Double-entry, by construction
Every transaction writes two or more legs summing to zero per commodity. Signed-balance convention with floor enforcement. No transaction can leave the books unbalanced.
Platform
One API for money movement. One ledger for the truth.
WalletD is two layers that ship together: LedgerD, a domain-agnostic double-entry ledger of record, and the WalletD money paths that post to it. Nothing wallet-shaped is baked into the ledger. You register your own transaction types, account purposes, and currencies.
Your application
Edge gatewayauth, rate limiting, fail-closed on money routes
WalletDtop-ups, transfers, payments and holds, refunds, payouts, rewards, subscriptions, marketplace
Identity and credentials
Signed webhooks
LedgerD, ledger of recordappend-only, idempotent, verified, one isolated database per tenant
LedgerD, the ledger of record
Books that cannot silently drift.
A true double-entry engine with integer money, two-phase postings, bitemporal history, and a verifier that re-checks its own invariants on a schedule. It runs as its own service, on its own database. The money paths cannot reach around it.
Two-phase postings
Pending, then post or void, with reservation-bounded posts and TTL enforcement. The consistency primitive behind authorize/capture, holds, and settlement.
Bitemporal history
Each transaction carries a caller-supplied effective date plus an immutable recorded-at. Statements and period closes key on effective time.
Idempotent everything
Every mutation requires an idempotency key and replays byte-identically. A stored-result probe lets a caller safely recover after a lost commit.
Append-only and verified
Append-only triggers plus a serving role that cannot rewrite history. A verifier re-checks conservation, balances, floors and lifecycle every few minutes and fails loudly on drift.
Multi-tenant isolation
One ledger per tenant, physically isolated on its own database and role. A foreign ledger id does not exist as far as the API will ever admit.
WalletD, the money paths
The whole money stack, already built.
Every flow a wallet product needs, each one posting to the ledger and each one idempotent. Fees, holds, caps, and clawbacks are enforced inside the transaction, not bolted on after.
Top-ups
Fund wallets via Stripe (card and hosted checkout). Balance credited only on verified gateway confirmation, never a client callback, with a reconciliation sweep for missed webhooks.
Peer-to-peer
Synchronous wallet-to-wallet transfers within a tenant, by id or alias (handle, phone, email). Velocity caps enforced inside the transaction under ordered locks.
Payments with holds
Single-step capture, or authorize then capture later. Partial capture releases the remainder, holds expire on a TTL, line items must reconcile to the amount, and the platform fee is deducted from settlement.
Refunds
Full or partial, capped at the captured amount, recorded as contra postings rather than ledger rewrites, with proportional fee return and reward clawback.
Rewards and loyalty engine
Rule-based cashback, points accrual, and points-to-cash conversion, evaluated at the moment of capture. Scopes, caps, and campaign windows, with caps enforced concurrency-safe in the ledger.
Subscriptions and dunning
Weekly or monthly billing with structural at-most-once charging per period, dunning retries, and pause, resume, or cancel that re-anchors without catch-up charges.
Marketplace and commission
Onboard merchants, publish offerings to a discovery directory, and split three-level commission, with catalog-authoritative pricing and per-merchant sales summaries.
Payouts
Money out to merchants posts to the ledger first, then produces a settlement statement with an external reference for reconciliation. Semi-closed by design.
Limits and credit lines
Tiered balance and velocity limits checked before the processor is ever called, plus staff-granted credit lines that allow bounded negative balances, every change audited.
Signed webhooks
HMAC-signed events with a replay window and constant-time verification, at-least-once delivery with dedupe ids, and their own worker pool so a slow receiver can never stall a money path.
Platform and operations
Identity, gateway, and operations included.
The pieces you would otherwise assemble yourself, human identity, API credentials, an edge gateway with rate limiting, and an operations console, come with the platform.
Identity and credentials
Keycloak owns every human account; a dedicated credential service issues Argon2id-hashed tenant API keys and short-lived signed user tokens, with live key rotation and a full credential audit stream.
Edge gateway and rate limiting
A hardened API gateway with a distributed rate limiter whose budget holds across replicas, spoofed-identity header stripping, and money-moving routes that fail closed under pressure.
Operations and admin
Tenant provisioning, a ledger summary with the float equation, a tenant-wide transaction explorer, audit logs, and tier or fee-plan configuration, every privileged action recorded.
What is live today, plainly
WalletD is in early access and has not yet carried real customer money. We would rather you knew the exact shape of the product than discover it in a sales call.
- Money-in runs through Stripe (card and hosted checkout). The gateway layer is pluggable, but Stripe is the live rail.
- Wallets are semi-closed: money leaves as merchant payouts, executed today on a manual rail with recorded references. Consumers do not cash out.
- Cross-currency support today is points to cash conversion, not fiat foreign exchange.
- There is no SDK to install. The API is plain HTTP + JSON with a published OpenAPI 3.0.3 spec and worked examples in six languages.
- Rate limiting is currently per-IP. Per-tenant identity propagation is in progress.
The full roadmap to general availability is on the security and trust page.
Early access
Become a design partner.
We are working with a small number of teams building wallet and money products on WalletD. If that is you, let's talk. You will get direct access to the people who built it.