Xoldy – case study

Xoldy is a payment institution authorised by the Bank of Italy, providing payment systems to professional networks. Working for a supervised entity changes the order of priorities: security and compliance come before every other consideration, convenience included.

The constraint that shaped the project

Every technical choice has to be justified and documented. It is not enough that it works — it has to be demonstrable. The difference shows up everywhere: how a credential is stored, how long a session lasts, what ends up in a log file and what must never end up there. In an ordinary project these are good practice; here they are the perimeter you are allowed to work in.

How it works

• Payment systems built for professional networks, where payer and payee belong to the same structure.
• PSD2 requirements on authentication and access, applied as the general rule rather than as an exception for sensitive operations.
• Application security measures matched to the context of a supervised intermediary.

The part you do not see

Strong authentication is the easy part to explain and the hardest to make bearable. If every action needs a confirmation, people stop using the system or find a way around it — and a system that gets worked around is less safe than a permissive one, because nobody knows where the controls actually are any more. The real work is deciding which operations deserve the friction.