Payment Checkout & Ledger Service  ·  View 11 of 24  ·  Data

Data Classes — Truth, Residency and Rebuildability

Four classes with different correctness, retention and regulatory treatment, plus one that never leaves its segment.

Editable source SVG draw.io All views
In-country data centres — all copies, including backups Class 1 · Ledger — the only truth about money · 10 years · RPO 0 Transactions balanced at write Entries signed minor units Account tree named accounts Posting rule versions Class 2 · Payment state — mutable, merchant sharded · 7 years · RPO 5 s Intents Attempts Refunds Disputes Class 3 · Event log — replayable evidence · 7 years Payment events Raw provider payloads before parsing Webhook attempts Operator audit 7 years Class 4 · Derived — rebuildable, no independent truth Merchant balances Statements Analytics marts Dashboard cache Cardholder data environment — never leaves, never joined PAN (transient) not at rest Token vault CDE only HSM key material non-exportable DR data centre same country rebuild Data Classes — Truth, Residency and Rebuildability Data store Queue / topic Risk / gap Security / platform Application we own batch Class 4 is deleted and rebuilt from Class 1 and Class 3 on a schedule. If a rebuild changes a number, Class 4 was wrong — never Class 1. Every class is replicated to the DR site in the same country. v 1.0 · owner Payments Platform Architecture · date 2026-10

Decisions

  • Class 1 is the only truth about money. Classes 2 and 3 record what happened; Class 4 has no independent truth and is deleted and rebuilt on a schedule (ADR-02, ADR-16).
  • Every copy, backups and DR included, stays in the country of operation (ADR-11).
  • Class 4 is rebuilt regularly and the rebuild is compared. If a rebuild changes a number, Class 4 was wrong — never Class 1.

Retention

  • Ledger 10 years; payment state and raw provider payloads 7 years; operator audit 7 years; application logs 400 days.
  • No PAN at rest outside the cardholder data environment, ever.
  • Retention figures are stated assumptions, set to the longer of tax and payment-regulation practice.

Risks

  • The projection rebuild is the one control that proves Class 4 is derived rather than authoritative, and it is the control most likely to be quietly disabled when it gets slow. It is an availability-affecting job by design (ADR-16).
◀  Data Flow — One Payment, End to End All views Ledger and Payment Data Model  ▶
Solution Architecture v1.0 · open source, self-hosted on Kubernetes across two in-country data centres · Payments Platform Architecture · 2026-10 · 24 views · 18 architecture decision records11-data-classes-and-ownership