Rebuilding OK2Pay's Deployment Pipeline: Modern CI/CD for a Mission-Critical Payments Platform
Satori is the leading specialists in providing automated financial monitoring solutions, across Australia and New Zealand.
The Client
Satori Group has spent more than 20 years helping Australia and New Zealand’s largest organisations monitor financial transactions, prevent leakage, detect fraud, and bring automation to the finance function. Their platform monitors over $22 billion in transactions every year across 200+ long-term clients, and saves each customer an average of $5 million annually in losses through errors or fraud.
Satori’s product suite includes Verify, their automated procure-to-pay transaction monitoring platform, and OK2Pay, a market-leading bank account verification solution that confirms every payment is going to the right person. OK2Pay sits at the front line of one of Australia’s fastest-growing fraud categories: payment redirection scams cost Australian businesses over $152 million in 2024 alone, a 67% jump year-on-year. The product integrates with Confirmation of Payee data from Australian banks, the Australian Business Register, and partner platforms like Zepto Validate, and is the only verification solution with direct access to CBA’s NameCheck technology.
When the platform you run sits between organisations and their payment runs, the cost of a bad deployment isn’t an outage, it’s a fraud window. Engineering velocity matters, but it can’t come at the expense of control.
The Challenge
Satori engaged us to assist with rebuilding and modernising the CI/CD configuration for OK2Pay, with a specific outcome in mind: a new environment, provisioned cleanly and repeatably, that the engineering team could use with confidence and replicate as the product roadmap demanded.
The existing infrastructure-as-code estate had grown out of step with the pace of the product. The original build sat on an older toolchain and CI platform combination that no longer reflected how the team wanted to work, version drift had accumulated, the deployment process had become unreliable, and the cost of pushing changes through it was higher than it should have been. The engineering team had already made a clear strategic call: they wanted to standardise on Azure DevOps for pipelines and AWS CloudFormation for infrastructure-as-code, aligning with their broader tooling stack and the skill sets in the team.
The brief was straightforward in intent but substantial in execution: rebuild the OK2Pay infrastructure layer from scratch using their preferred toolchain, deliver pipelines that gave engineers the confidence to deploy frequently, and design the whole thing so that standing up additional environments became a parameterised, low-effort exercise rather than a project in itself.
The Approach
We rebuilt the OK2Pay infrastructure layer cleanly in CloudFormation, orchestrated through Sceptre and deployed via Azure DevOps pipelines, a combination that gave Satori a modern, modular, environment-aware deployment story without forcing them off their chosen platforms.
Modular CloudFormation, orchestrated by Sceptre. Rather than monolithic templates, the infrastructure was split into focused, independently deployable stacks: a three-tier VPC, ACM certificates, RDS databases, ECS clusters and services, frontend CloudFront distributions, DynamoDB, CloudFront Functions, and SSM parameter management. Sceptre handles stack dependencies and output resolution automatically, so the ECS stack picks up the VPC’s subnet IDs and security groups without anyone hand-wiring outputs between templates.
Environment-as-config, not environment-as-code. Each environment lives in its own configuration directory with environment-specific YAML values feeding into shared CloudFormation templates. Standing up a new environment is a matter of cloning the config directory, adjusting parameters, and running the deploy pipeline, no template duplication, no copy-paste drift, no per-environment forks of the same logic.
A pipeline for every stack, plus orchestrated deploys. Azure DevOps pipelines were built for each individual stack (VPC, ACM, RDS, ECS, frontends, SSM parameters, CloudFront Functions) and for full-environment deploy and destroy operations. This gives the team granularity when they need it, redeploying just the ECS service, or just the frontend, and a single-button option when they want to stand up or tear down an entire environment.
Containerised application delivery. Backend services run on ECS, pulling container images from a shared services account with cross-account ECR permissions configured cleanly. The pattern lets Satori maintain a single source of truth for built images while deploying them across multiple isolated environments.
Secrets and configuration handled the right way. Sensitive credentials are stored in AWS Systems Manager Parameter Store and retrieved at runtime by the ECS tasks, nothing sensitive ever lands in a repository or a pipeline variable. Non-sensitive application configuration is also managed through SSM, deployed via CloudFormation, so every parameter an environment needs is reproducible from code.
TLS everywhere via ACM. Certificate provisioning and validation are part of the deployment workflow itself, issued and managed through AWS Certificate Manager rather than handled as a separate manual step.
Database refresh built into the design. RDS stacks were designed to support snapshot-based provisioning, so refreshing a lower environment from a known-good snapshot is a straightforward, repeatable operation rather than a bespoke exercise.
Approval gates where they matter. Pipelines incorporate the appropriate manual approval steps for higher-impact actions, giving the team control over what gets deployed and when without compromising the speed of routine changes.
The Outcome
A clean, modern foundation for OK2Pay deployments. The new infrastructure layer is built entirely in CloudFormation, orchestrated by Sceptre, and deployed through Azure DevOps, fully aligned with the team’s preferred toolchain and the way they want to work going forward.
New environments are now a configuration exercise. What was previously a substantial undertaking is now a parameterised deploy. The engineering team can spin up additional environments, for testing, for client-specific work, for feature branches at scale, without re-engineering the foundations each time.
Granular and full-stack deploys, both supported. The pipeline design gives engineers the choice: deploy a single stack when iterating quickly, or deploy the full environment when standing something up from scratch. The same is true for teardown, which matters for cost control in non-production environments.
Secrets, configuration, and certificates all handled in code. No hand-jamming credentials into pipelines, no manual certificate uploads, no “where did this parameter come from” archaeology. Everything an environment needs to exist is captured in the repository.
A team in control of their own platform. The pipelines, templates, and configuration patterns belong to Satori. They can extend them, fork them, replicate them across products, and as OK2Pay continues to evolve, the foundation underneath it can keep pace.
Why It Mattered
OK2Pay is the kind of product where deployment confidence translates directly into commercial outcomes. Satori’s customers rely on the platform to verify payments in real-time and stop fraud before money leaves their accounts, a function that has become essential as payment redirection scams continue their double-digit annual growth. Every improvement Satori ships to OK2Pay, new bank integrations, enhanced verification logic, partner platform connections, needs to land in production cleanly and predictably.
A modern, modular, well-instrumented deployment pipeline isn’t a back-office concern for a product like this. It’s part of how Satori delivers on its promise to customers: that every transaction monitored, and every payee verified, runs on infrastructure they can trust.
That’s the foundation we set out to build, and the one that’s now in their hands.
The Results
- Modern infrastructure-as-code foundation built in AWS CloudFormation.
- New environments stood up through configuration, not custom builds.
- Granular and full-stack deploys, both supported through Azure DevOps.
- Secrets, configuration, and certificates all managed in code.
- Built-in database refresh and approval gates where they matter.
- A self-sufficient team in control of their deployment pipeline.
The technology that we use to support Satori Group
Ready to modernise the pipeline behind your platform?
See More Case Studies
