work / case
Modernising a RegTech Backend: .NET to Go
Re-architected a flagship compliance product's backend from a stateful .NET monolith toward stateless, cloud-native Go services — cutting a key query from a 5-minute timeout to under 10 seconds and removing a hidden data-loss risk.
Problem
A flagship RegTech/compliance product ran on an aging .NET backend: a tightly-coupled monolith of 300+ API endpoints that held in-memory state, scaled only vertically, and resisted containerisation. As load grew, the architecture became the ceiling — no horizontal scaling, slow deploys, and operational risk concentrated in a single process.
Two issues stood out as urgent. First, the software HSM holding the product’s encryption keys ran off a single, un-backed persistent volume — one volume deletion away from permanently unrecoverable customer data, a latent data-loss event hiding in plain sight. Second, core list endpoints used OFFSET-based pagination with no supporting indexes; against tables of 100k+ rows, a key query timed out entirely (>5 min) and failed under real customer data volumes.
Approach
Led a ground-up rewrite from .NET to Go, chosen for its runtime performance and small container footprint. Ported the 300+ endpoints away from the stateful monolith toward stateless, horizontally-scalable services designed to run cleanly on Kubernetes — state externalised, instances interchangeable, deploys rolling — shipped onto the platform through GitLab CI/CD and ArgoCD GitOps.
Remediated the key-management risk by migrating off the single-PVC software HSM to AWS KMS with envelope encryption: durable, IAM-scoped, CloudTrail-audited, and protected against accidental deletion — turning a catastrophic single point of failure into a managed, auditable key hierarchy.
Re-engineered the slow data paths by replacing O(n) OFFSET pagination with keyset (seek) pagination and adding the indexes the query patterns actually needed, so cost stayed flat regardless of how deep into a result set a request reached.
Outcome
- The query that previously timed out (>5 min, failing on 100k+ rows) now returns in under 10 seconds — roughly a 30x improvement, and stable under production data volumes.
- A latent data-loss risk was eliminated: key material moved to a durable, IAM-scoped, audited KMS-backed envelope-encryption scheme with deletion protection.
- The backend’s trajectory shifted from a vertically-scaled monolith toward stateless, Kubernetes-native services — unblocking horizontal scale, faster deploys, and a far smaller operational blast radius.