FiapPay: Escrow-as-a-Service Over WhatsApp, Built in Rust

FiapPay is our own product: an Escrow-as-a-Service (EaaS) platform serving buyers and sellers in Cameroon, where informal commerce runs on WhatsApp and mobile money, and where the biggest obstacle to closing a deal between strangers is trust. FiapPay acts as the neutral third party that holds funds until both sides have kept their word. The platform is live in production.

Online buyer-seller fraud is rampant in informal markets: pay first and the goods never arrive, or ship first and the payment never comes. Classic escrow solves this, but every existing implementation assumed a web or mobile app - a real adoption barrier for users whose entire commercial life already happens inside WhatsApp on low-end phones and metered data. The technical problem was therefore twofold: build escrow money-handling that is genuinely trustworthy, and deliver it through a channel with no app install, no signup friction, and no learning curve.

We made a deliberately unusual architecture decision: no frontend at all. FiapPay is a pure backend - Rust with the Axum framework on the Tokio async runtime - and its complete user interface is an interactive WhatsApp menu. Users create an escrow, get payment instructions, confirm delivery, and trigger release entirely in a chat conversation. Rust was chosen for the reasons that matter when software holds other people's money: memory safety, a type system that makes illegal states unrepresentable, and predictable high performance under concurrent load. Payment collection and disbursement run through Campay, which aggregates MTN Mobile Money and Orange Money - the rails our users actually have. The transaction lifecycle is explicit and state-machine driven: awaiting payment, funds locked in escrow, delivered and released. Pricing is a flat 5% platform fee split evenly between buyer and seller, stated upfront.

Rust with Axum and Tokio for the service itself; SQLx over SQLite for storage with compile-time-checked queries; Campay API integration for mobile money collection and payout; WhatsApp webhooks for the conversational interface.

Every inbound webhook - payment notifications and WhatsApp messages alike - is verified with HMAC-SHA256 signature validation before it is trusted; an unverified payload is rejected outright. Payload contents are validated server-side against strict schemas. State transitions are enforced in one place, server-side: funds cannot be released without the transaction being in the correct state, no matter what a message claims. Escrow operations are idempotent, so a retried or replayed webhook cannot double-release or double-credit. Rust's ownership model eliminates the memory-corruption bug classes that plague money-handling services written in unsafe languages.

FiapPay is live and processing real escrow transactions. The WhatsApp-only interface proved the core bet: users transact through a chat menu they already know how to use, with zero app installation. Operationally, the Rust backend runs with a minimal resource footprint, and the absence of a web frontend eliminated an entire attack surface - there is no browser session, no XSS, and no client-side payment logic to subvert.

Designed, built, and operated in-house by our small engineering team in Bamenda, led by our founder. The platform is under continuous development as transaction volume grows.