Case studyNeuroMind

A loan platform built for bank-grade security.

How NeuroMind modernised the loan management platform it runs for a major bank on AWS: secure by design, PCI-DSS aligned and quicker to release.

Industry
FinTech, loan management
We built
A secure container platform
Runs on
Amazon ECS on AWS Fargate

~60%

Shorter deployment time

New CI/CD pipeline

PCI-DSS

Aligned platform

Banking compliance

Multi-AZ

High availability

ECS and DocumentDB

The challenge

Growth outpaced the legacy platform.

NeuroMind builds applications for large enterprises, including a loan management platform for a major bank. As usage grew, its legacy infrastructure held back the speed and security the platform needed. It had to scale without compromising the data security and compliance banking requires.

What we built

Secure by design, from network to data.

Assembly designed the platform on the AWS Well-Architected Framework, planned the move with the AWS Cloud Adoption Framework and built it in AWS CDK, across multiple accounts and environments.

What we delivered

Multi-account foundation

Separate accounts, environments and clusters, governed with AWS Control Tower.

Public, private and secure clusters

Services run on Amazon ECS with AWS Fargate in isolated VPC networks with tight security groups and NACLs.

Protected loan data

Multi-AZ Amazon DocumentDB, encryption throughout, and secrets in Parameter Store with AWS KMS.

Faster, safer releases

A GitHub Actions pipeline with ECS batch deployments rolls updates out step by step.

01 / 04

Built in

Compliance monitoring

Amazon GuardDuty and AWS Security Hub check the platform continuously, AWS WAF protects public endpoints, and regular security assessments find and fix vulnerabilities.

  • Amazon GuardDuty
  • AWS Security Hub
  • AWS WAF

Powered by AWS

Secure from request to record.

  • Protected at the edge. AWS WAF screens public endpoints, and an Application Load Balancer routes traffic to healthy tasks.
  • Isolated by design. Services run on Amazon ECS with AWS Fargate in public, private and secure clusters inside the VPC.
  • Data that fails over. Amazon DocumentDB runs Multi-AZ, and every service spreads across Availability Zones.
  • Secrets kept safe. Parameter Store with AWS KMS holds secrets, and data is encrypted in transit and at rest.
  • Watched continuously. Amazon GuardDuty and AWS Security Hub monitor threats and compliance across the accounts.
Powered by AWS

High-level architecture

NeuroMind on AWS

How NeuroMind runs on AWSHigh-level AWS architecture for NeuroMind. Users reach the platform through Amazon Route 53 and an Application Load Balancer, which sends traffic to healthy tasks of loan platform services on Amazon ECS with AWS Fargate, inside an Amazon VPC. The services use Amazon DocumentDB and Amazon S3, and send metrics and logs to Amazon CloudWatch. GitHub Actions builds each change and rolls it out with ECS batch deployments. Amazon GuardDuty, AWS Security Hub, AWS WAF and AWS KMS secure it, across accounts governed with AWS Control Tower.AWS CLOUD · MULTI-ACCOUNT, AWS CONTROL TOWERAMAZON VPC · MULTI-AZRequestsResolveHealthy tasksRead and writeFilesMetrics, logsECS batch deploymentsUsersLoan managementAmazon Route 53DNSElastic Load BalancingApplication Load BalancerLoan platform servicesPublic, private, secure clustersAmazon ECS on AWS FargateAmazon DocumentDBMulti-AZAmazon S3Object storageAmazon CloudWatchMetrics and logsGitHub ActionsCI/CD pipelineSECURED WITHAmazon GuardDutyThreat detectionAWS Security HubCompliance checksAWS WAFWeb protectionAWS KMSEncryption keys
Simplified view. Arrows follow one request through the platform, then one release from the pipeline.

Key results

Faster releases, bank-grade controls.

Delivery

~60%

Shorter deployment time

The new CI/CD pipeline and ECS batch deployments release updates quicker, with minimal impact on availability.

Compliance

PCI-DSS

Aligned platform

Encryption, isolation and continuous monitoring keep the platform in line with banking requirements.

Availability

Multi-AZ

Uninterrupted service

Health checks route around failures, failed tasks restart, and scaling follows CPU, memory and demand.

Our certified expertise

AWS Partner, Advanced Tier ServicesAWS Partner, Well-Architected Partner Program
AWS Certified Generative AI Developer – ProfessionalAWS Certified Machine Learning Engineer – AssociateAWS Certified Solutions Architect – ProfessionalAWS Certified AI Practitioner

AWS Advanced Tier Services Partner and Well-Architected Partner Program. All 12 current AWS Certifications are held by our team.

Want results like these on AWS?

We modernise and scale platforms on AWS, from assessment to production. Book a call and bring your platform.

Book a discovery call