Automated verification of a business buyer before trade credit
Before a business buyer is granted trade credit, five external sources are checked and one score comes back for the credit team to act on. Built for enterprise environments, ready to connect to their ERP, with UK GDPR, MLR and PSD2 requirements in place from the start.
The challenge
Approving a business buyer for trade credit means checking company registries, credit bureaus, sanctions lists, VAT numbers and Open Banking data — five systems, no two of which agree on a format. It had to work as a multi-tenant product, where a compliance failure at one tenant is a failure for the whole company.
Our approach
We started from the decision the platform exists to make: can this buyer get trade credit? Five external checks — registries, credit bureaus, sanctions, VAT, Open Banking — feed an automated process that weighs them into one trust score, and if anything is interrupted, a check resumes exactly where it stopped. Around that we built fintech-grade security: passkey sign-in instead of passwords, every tenant encrypted under its own key — so a GDPR erasure comes down to destroying that key — and a design taken through STRIDE threat modeling. The whole environment stands up from code — nothing hand-built, no stored secrets.
The results
The client got a service ready for enterprise environments: verifying a business customer is no longer manual work but an automated process that ends in a clear score, ready to feed the ERP it will one day run from. SOC 2 Type 1 readiness was delivered, UK GDPR, MLR and PSD2 requirements are built in from day one, and compliance is checked automatically on every release.
What we did
- Architected and built the entire platform, from the data model to the user interface
- Automated buyer verification: 5+ API integrations — business registries, sanctions lists, credit bureaus — weighed into one trust score
- Integrated 2+ Open Banking providers, so verification runs on real account data
- Made long-running checks reliable: an interrupted verification resumes exactly where it stopped
- Built passwordless, phishing-resistant sign-in with passkeys
- Reduced GDPR erasure to destroying a key: every tenant encrypts under its own, so no data has to be chased down row by row
- Stood the whole environment up from code: no hand-built infrastructure, no stored secrets
- Designed security in from day one, with STRIDE threat modeling
- Delivered SOC 2 Type 1 readiness, with compliance checks running in CI