Architecture
Six layers, one body
Accounting, reporting, identity verification and CRM are all inside one solution — no integration patchwork. Auditability is not a feature; it is the architecture itself.
Capability matrix
Which surface touches which module?
Nine module groups, four surfaces. The operations console, the portal and the partner surface are role-based views of the same core; the open API sits under all of them.
| Module group | Ordo Operations | Ordo Portal | Ordo Partner | Open API |
|---|---|---|---|---|
| Acquisitioncrm · kyc · party · compliance | the surface runs the operation | the surface runs the operation | — | the surface runs the operation |
| Catalogue and calculationcatalog · calc · rule-engine | the surface runs the operation | reads the derived state | — | the surface runs the operation |
| Contractcontract | the surface runs the operation | the surface runs the operation | — | the surface runs the operation |
| Collections and poolcollections · pool · accounting | the surface runs the operation | the surface runs the operation | — | the surface runs the operation |
| Treasury, allocation, lotterytreasury · allocation · lottery | the surface runs the operation | reads the derived state | — | the surface runs the operation |
| Deliverydelivery | the surface runs the operation | — | the surface runs the operation | the surface runs the operation |
| Exits and delinquencyexit · dunning · tasks | the surface runs the operation | — | — | the surface runs the operation |
| Reporting and end of dayreporting · eod · audit | the surface runs the operation | — | — | the surface runs the operation |
| Platformbranding · identity · studio | the surface runs the operation | reads the derived state | reads the derived state | the surface runs the operation |
the surface runs the operationreads the derived state
Event ledger
The audit trail is not a log — it is the data itself
Savings-finance contracts live longer than a decade; the classic “update the record” architecture collapses in year three. In Ordo nothing is overwritten: events are appended, state is derived. The state as of any past date can be reproduced; corrections are reversal entries only.
The pool invariant is verified at accounting level on every event — a record that breaks it is refused by the ledger:
pool cash = savings liability − financing receivable
Rule engine
A regulatory change is a configuration task, not a development request
Tariffs, fees, penalties and regulatory rules are managed as effective-dated, versioned rule sets. When a rule changes, new contracts bind to the new version; existing contracts keep living on their own.
A regulatory change goes live as a rule package — the same day, without waiting for a release.
Lifecycle
Seven states, a rule that gates each one
From acquisition to exits every state transition belongs to a module, writes its own events to the ledger and is gated by a rule — a regulation article or a message code. Click through the states.
01Acquisition
- Modules
- crm · kyc · party · compliance
- Events written to the ledger
- LeadCreated · KycSessionStarted · KycResultRecordedKycPartyLinked · PartyRegistered · ScreeningPerformed
The rule that gates this state
A sanctions-screening hit opens a compliance-review task; the identity-verification provider is a port. The related-party and risk-group record feeds two checks at establishment: the ban on contracts with insiders and the risk-group limit relative to equity.
BasisMADDE 22/AMSG-S-57
Product factory
A new product is not a project
Every product parameter is defined on screen; a sample plan is generated automatically and the product’s effect on the pool balance is simulated before it goes live.
- Parameters defined on screen
- Term · Amount · Down payment · Fees · Delivery condition · Draw rule · Ranking score · Indexation
A product cannot be sent for approval before its effect on capacity is visible.
Process automation
Seven processes, zero manual work
The repetitive load of operations is automated in the core.
People stay only where they decide: exceptions, approvals, negotiation.
- 01Payment matching
- 02Payment component split
- 03Journal entry generation
- 04End-of-day reconciliation
- 05Staged delinquency actions
- 06Regulatory report generation
- 07Delivery queue and quota management
Atomic disbursement
Five postings, one transaction
On disbursement five postings are written in one unit of work.
- 01Pool outflow
- 02Journal entry
- 03Repayment plan
- 04Collateral record
- 05Customer notification
If one fails, none is written.
Edge and core
AI at the edge, a deterministic core
AI runs at the edge, where perception has to be fast: face scan, document verification and fraud checks, risk score, anomaly detection — in 100–300 milliseconds. In the core, where the money lives, there is no AI: pool ledger, lottery and accounting are entirely rule- and process-based.
A score is a signal, not a decision
- 01The score is never shown to the customer.
- 02It can never be the sole ground for termination, refusal or restriction of a right.
- 03The top three factors are shown for explainability.
- 04The model version is recorded and can be queried retrospectively.
- 05Score-driven actions are limited to information and offers.
Channels
One calculation service, five channels
Installment, savings, ranking and capacity live in one calculation service. All five channels produce the same result — there is no “different number” between channels.
Mobile · Web · Branch · Call centre · Partner
White-label on mobile
The mobile apps are built per brand from a shared code base and published on the App Store, Google Play and AppGallery.
Brand customisation never forks the code.
Low-code studio
Independence, with its boundary
The institution’s own team changes screens, flows and reports; the areas that touch regulation and financial integrity are explicitly fenced off. Who may change what is never left to guesswork.
Decision support
Capacity lives in the core, not in a spreadsheet
The treasury derives capacity from the pool balance and the coverage ratio in the rule set; the draw quota is derived from that figure.
- 01Projections of collections, deliveries, repayments and termination refunds
- 02Deficit periods flagged in advance
- 03Stress scenarios compared against actuals
- 04Sales target versus capacity mismatch warnings
The treasury produces the capacity; the draw quota is derived from it. Two screens cannot show different numbers.
Open API
Not a black box — a platform to build on
The open service layer is versioned per consumer (v1.1 / v1.2 / vNext) and ships with a sandbox. Every official and financial integration is separated from the core through abstracted adapters.
- Official sourcesKPS · KKB · TAKBİS · TNB e-pledge · GİB · MASAK · BDDK
- Signature and serviceKEP · e-signature
- FinancialBank collections · Virtual POS · Valuation and insurance
The partner portal works on a minimum-data principle: every partner sees only the files assigned to it and the minimum customer data.
Data ownership
Your data is always yours
- ExportAll data can be exported at any time as CSV, Parquet, PDF-ZIP or JSON. Leaving the platform is an export, not a negotiation.
- Shadow runDuring migration the new system runs in parallel with the old one; results are compared through a difference report.
- Four reconciliation pointsContract count, pool balance, customer savings and queue seniority — all four must reconcile exactly at migration.
- Rollback planEvery migration has a defined rollback plan and a ready acceptance-test package; go-live does not happen before the difference report is clean.