November 10, 2026

AI / FINTECH / CRYPTO / TECH

Leonie Voss

Leonie covers digital identity, cloud services, and software infrastructure. She focuses on account security, reliability, and the practical consequences of technical design choices.

Latest

Diagram of one risk register row, a single cloud region for ledger, KYC and payouts, scored 0.40 before and 0.15 after failover on a low, moderate and high likelihood-times-impact scale

NYDFS · Nov 6

NYDFS Risk Assessment Guidance: What Part 500 Requires and What DFS Expects

What New York's September 2026 risk assessment letter adds to Part 500, who must comply and how a risk is scored.

A stored payment token branches into customer checkout and merchant-initiated payments after consent.

Payment APIs · Oct 31

Merchant-Initiated Transactions and Stored Cards

How customer consent, stored credentials and later payment attempts fit together in Stripe and Adyen integrations.

Refund API state diagram from request through pending processing to completed or failed outcomes

Payment APIs · Oct 29

Payment API Refunds: Full, Partial and Pending States

How Stripe, Adyen, PayPal and Square handle full, partial and asynchronous refunds.

Diagram of a card payment authorized first, held for a provider-set window, then either captured in full or part or cancelled to release the hold

Payment APIs · Oct 28

Authorize and Capture in Payment APIs, Compared

How separate authorization and capture works at Stripe, Adyen, PayPal and Square, from hold windows to expiry.

Diagram of what a SOC 2 report examines: a system boundary of production services, identity and admin paths, key subservice vendors, change and incident workflows and customer-side controls; the Trust Services Criteria placed in scope; and the Type 1 date or Type 2 period covered.

SOC 2 · Oct 26

SOC 2 for Fintech Startups: What the Report Actually Covers

What a SOC 2 report covers, how to set scope and which controls a fintech startup must operate consistently.

Three ISO 20022 message families: pain for initiation, pacs for clearing and settlement, and camt for cash management.

Payment APIs · Oct 24

ISO 20022 Messages Explained: pain, pacs and camt

Read pain, pacs and camt by their business jobs, then check the rail's version and implementation rules.

Timeline of a card dispute in a payment integration: the dispute webhook arrives, the case is mapped to the order by dispute ID, evidence is staged, and the defense is submitted once, with a note that merchants usually have 7 to 21 days to respond

chargebacks · Oct 24

Chargeback API Disputes: Webhooks, Evidence and Deadlines

How Stripe and Adyen report card disputes, stage evidence and take a one-shot defense before the deadline.

Diagram comparing a vault token, which the payment provider swaps for the card number, with a network token that travels with a cryptogram to the card network and issuer, with a fallback retry on the card number

Payment APIs · Oct 23

Network Tokenization Explained: Network Tokens vs Vault Tokens

How card network tokens differ from a provider's vault token, and what that changes for developers.

Flow diagram of a payment webhook: the provider sends an event, the endpoint verifies and stores it under a unique event key, returns 2xx, and a worker applies the business change, with a retry loop and checks for duplicates and failures after acknowledgment

Payment APIs · Oct 21

Payment Webhook Retries: Duplicates, Order and Recovery

Separate delivery acknowledgment from payment processing, and make repeated events safe.

Table comparing hosted checkout with a lower-level payment API across five layers: payment page, card fields and tokens, totals, confirmation and final-state verification, showing which layers the provider or your code owns

Payment APIs · Oct 20

Payment API vs Payment Gateway: What You Actually Integrate

Hosted checkout bundles the payment UI; a lower-level API leaves more of the payment lifecycle in your code.

Diagram of a backend server sending three kinds of payment API credentials: an API key, an OAuth 2.0 bearer token and a mutual TLS client certificate, each paired with the secret it requires you to protect

Payment APIs · Oct 20

Payment API Authentication: API Keys, OAuth 2.0 and Mutual TLS

API keys, OAuth 2.0 tokens and mutual TLS compared across Stripe, Adyen, PayPal, Square and Visa.

New York SHIELD Act · Oct 17

New York SHIELD Act Requirements for App Developers

The New York SHIELD Act reaches businesses outside the state when they hold New Yorkers’ private information.

Diagram of a card decline moving from the issuing bank to a network code and a provider code, with three next steps: ask to re-enter, retry on a schedule, ask for a new card

Payment APIs · Oct 17

Payment Decline Codes: Reading Stripe, Adyen and Braintree Refusals

How Stripe, Adyen and Braintree report card declines, what to tell the customer and when a retry is allowed.

Diagram of payment API sandbox testing: sandbox test values for Stripe, Adyen, PayPal and Square beside a list of what a sandbox does not prove, from issuer decisions to go-live cutover

Payment APIs · Oct 14

Payment API Sandbox Testing: What Test Mode Proves and What It Can't

How Stripe, Adyen, PayPal and Square sandboxes force failures, and where each says test mode differs from production.

Diagram: a processor's hosted card field and card data vault stay in PCI DSS scope, while the merchant's systems receive only a token and the card's last four digits

PCI DSS · Oct 13

PCI DSS Scope and Tokenization: What Leaves Your Plate, What Stays

What tokens take out of PCI DSS scope, what stays in, and how a hosted card form decides SAQ A or A-EP.

Bar chart of API requests per second crossing a dashed rate limit, with the excess answered by 429, beside a request retried after 1, 2 and 4 seconds plus jitter and sent with the same idempotency key.

Payment APIs · Oct 11

Payment API Rate Limits: Handling a 429 at Stripe, Square and PayPal

How Stripe, Square and PayPal throttle API calls, and how to retry a 429 without charging twice.

Diagram: a client calls a payment provider two ways, once with a dated version header and once with a version number in the URL path.

Payment APIs · Oct 10

Payment API Versioning: Dated Headers vs Version Numbers in the URL

How Stripe, Square, Adyen and PayPal ship breaking changes, and what each model means for your code.

A green regulatory binder connects risk assessment, access control, incident response and reporting.

NYDFS · Oct 8

NYDFS Part 500 Requirements for Fintech and Crypto Firms

A working guide to cybersecurity controls, notices, annual filings and exemptions under NYDFS Part 500.

Comparison of payment webhook signatures: Stripe signs a timestamp and the raw body with HMAC-SHA256, Adyen signs eight colon-joined fields with HMAC-SHA256 and no timestamp, and PayPal signs the transmission ID, time, webhook ID and a CRC32 of the body with SHA256withRSA.

Payment APIs · Oct 5

Verifying Payment Webhook Signatures at Stripe, Adyen and PayPal

Stripe, Adyen and PayPal all sign webhooks, but not the same things. What each check proves and where it breaks.

Diagram of a payment request sent with an idempotency key: the response is lost to a timeout, the client retries with the same key, and the provider returns the stored first result with only one charge.

Payment APIs · Oct 3

Idempotency Keys in a Payment API: Retrying Without Charging Twice

How idempotency keys let a payment API call be retried safely, and where Stripe, Adyen, PayPal and Square differ.

A phone and a USB-C security key beside a laptop and a second device.

Passkeys · Sep 26

Passkeys After a Lost Phone: How Account Recovery Works

Your recovery route depends on where a passkey is stored and which other sign-in methods remain available.