Scaling a Payments Platform

This talk is about some of the challenges we ran into building and scaling payments at Shopify, and the solutions we came up with to overcome them.

Transcript

1. JOHN DUFF SCALING A PAYMENTS PLATFORM
2. ABOUT ME 2006 2011 2012 2013 2017 RUBY ON RAILS DEVELOPER SHOPIFY DEVELOPER API & INTEGRATIONS TEAM LEAD DIRECTOR OF ENGINEERING CONTRACTOR & CONSULTANT
3. SCALING PAYMENTS
4. You have to know the past to understand the present Carl Sagan “
5. INTEGRATION COMPLIANCE SCALE PSP FRAUD
6. E-COMMERCE 2005 No Stripe Limited payment processing options Challenging to impossible for new businesses Build a website
7. INTEGRATION COMPLIANCE SCALE PSP FRAUD
8. INTEGRATION Eway Authorize Purchase Capture Void Refund Linkpoint Authorize Purchase Capture Void Refund Paypal Authorize Purchase Capture Void Refund Purchase Capture Void Refund Authorize Authorize.NET
9. [Active Merchant] abstracts as many parts as possible away from the user to offer a consistent interface across all supported gateways. “
10. module ActiveMerchant # Base class for all ActiveMerchant gateway implementations. # Concrete gateway classes can and should implement include the following: # # * purchase(money, creditcard, options = {}) # * authorize(money, creditcard, options = {}) # * capture(money, authorization, options = {}) # * void(identification, options = {}) # * refund(money, identification, options = {}) class Gateway # The format of the amounts used by the gateway # :dollars => ’12.50’, :cents => '1250' class_inheritable_accessor :money_format self.money_format = :dollars # Does this gateway support credit cards of the passed type? def self.supports?(type) supported_cardtypes.include?(type.intern) end def self.supported_cardtypes [] end end end
11. Defacto payment library for Ruby ACTIVE MERCHANT Support of the Open Source community Over a hundred payment providers
12. INTEGRATION COMPLIANCE SCALE PSP FRAUD
13. PCI DSS OVERVIEW Maintain an Information Security Policy Regularly Monitor and Test Networks Implement Strong Access Control Measures Build and Maintain a Secure Network and Systems Protect Cardholder Data Maintain a Vulnerability Management Program
14. Only store what you are allowed and really need PCI DSS OVERVIEW Encrypt transmission of all cardholder data tl;dr Protect cardholder data behind a secure network and restricted access
15. Put as much of the system into scope as you possibly can and secure everything Every compliance consultant ever “
16. Put as much of the system into scope as you possibly can and secure everything Every compliance consultant ever “ X
17. CardProxy Processor Network Edge Form Post Payment Token Authorize
18. CardStore Network Edge Form Post Card Token
19. CardStore Network Edge Authorize CardProxy Processor Server Get + Clear Authorize
20. Reduce scope and isolate COMPLIANCE Simple systems Segregation of duties
21. INTEGRATION COMPLIANCE SCALE PSP FRAUD
22. 33 App Servers SCALE 2013 > 1000 Unicorn workers 5 Job servers > 2000 Sales per minute > 50k RPM Average 45 ms response time 370 Job workers
23. NO PAYMENT LEFT BEHIND
24. Network Edge Purchase Purchase CardProxy Processor Purchase Server Purchase
25. # Client def authorize(order) order.update_attribute(uuid: UUID.new) unless order.uuid.present? cardproxy.authorize(order.amount, uuid: order.uuid) end # CardProxy def create transaction = Transaction.find_or_create_by(uuid: params[:uuid]) if transaction.persisted? respond_with transaction.to_json, status: :conflict else transaction.amount = amount transaction.kind = transaction_type transaction.process! respond_with transaction.to_json, status: :created end end
26. THERE WILL ALWAYS BE FAILURES
27. REDUCE WORKLOAD
28. CardStore Network Edge Form Post Card Token
29. CardStore Network Edge Authorize CardProxy Processor Server Get + Clear Authorize Background Job
30. BACKGROUND PAYMENT PROCESSING ms
31. Server FLASH SALE Server
32. Idempotent requests so they can be retried SCALE Recovering vs preventing failures Move slower processes out of critical path
33. INTEGRATION COMPLIANCE SCALE PSP FRAUD
34. Shopify
35. Shopify
36. Bank and processor PAYMENT SERVICE Account Provisioning Risk management Chargebacks and payouts Support
38. Bank and processor Managed accounts Account provisioning Chargebacks and payouts Solid APIs STRIPE CONNECT 2012
39. 2012 2013 2013 2015 2017 CONNECT LAUNCHED ACCOUNT CONNECTION APPLICATION FEES TRANSACTION DATA BANK TRANSFERS API MANAGE & REFUND FEES FEES ON SUBSCRIPTIONS MANAGED ACCOUNTS MANY TO MANY PAYMENTS HOLDING FUNDS ACCOUNT DEBITS STRIPE CONNECT
40. CHALLENGES Inconsistencies in totals Data not available in the APIs Values not broken down as we needed Keep your own records
41. INTEGRATION COMPLIANCE SCALE PSP FRAUD
43. Basic hard code rules FRAUD DETECTION 2012 Depend on the payment processor Blacklist repeat attempts
44. False positives / negatives FRAUD DETECTION 2012 Poor static rules High impact to merchants Lower trust
45. 10+ years of data WHY BUILD? We own the purchasing pipeline Investing in ML/AI Scalable
46. Problem Features Availability Metrics Deploy
47. Get Rating Orders History HDFS Spark Read History Fraud Model Feature Provider 1 Feature Provider N … Server
48. If you build it, there will be fraud FRAUD DETECTION Leverage contextual data Fraud changes More @ https:/ /tinyurl.com/fraud-ml
49. INTEGRATION COMPLIANCE SCALE PSP FRAUD
50. THANKS! @johnduff