CASE 01 · Banking & paymentsGateway estate migrated with zero consumer impact
The challenge. A European retail bank had to exit a sunsetting API gateway platform — hundreds of proxies, regulated payment flows, partner integrations, and a hard licence deadline. Consumers could not be asked to change a single line.
What we did. Proxy-by-proxy re-platforming on the SBR Fabric: behavioural parity proven by replaying captured production traffic against the new platform before each cutover; shared-flow fault-handling and logging patterns standardised; HSM-backed mTLS rebuilt correctly on the target; 100% automated CI/CD from day one.
0
consumer-facing incidents across the migration
100%
of changes shipped through automated pipelines
→
platform exit completed ahead of the licence deadline
Intermittent signature failures traced and eliminated
The challenge. A payments platform saw 5–6% of authorisation calls fail HMAC verification — intermittently, untraceably, and at real revenue cost. Two vendors had looked; neither owned the seam between the signing service and the verifying gateway.
What we did. One team, both sides of the seam: byte-level comparison of signed and verified payloads isolated a character-encoding divergence between serialisation layers; the fix was three lines, the diagnostic framework reusable. Runtime detection then tuned to catch any recurrence.
100%
verification success after fix
3
lines of code — once the right team looked
↘
a reusable byte-level diagnostic left with the client
GenAI from slideware to governed production service
The challenge. An industrial group had GenAI ambition, a nervous risk committee, and the EU AI Act on the horizon. Two pilots had stalled at the demo stage — no guardrails, no evaluation, no governance story to take to the board.
What we did. RAG over the group's own knowledge with evaluation harnesses and guardrails; LLM red-teaming against the OWASP Top 10 for LLM Applications; model inventory and risk classification aligned to the EU AI Act; the existing gateway and identity controls extended to model traffic.
1
governed AI service in production, monitored 24/7
OWASP
LLM Top 10 red-teamed before launch
✓
AI-Act-ready documentation accepted by risk