3.1 Purpose

Sumsub provides KYC (Know Your Customer) identity verification. This isoperations the onlyapp production-readyactually externalneeds service// withHides realStripe-specific APIimplementation calls.

Verification// checks:

testing
• Document authenticityeasier (passport,injectable, IDmockable) card,async driver'screatePaymentIntent(amount: license,number, residencecurrency: permit)
string):
• Liveness check (selfie is a real person)
• Face match (selfie matches document photo)
• Sanctions check (not on international sanctions lists)
• PEP check (not a politically exposed person)

3.2 Integration Architecture

User app (web/mobile)
  │
  ├── 1. GET /api/kyc/initiate → server calls Sumsub createApplicant + getAccessToken
  │                               returnsPromise<PaymentIntent> { token... }
for WebSDK
  │
  ├── 2. Frontend loads Sumsub WebSDK with token
  │       User submits documents + selfie via Sumsub UI
  │
  └── 3. Sumsub webhook → POST /api/kyc/webhook
          Server updates user.kyc_status = 'approved' | 'rejected'}

3.3

---

Key

4. Functions

3.4

Mock Applicantsetup Status Flow

init// →__mocks__/@sendgrid/mail.ts
pendingconst →sendMock queued= →jest.fn().mockResolvedValue([{ completedstatusCode: →202 (reviewAnswer:}]);
GREEN=approvedexport default { send: sendMock, setApiKey: jest.fn() };

/ RED=rejected / RETRY)In tests
import sgMail from '@sendgrid/mail';
expect(sgMail.send).toHaveBeenCalledWith(expect.objectContaining({
  templateId: 'd-XXXXX',
}));

Test mode credentials location: .env.test (gitignored) — see onboarding guide.

5. Vendor Lock-In Assessment

3.5

Mitigation Environmentstrategy: Variables

3.6 Mock Mode

When NEXT_PUBLIC_SERVICE_MODE=mock:

• 90% approval rate, 10% rejection
• 3-second simulated delay
• Risk score: 15 (approved) or 85 (rejected)
• Rejected label: DOCUMENT_UNREADABLE, type: RETRY

3.7 Error Handling

4. Open Banking — AISP + PISP (Provider TBD)

4.1 Purpose

• AISP (Account Information): Read user's bank balance from their Norwegian bank account
• PISP (Payment Initiation): Initiate transfers directly from user's bank account

This is Drop's core PSD2 architecture — users' funds never move into Drop's control.

4.2 Current State

4.3 Planned Integration Architecture

User initiates payment
  │
  ├── 1. AISP: Refresh balance from bank → update bank_accounts.balance
  ├── 2. PISP: Initiate payment at provider → returns payment_id
  ├── 3. User bank sends consent redirect if needed
  ├── 4. Provider webhook: payment settled → update transaction.status
  └── 5. Notify user

4.4 Required Environment Variables (Future)

4.5 Supported Banks (Target)

Norwegian banks supporting PSD2 (via Open Banking provider):

• DNB
• Nordea
• Handelsbanken
• SpareBank 1
• Sbanken / DNB (merged)

5. Slack — Operational Alerting

5.1 Purpose

Slack receives operational alerts from Drop's internal alerting system (src/lib/alerts.ts).

Channel: #drop-ops on alai-talk.slack.com

5.2 Alert Types

5.3 Integration Details

5.4 Environment Variables

5.5 Alert Format

🚨 Drop Production Alert — Critical

Title: Error spike detected
Message: 8 errors in the last 60 seconds

Time: 2026-02-23 14:30 UTC

6. BetterStackMigration —Plan External(Switching Uptime MonitoringProviders)

6.1Stripe Purpose→ Alternative Payment Provider

BetterStackTrigger providesconditions: externalPricing uptimeincrease monitoring> independent30%, ofreliability Drop's< infrastructure99.9%, —compliance detects total infrastructure failures that internal health checks miss.issues.

6.2

Migration Monitorssteps:

Configured

1. Select
alternative(Adyen,Braintree,etc.)andobtaintestcredentials
2. Implement
adapterbehindflag
3. Test
paymentflow
4. Migrate
tonew

Monitor	URL	Check
Health Endpoint	https://drop.alai.no/api/health	HTTP 200 +new "status":"ok"PaymentService
Landingfeature Page	https://drop.alai.no	HTTPin 200staging +with Sendfull penger
USnew Eastcustomers Health	https://drop.alai.no/api/health	HTTPprovider 200 Migrate fromexisting USsubscription East

6.3 Alert Escalation

Minute 0:   DOWN → Slack #drop-ops
Minute 5:   Still down → Email [email protected]
Minute 15:  Still down → SMS +47 40 47 42 51customers (requires paidcustomer plan)consent 

in

6.4some Statusjurisdictions) Page

5. Deprecate

   PublicStripe status page: https://drop-status.betteruptime.com

   Setup guide: docs/infrastructure/BETTERSTACK-SETUP.md

   ---

   7. Deprecated Services

   Swan Open Bankingintegration (Deprecated)

   keep webhooks active until all subscriptions migrated)

Status: DEPRECATED — no longer the planned Open Banking provider. Mock code exists at services/mock-swan.ts but will be removed.

Why deprecated: Commercial and technical reasons — specific provider TBD via procurement process.

Stripe Issuing (Mock/Dev — Future)

Status: MOCK ONLY — no Stripe SDK installed. File: services/mock-stripe.ts.

Purpose: Future card issuance feature (virtual + physical cards). All card feature flags defaultData to false. Requires card issuing partner before activation.

Not to be confused with:migrate: StripeCustomer Payments — Drop does NOT use Stripe for payments.

8. Service Initialization

Source: src/lib/services/index.ts

// Called once on app startup
await initializeServices();

// In tests — reset all mock state
resetMockServices();

Mock state uses in-memory storageIDs (server-side)map —old resets→ onnew), processsubscription restart.IDs.

Related Documents

• Backend Architecture
• Authentication Source
• Services Source
• BetterStack Setup

Approval