QODY Architecture
Architecture documentation for QODY.ba scan-order-pay platform (SnowIT BA partner project)
Monri Integration
QODY → Monri Integration — Archive Summary
Date: 2026-06-24
Archived by: Skillforge (ALAI Knowledge Management)
Purpose: Consolidate all Monri payment integration materials for QODY project
1. Monri Contact
Account Manager:
- Name: Mahir Mulaomerović
- Phone: +387 66 284 773
- Email: mahir.mulaomerovic@monri.com
SnowIT Contact for Monri:
- Entity: SnowIT d.o.o. Sarajevo
- Contact: Enis Merdžanović (CTO, enis@snowit.ba)
- Business Email: info@snowit.ba
- Phone: +387 62 329 076
2. Monri Response Summary
Date Received: 2026-06-24 (from CEO)
Available Acquirer Banks (BiH):
- Raiffeisen Bank BiH
- Atos Bank
- UniCredit Bank
- Intesa Sanpaolo Bank
Process Confirmed:
- Pick bank → access documentation → test environment → contract → production
- Sandbox available for testing before merchant contract
Packages/Services:
- Standard merchant gateway integration
- Transaction API
- Webhook support
- 3D Secure (3DS2) compliance
3. Architecture Decision
Recommended Model: Model B — Per-Venue Merchant Accounts
Rationale:
- QODY remains software service provider (no Payment Institution license needed)
- Bank-agnostic: each restaurant uses its own bank + Monri merchant account
- Regulatory safety: money flows restaurant-bank → restaurant (bypasses QODY)
- Scalable: parallel restaurant onboarding without platform-level approvals
QODY Platform Fee Collection:
- Monthly invoice: 29-49 KM base + 0.5% of venue revenue through QODY
- Invoiced separately (not deducted from card settlements)
Full Details:
- See
/tmp/qody-prd/monri-architecture-decision.md(25 pages, 667 lines) - Author: Finverge (Markos Zachariadis)
4. Test Environment Form
Status: FILLED — Draft for CEO/Asmir confirmation
File: /tmp/monri/Podaci_za_testno_okruzenje_POPUNJENO.xlsx
Key Data:
- Company: SnowIT d.o.o. Sarajevo
- JIB: 4203069040007
- Contact: Enis Merdžanović (info@snowit.ba, +387 62 329 076)
- Test Bank: Raiffeisen (sandbox)
- Notification Emails: info@snowit.ba, enis@snowit.ba, john@alai.no
Note: Requires CEO/Asmir confirmation of:
- Responsible person (Enis vs Asmir)
- Phone number verification
5. Clarifying Questions Sent to Monri
Status: Sent 2026-06-24
8 Priority Questions:
- Merchant-of-record model (platform vs per-venue) — CRITICAL
- Platform fee auto-deduction support
- Apple Pay / Google Pay availability for BiH
- Refund, void, authorize+capture API operations
- Webhook signatures, retry policy, idempotency
- Test environment access timeline
- Multi-venue reporting / reconciliation
- PCI-DSS SAQ-A confirmation for Monri.js hosted checkout
Full Question Text: See monri-architecture-decision.md §5
6. Next Steps
Immediate (blocking)
- ✓ Fill test environment form (DONE — pending CEO confirmation)
- ⏳ Await Monri test credentials (sandbox merchant_id, auth_token, webhook_secret)
- ⏳ Confirm Model B with BiH payment lawyer (1-hour consult, ~500 EUR)
Build Phase (after test credentials)
- Implement per-venue payment config vault (encrypted Monri credentials)
- Monri Transaction API client (Kotlin/Ktor)
- Webhook handler with signature verification
- E2E test: guest checkout → Monri test charge → staff board update
Pre-Production
- Onboard 2-3 pilot restaurants through Monri merchant application
- Complete PCI-DSS SAQ-A (Securion)
- Privacy policy + Terms (Lexicon)
- BiH fiscal integration research (Phase 2)
7. Archived Files
| File | Description | Size |
|---|---|---|
Podaci_za_testno_okruženje.xls |
Blank Monri test environment form (original) | 35 KB |
Podaci_za_testno_okruzenje_POPUNJENO.xlsx |
Filled form (DRAFT) | 5.8 KB |
monri-architecture-decision.md |
Full architecture analysis + recommendation | 667 lines |
image001.png |
Monri logo (from email) | 8.5 KB |
image002.jpg |
Monri branding (from email) | 17 KB |
8. Compliance Notes
Regulatory:
- Model B avoids BiH Payment Institution (PI) license requirement
- QODY = software service, not payment intermediary
- Legal confirmation still recommended (BiH lawyer)
Security:
- PCI-DSS scope: SAQ-A (Monri.js hosted checkout, no card data on QODY servers)
- Monri credentials: encrypted vault storage (libsodium or Azure Key Vault)
- Webhook: HMAC SHA512 signature verification mandatory
Data Privacy:
- BiH Data Protection Law + GDPR compliance
- Privacy policy required before production launch
- Cookie consent (if analytics)
Fiscal:
- BiH requires fiscal cash registers for retail/hospitality
- Phase 1 (MVP): QODY order = pre-payment; restaurant issues fiscal receipt from POS
- Phase 2: Integrate cloud fiscal service (e.g., eFiskalizacija.ba)
Archive URL: https://docs.alai.no/books/qody-architecture/page/monri-integration
Paperless Archive ID: [will be added after upload]
Document Owner: ALAI Holding AS → SnowIT BA (partner tenant)
Project: QODY.ba — Scan-Order-Pay Platform for BiH Hospitality