Industries · Financial services
Technology for banks, fintechs and insurers in Saudi Arabia
A financial-services technology team is judged on two things customers notice at once: whether the code or alert arrives, and whether the service stays up. Interkey works on the layers behind both: passcodes and alerts over SMS with fraud protection built in, production monitoring as an official Datadog partner, API gateways that can run inside the Kingdom, and database changes that reach production through checks and a rehearsed rollback. Interkey holds ISO/IEC 27001:2022 and ISO 9001:2015 certificates and delivers from Riyadh.
Published 4 min read
In short
- Customer codes and alerts: OTP and account alerts over SMS from one platform, with fraud protection, country blocking, spending limits and a delivery receipt for each message.
- Production monitoring: Datadog implemented and operated by Interkey, an official Datadog partner.
- APIs: Kong Gateway, self-managed inside the Kingdom or in a hybrid deployment.
- Database changes: from version control through a pipeline with checks, with a rehearsed rollback.
- Certificates: ISO/IEC 27001:2022 and ISO 9001:2015, certifying body AQC.
01 The question a financial-services team asks first
Will the customer get the code, and will we know that something has broken before the customer calls us? Behind that question sit four layers that often come from different suppliers and fail in different places: the messages sent to customers, the monitoring of production systems, the gateway in front of the APIs, and the way database changes are released. This page shows what Interkey provides on each layer and where to read more.
02 The four layers, and what Interkey provides on each
| Layer | What Interkey provides | Read more |
|---|---|---|
| Customer codes and alerts | Interkey Digital Connect: one-time passcodes, account alerts and notifications over SMS from one platform, with fraud protection, country blocking and spending limits; REST API, SOAP for established systems, or SMPP for high-volume SMS | Interkey Digital Connect |
| Production monitoring | Datadog implementation and operation by Interkey: instrumentation, dashboards, alerting, synthetic tests and real-user monitoring, and log-cost control | Datadog implementation |
| API gateway | Kong Gateway implemented and operated by Interkey, self-managed inside the Kingdom or in a hybrid deployment, with policies kept as configuration | Kong implementation and operations |
| Database changes | Redgate tooling implemented so database changes ship from version control through a pipeline with checks before deployment, and a rehearsed rollback | Database DevOps |
03 The capabilities behind the table
Codes and alerts customers can rely on
Digital Connect sends passcodes and account alerts over SMS from one platform, with a delivery receipt for each message. Fraud protection, country blocking and spending limits on the account limit the damage if a sign-up or login screen is abused. Platform users sign in with two-factor authentication, using a verification code sent by email, at admin or user permission level, and API access can be restricted to approved IP addresses or a VPN connection. Message templates are approved by the customer and by Interkey, and SMS sender registration with the regulator and operators is handled during onboarding.
Read more
Monitoring the services customers use
As an official Datadog partner, Interkey instruments applications and infrastructure, builds the dashboards and alerts an on-call team works from, sets up synthetic tests and real-user monitoring, reviews telemetry for personal data that should be masked, controls log costs, and can operate the setup after go-live. Where telemetry data is stored is a design decision to settle early; the data residency guide explains the options.
APIs exposed to partners and channels
Interkey implements and operates Kong Gateway either self-managed inside the Kingdom or in a hybrid deployment. Gateway policies are kept as configuration, and the gateway can run as ingress on Kubernetes.
Database changes with a way back
Interkey implements Redgate tooling so that every database change comes from version control, passes checks in a pipeline before deployment, and has a rollback that has been rehearsed. Interkey also runs Couchbase migration and implementation projects.
04 Questions to put to any supplier for these layers
| Layer | Questions worth asking |
|---|---|
| Customer codes and alerts | Can we see a delivery receipt for each message? Can we block countries we do not serve and set a spending limit? Who registers our SMS sender name, and when? Who approves our message templates? Can API access be limited to our IP addresses? |
| Production monitoring | Who builds and maintains the alerts after go-live? Where will telemetry data be stored? Is personal data masked before it leaves our systems? How are log costs controlled as volume grows? |
| API gateway | Can the gateway run on infrastructure inside the Kingdom? Are policies kept as reviewable configuration? Who operates it after launch? |
| Database changes | Does every change come from version control? What checks run before deployment? Has the rollback been rehearsed, and how? |
| Supplier | Which certificates do you hold, issued by whom and valid to when? Can you arrange a reference in our sector? |
05 How a programme is scoped with Interkey
-
Start with how you run today.
Map the current systems, suppliers and the incidents that matter most.
-
Design the right path.
Choose the layers to change first and how each will be deployed.
-
Build it and connect it.
Implement and integrate with the systems already in place.
-
Hand it over properly.
Leave the runbooks and knowledge with your team.
-
Keep it running.
Operate it from Riyadh, or support your team as it does.
Solutions for this sector
06 What buyers ask us
Is Interkey ISO/IEC 27001 certified?
Yes. Interkey holds ISO/IEC 27001:2022 and ISO 9001:2015 certificates; the certifying body is AQC, and both are valid to 12 February 2029. Certifications and company registration
Can the API gateway run inside the Kingdom?
Yes. Interkey implements Kong Gateway self-managed inside the Kingdom, or in a hybrid deployment if that suits your architecture.
Can we stop passcodes going to countries we do not serve?
Yes. Digital Connect has country blocking and spending limits on the account, alongside fraud protection, and a delivery receipt for each message.
Can you provide a reference from a bank or fintech?
A reference in your sector can be arranged on request, with the agreement of the organisation concerned.
Who operates the systems after go-live?
Interkey can operate them from Riyadh, or hand them over to your team with runbooks.
Next
Read next for this sector
Next step
Start with the layer that hurts most
Tell us which layer is causing the most trouble today: codes and alerts, monitoring, APIs or database releases. We will reply with how we would approach it and who on our team would work on it.
Or directly
+966-11-2180999 [email protected]Tawuniya Towers, North Tower, 7th Floor, King Fahad Highway, Olaya, P.O. Box 56835, Riyadh 11564, Saudi Arabia