggable rulesFull lifecycle from application to disbursement, schedule, repayment and penalties. Eligibility and guarantor checks are composable rule chains, guarantees lock part of the guarantor's savings, and members are verified against the national ID and tax registries.
- 06Observability and safe deliveryMetrics, logs and traces in Prometheus, Loki, Tempo and Grafana, with trace IDs returned in every API response. Jenkins builds and ships only the services that changed, and a pre-commit hook stops anyone editing an applied migration.
Outcome
I lead the engineering team through service design, the financial engine and mobile-money integration, taking the platform from initial build toward production rollout.
Cash-and-paper record-keeping becomes an auditable digital bank: every balance can be rebuilt from the ledger at any point in its history.