Pehmen Integration Architecture

Pehmen Integration Architecture An architecture diagram generated by Archify. Merchant systems · Dashboard and API clients · Architecture component Merchant systems Dashboard and API clients Secure API edge · TLS and request controls · Pehmen managed service Secure API edge TLS and request controls Operator dashboard · Interactive workflows · Pehmen managed service Operator dashboard Interactive workflows Pehmen control plane · Auth, validation and orchestration · Pehmen managed service Pehmen control plane Auth, validation and orchestration Decision services · Policy, trust and routing · Pehmen managed service Decision services Policy, trust and routing Provider adapters · Isolated asynchronous dispatch · Pehmen managed service Provider adapters Isolated asynchronous dispatch Payment providers · Licensed external services · Architecture component Payment providers Licensed external services Durable records · Tenant-scoped state and audit · Pehmen managed service › Isolated data layer Durable records Tenant-scoped state and audit Protected evidence · Encrypted payloads and files · Pehmen managed service › Isolated data layer Protected evidence Encrypted payloads and files Key management · Separated service identities · Separated key-management boundary Key management Separated service identities Merchant endpoints · Signed webhook receivers · Architecture component Merchant endpoints Signed webhook receivers HTTPS authenticated requests session requests evaluate approved instruction provider API verified outcome transactional state encrypt and sign encrypted objects signed events Pehmen managed service Isolated data layer Separated key-management boundary Legend Frontend Backend Database Cloud Security External

Integration boundary

  • • Merchant systems use the documented HTTPS API
  • • Provider outcomes are delivered as signed webhook events

Data protection

  • • Sensitive credentials and payloads are encrypted
  • • Key capabilities are separated from application storage

Isolation

  • • Every request is authorized for one workspace and environment
  • • Data services are not exposed as public integration endpoints