Success story

4G Capital saves a quarter-million dollars per year with Cerbos

A digital bank replaces their legacy authorization service with Cerbos and improves their cost-efficiency.

$264k saved per year by switching authorization services

From requirements to production in minutes instead of a full development cycle.

Policies are updated in minutes when requirements change

“We got the foundation set. Now we can scale and include more complex policies. And we can grow in the right direction and with the right security.“

Edgar Rivera, CTO, 4G Capital

Summary

4G Capital is a growing bank serving small businesses and entrepreneurs in Kenya and Uganda. When CTO Edgar Rivera joined the company, he was tasked with modernizing their back-end architecture and moving from a monolithic to a microservices design.

Edgar implemented Cerbos as the authorization solution, replacing their hard-coded system. As a result, 4G Capital now has an easily configurable and auditable authorization system that also saves over a quarter million dollars per year in scaling costs.

Fine grained, contextual, continuous authorization for enterprise software and AI

Use Case

Modernizing and future-proofing a digital bank

Banking is now a digital business. High-quality digital experiences are now a top priority to be competitive. “We see very successful banks in Europe, America, and Asia completely digital native, and they have millions of customers now. And users are already used to the same user experience that big tech brands give you, like Google and Netflix,” says Edgar, “And so you’ve got to compete by providing the same user experience and fast value to the customer.”

And with Fintech being a relatively new sector, regulations for fintech like ISO27001, SOC2, GDPR, PSD2, CCPA, are constantly evolving. That means your architecture needs to be designed for constant change. So applications need to be designed for change.

4G’s existing authorization model didn’t scale and was gathering technical debt. They were using roles and user groups from Google Workspace, but their role requirements were changing and Google didn’t have the right capabilities to meet their requirements.

4G’s team needed a way to synchronize authorization across internal and external apps and services in a more modern architecture. That included incorporating authorization in serverless environments, and keeping their authorization lightweight and flexible while maintaining their security standards.

Requirements

Flexibility

Edgar wanted his team to deliver frequent releases, to constantly test and iterate features, constantly improve user experience, and smoothly adapt to changing regulatory requirements in the markets where they operate. “Products are live things,” says Edgar “You gotta have that flexibility, otherwise it's very hard to deliver quickly and to innovate.”

Auditable and secure

Dynamic and fine-grained access control

4G wanted their access controls to fit the real-life use cases of the financial operations that are taking place in their application, and the different user types of the application. They weren’t going to settle for a ‘set it and forget it’ approach. Users and employees come and go, and the regulatory environment changes all the time, especially in fintech.

“It was very important to have full governance around access control. If you want to scale, if you want to go to other countries, you need to nail these things.“

Edgar Rivera, CTO, 4G Capital

Solution - Authorization that evolves with the application

Edgar Rivera was leading a full cloud transformation, not just an authorization revamp. So he needed an authorization solution that would adapt along with the transformation process.

He started by deploying Cerbos an an AWS Lambda function, and retiring their legacy authorization service. Cerbos’ stateless policy decision point (PDP) performs authorization checks at the service layer. And all of 4G centralized their authorization logic in a repository of policy files managed in Cerbos Hub.

“It took very few resources from us to do this. We have one engineer who went through all of the documentation, and it was quite easy for him to create the policies and implement the changes on the backend,” Edgar recounts.

The next stage of 4G’s transformation is a full migration from AWS to Google Cloud. In Google Cloud, 4G can manage their policy decision points with Cerbos Hub in exactly the same way. The stateless Cerbos PDPs are easily deployed as multi-container docker images with GCP Cloud Run services. They can implement authorization at the API layer using Apigee. They authorization has no single point of failure and it will scale with the service layer.

Results

Millions of dollars saved and precious time reclaimed

By switching to Cerbos for authorization, Edgar estimates 4G Capital is saving over $264K per year (or $22K per month).

“We were about to scale our existing platform to all branches in Kenya. And when we looked at the performance of the Lambda authorization service and the cost, we were saying Oh my God, this is going to cost us a lot of money.”

Managing authorization in the backend of 4G capital’s application used to involve hours or days hardcoding changes, complicated re-deployments, and a whole separate service just to test policies. Managing Cerbos PDPs through Cerbos Hub reduces authorization maintenance work to minutes. 4G’s authorization policies are automatically synchronized throughout their architecture, eliminating potential vulnerabilities from an incomplete roll-out.

Edgar shares, “It's quite easy to see what the policies do, and also very easy to update them. With the CI/CD feature you update a new policy and it automatically pushes latest version to the PDPs.”

“It's quite easy to see what the policies do, and also very easy to update them. With the CI/CD feature you update a new policy and it automatically pushes latest version to the PDPs.“

Edgar Rivera, CTO, 4G Capital

Fine-grained, adaptable policies with enhanced security and auditability

4G Capital can now easily implement and manage highly granular, attribute-based authorization policies. They can control access to resources and actions based on user attributes, resource attributes, relationships, and contextual factors.

By decoupling authorization logic from their application code, 4G can modify policies centrally and propagate changes across services without requiring code redeploys. Whether product or regulation changes require updates to authorization policies, it’s easy to communicate between stakeholders and write new policies that fit the new use case, then push the changes right away instead of taking a full development cycle.

Cerbos maintains a central log of all authorization decisions, so 4G Capital has a clear audit trail for compliance and security investigations. And it’s easy for the internal team to monitor performance and detect potential issues.