Certifique a sus proveedores sin abrir su banco.

Replicamos sus APIs, su seguridad y sus reglas en un entorno aislado en Google Cloud. Sus proveedores se integran y se certifican contra esa réplica. Su equipo de IT y seguridad no abre accesos ni presta ambientes: recibe el expediente listo para aprobar el paso a producción.

Cada proveedor nuevo le cuesta a su banco semanas de trabajo que no son su negocio.

  • Abrir VPN, reglas de firewall, credenciales y usuarios de prueba para cada proveedor.
  • Un ambiente de QA compartido que se cae o que ya no se parece a producción.
  • Equipos de IT y seguridad acompañando pruebas ajenas en lugar de sus propios proyectos.
  • Cada acceso abierto es una superficie más que vigilar y auditar.
  • Semanas esperando accesos antes de enviar la primera petición.
  • No puede provocar los casos difíciles: fondos insuficientes, OTP errado, timeouts, webhooks caídos.
  • Si el ambiente del banco falla, su proyecto se detiene.
  • Llega a producción con casos que nunca probó.

Un gemelo de su banco, operado por nosotros.

Construimos una réplica fiel de sus servicios a partir de su documentación. Para el proveedor es indistinguible de su banco. Para su banco no existe: no hay ningún cable entre los dos.

  • El mismo contrato: Endpoints, campos, códigos y formatos idénticos a su documentación, con sus particularidades: decimales con coma, monedas, referencias y estados propios.
  • La misma seguridad: OAuth2 con permisos por comercio, mensajes cifrados, firmas HMAC o JWT y OTP. El proveedor implementa lo que su banco exige, no una versión simplificada.
  • Webhooks de verdad: Notificaciones firmadas con reintentos y espera exponencial, cola de fallidos y reenvío manual.
  • Cada caso, a pedido: Valores de prueba que fuerzan cada resultado sin tocar configuración: aprobado, fondos insuficientes, cuenta bloqueada, sobre el límite, OTP requerido, pendiente.
  • Fallas controladas: Latencia, errores y caída del servicio a demanda, para comprobar que el proveedor se recupera sin cobrar dos veces.
  • Evidencia sin esfuerzo: Cada petición y respuesta queda registrada, descifrada y auditada. El expediente de certificación se arma con esos registros.

Usted participa en dos pasos de seis.

  1. Levantamiento: Nos comparte la documentación de sus APIs y un contacto técnico. Definimos alcance, casos obligatorios y calendario.
  2. Réplica: Construimos el gemelo: contrato, seguridad, códigos de respuesta y particularidades de su banco.
  3. Sandbox en Google Cloud: Proyecto dedicado y aislado, con dominio, certificados TLS, monitoreo y panel de control.
  4. Atención a proveedores: Credenciales, guía de integración y soporte técnico para cada proveedor que usted nos refiera.
  5. Certificación: Ejecutamos la matriz de casos y documentamos cada resultado con evidencia reproducible.
  6. Aprobación: Recibe el expediente y decide el paso a producción.

Ya operamos gemelos de cuatro rieles de pago.

  • Banco Activo: OAuth2 con permisos por comercio. Cobro Pago Móvil (C2P) con OTP, débito inmediato, consultas de movimientos y webhook de transacciones.
  • Banco Venezolano de Crédito: Mensajes cifrados AES, flujos síncronos y asíncronos. 15 servicios: Pago Móvil C2P, reverso y verificación, vuelto, débito con token, créditos y débitos inmediatos, transferencias, saldo y movimientos.
  • R4 Conecta: Firma HMAC por comercio y consultas con JWT. Cobros del comercio, notificaciones al cliente por webhook y consulta de operaciones.
  • Core transaccional genérico: Contrato propio con clave de sandbox. Alta de comercio, cobros, tarjeta, débito, crédito, vuelto y consultas. Sirve para probar sin cuenta en un banco real y es la base para modelar el core de su banco.

Simuladores construidos a partir de la documentación de integración de cada entidad. No procesan dinero real ni se conectan a los bancos. Las marcas pertenecen a sus titulares.

Para quién es

  • Bancos: Que integran fintech, procesadores y comercios y no quieren abrir su red para cada prueba.
  • Fintech y PSP: Que necesitan integrarse con varios bancos y llegar a la certificación con todo probado.
  • Procesadores y adquirentes: Que conectan comercios a varios rieles de pago y necesitan pruebas de regresión estables.
  • Casas de software y ERP: Que integran cobros bancarios en sus productos y deben certificarse con cada banco.

Certify your vendors without opening up your bank.

We replicate your APIs, security and business rules in an isolated Google Cloud environment. Your vendors integrate and certify against that replica. Your IT and security teams open no access and lend no environments: they get the evidence file, ready to approve go-live.

Every new vendor costs your bank weeks of work that isn't your business.

  • Opening VPNs, firewall rules, credentials and test users for every vendor.
  • A shared QA environment that goes down or no longer matches production.
  • IT and security teams babysitting someone else's tests instead of their own projects.
  • Every access you open is one more surface to watch and audit.
  • Weeks waiting for access before sending the first request.
  • No way to trigger the hard cases: insufficient funds, wrong OTP, timeouts, failed webhooks.
  • When the bank's environment fails, the project stops.
  • It reaches production with cases it never tested.

A twin of your bank, run by us.

We build a faithful replica of your services from your documentation. To the vendor it's indistinguishable from your bank. To your bank it doesn't exist: there's no wire between them.

  • The same contract: Endpoints, fields, codes and formats identical to your docs, quirks included: decimal commas, currencies, your own references and statuses.
  • The same security: OAuth2 with merchant scopes, encrypted messages, HMAC or JWT signatures and OTP. The vendor implements what your bank requires, not a simplified version.
  • Real webhooks: Signed notifications with retries and exponential backoff, a dead-letter queue and manual resend.
  • Every case, on demand: Test values force each outcome with no configuration: approved, insufficient funds, blocked account, over limit, OTP required, pending.
  • Controlled failures: Latency, errors and outages on demand, to prove the vendor recovers without charging twice.
  • Evidence without effort: Every request and response is logged, decrypted and audited. The certification file is built from those records.

You take part in two steps out of six.

  1. Discovery: You share your API documentation and a technical contact. We set scope, mandatory cases and timeline.
  2. Replica: We build the twin: contract, security, response codes and your bank's quirks.
  3. Google Cloud sandbox: A dedicated, isolated project with domain, TLS certificates, monitoring and control panel.
  4. Vendor onboarding: Credentials, integration guide and technical support for every vendor you refer.
  5. Certification: We run the case matrix and document every result with reproducible evidence.
  6. Approval: You get the evidence file and decide on go-live.

We already run twins of four payment rails.

  • Banco Activo: OAuth2 with merchant scopes. Pago Móvil (C2P) charges with OTP, instant debit, account activity queries and transaction webhook.
  • Banco Venezolano de Crédito: AES-encrypted messages, sync and async flows. 15 services: Pago Móvil C2P, reversal and verification, change, token debit, instant credits and debits, transfers, balance and activity.
  • R4 Conecta: Per-merchant HMAC signature and JWT queries. Merchant charges, webhook notifications to the client and transaction queries.
  • Generic transaction core: Own contract with sandbox key. Merchant onboarding, charges, card, debit, credit, change and queries. Lets you test without a real bank account and is the base to model your bank's core.

Simulators built from each institution's integration documentation. They move no real money and never connect to the banks. Trademarks belong to their owners.

Who it's for

  • Banks: Integrating fintechs, processors and merchants without opening their network for every test.
  • Fintechs and PSPs: Integrating with several banks and reaching certification with everything tested.
  • Processors and acquirers: Connecting merchants to several payment rails and needing stable regression tests.
  • Software and ERP vendors: Building bank payments into their products and certifying with each bank.
Bank Twin

Bank Twin: outsourced certification environments

Certify your vendors without opening up your bank.

We replicate your APIs, security and business rules in an isolated Google Cloud environment. Your vendors integrate and certify against that replica. Your IT and security teams open no access and lend no environments: they get the evidence file, ready to approve go-live.

Talk to a specialistSee how it works
  • 4 bank twins in operation
  • PCI bank certification since 2013
  • Dedicated Google Cloud project

What a certification looks like in the twin

Pick a case. Every request runs through the twin and becomes evidence; your bank never gets any traffic.

0/5 cases certified

Your bank's twinIsolated Google Cloud projectNo connectionVendorApp, POS or ERPAuthenticationOAuth2, AES, HMAC, OTPControl panelCases, errors, latencyYour APIs, identicalFields, codes, formatsScenario engineDecides every outcomeWebhooksSigned, with retriesLog and evidenceEvery request, auditedYour bankProduction untouchedYour certificationteamGets the evidence file

Live log

The vendor charges and reconciles with the bank reference.

    Illustrative example with synthetic data.

    Every new vendor costs your bank weeks of work that isn't your business.

    What your bank goes through

    • Opening VPNs, firewall rules, credentials and test users for every vendor.
    • A shared QA environment that goes down or no longer matches production.
    • IT and security teams babysitting someone else's tests instead of their own projects.
    • Every access you open is one more surface to watch and audit.

    What the vendor goes through

    • Weeks waiting for access before sending the first request.
    • No way to trigger the hard cases: insufficient funds, wrong OTP, timeouts, failed webhooks.
    • When the bank's environment fails, the project stops.
    • It reaches production with cases it never tested.

    The result: integrations that take months and go live with risks nobody saw.

    A twin of your bank, run by us.

    We build a faithful replica of your services from your documentation. To the vendor it's indistinguishable from your bank. To your bank it doesn't exist: there's no wire between them.

    What never happens

    • We never connect to your network or core.
    • We never use customer data: everything is synthetic.
    • No real money moves.
    The same contract
    Endpoints, fields, codes and formats identical to your docs, quirks included: decimal commas, currencies, your own references and statuses.
    The same security
    OAuth2 with merchant scopes, encrypted messages, HMAC or JWT signatures and OTP. The vendor implements what your bank requires, not a simplified version.
    Real webhooks
    Signed notifications with retries and exponential backoff, a dead-letter queue and manual resend.
    Every case, on demand
    Test values force each outcome with no configuration: approved, insufficient funds, blocked account, over limit, OTP required, pending.
    Controlled failures
    Latency, errors and outages on demand, to prove the vendor recovers without charging twice.
    Evidence without effort
    Every request and response is logged, decrypted and audited. The certification file is built from those records.

    You take part in two steps out of six.

    We handle the rest, including technical support for every vendor.

    Your teamSitioUno

    1. 1

      Discovery

      You share your API documentation and a technical contact. We set scope, mandatory cases and timeline.

      Your team + SitioUno

    2. 2

      Replica

      We build the twin: contract, security, response codes and your bank's quirks.

      SitioUno

    3. 3

      Google Cloud sandbox

      A dedicated, isolated project with domain, TLS certificates, monitoring and control panel.

      SitioUno

    4. 4

      Vendor onboarding

      Credentials, integration guide and technical support for every vendor you refer.

      SitioUno

    5. 5

      Certification

      We run the case matrix and document every result with reproducible evidence.

      SitioUno

    6. 6

      Approval

      You get the evidence file and decide on go-live.

      Your team

    The evidence file you get for each vendor

    • Case matrix with each result
    • Decrypted request and response log
    • Webhook, retry and recovery evidence
    • Open findings and how they were fixed
    • Go-live recommendation

    We already run twins of four payment rails.

    Your bank can be next. If it's already on the list, the twin already exists.

    • Banco Activo

      OAuth2 with merchant scopes

      Pago Móvil (C2P) charges with OTP, instant debit, account activity queries and transaction webhook.

    • Banco Venezolano de Crédito

      AES-encrypted messages, sync and async flows

      15 services: Pago Móvil C2P, reversal and verification, change, token debit, instant credits and debits, transfers, balance and activity.

    • R4 Conecta

      Per-merchant HMAC signature and JWT queries

      Merchant charges, webhook notifications to the client and transaction queries.

    • Generic transaction core

      Own contract with sandbox key

      Merchant onboarding, charges, card, debit, credit, change and queries. Lets you test without a real bank account and is the base to model your bank's core.

    Simulators built from each institution's integration documentation. They move no real money and never connect to the banks. Trademarks belong to their owners.

    Who it's for

    Banks

    Integrating fintechs, processors and merchants without opening their network for every test.

    Fintechs and PSPs

    Integrating with several banks and reaching certification with everything tested.

    Processors and acquirers

    Connecting merchants to several payment rails and needing stable regression tests.

    Software and ERP vendors

    Building bank payments into their products and certifying with each bank.

    Frequently asked questions

    Do you get access to our systems?

    No. We work only from your API documentation. The twin has no connection to your network or core.

    What data is used in testing?

    Synthetic data. No real customer accounts, IDs or transactions.

    Who approves go-live?

    Your bank. We run the tests and hand over the evidence; the decision is always yours.

    Where does it run and who maintains it?

    In a dedicated Google Cloud project with its own domain and certificates. We run, monitor and update it.

    What happens when our API changes?

    We update the twin, notify the vendors and re-run the regression tests.

    We're a fintech. Does this work for us?

    Yes. We give you environments for the banks we already replicate, or model the one you need, so you reach certification with every case tested.

    How long until it's ready?

    It depends on the number of services and the security scheme. We set it during discovery and give you a fixed timeline.

    Your next vendor can certify without touching your bank.

    Tell us which services you expose and how many vendors are in line. We'll reply with scope and timeline.

    Message us on WhatsAppUse the contact form

    Bank Twin is a test environment: it moves no real money and doesn't replace the bank's approval. © SitioUno Inc.

    PrivacyTerms