C4 — Context Diagram

This diagram shows Finnest Power at the ecosystem boundary. Finnest Power does not own the customer relationship, regulator directories, or bank/insurer core systems; it provides the regulated integration plane that connects them through FAPI-compliant APIs, consent flows, audit trails, and operational controls.

graph TB
  Customer[Bank or insurance customer]
  Bank[Holder or receiver institution]
  Fintech[Initiator or client application]
  BCB[BCB Open Finance directory]
  Susep[Susep Open Insurance directory]
  Operators[Platform operators]
  Finnest[Finnest Power platform]

  Customer -->|consent authorization| Bank
  Customer -->|payment or data-sharing intent| Fintech
  Fintech -->|FAPI client calls| Finnest
  Finnest <-->|mTLS, PAR, DPoP, consent, resources| Bank
  Finnest <-->|directory metadata and conformance inputs| BCB
  Finnest <-->|directory metadata and conformance inputs| Susep
  Operators -->|deploy, observe, audit, operate| Finnest

Trust Boundaries

• External clients and regulated institutions communicate through FAPI profiles, mTLS, PS256, and directory-backed metadata.
• Finnest services keep tenant isolation, consent state, audit logs, and transactional outbox state in PostgreSQL.
• NATS JetStream carries internal CloudEvents only; it is not a public integration surface.
• Redis is used for cache and short-lived shared state, not as the source of record.