Self-hosted reconciliation across nostro / GL, mobile money, and card-scheme settlements — one platform, on your infrastructure.
Break ageing, decision pressure and throughput — at a glance.
100% auto-reconciled · 14dBy the numbers
Auto-match rate observed on a West African correspondent-banking pilot; figures vary by data quality and tier policy. Kilter is self-hosted — your data never leaves your infrastructure. Read the field report →
Four streams, one platform
Same operator UI, same audit log, same role model, same deployment. Train a team once and they can work any queue.
Reads raw SWIFT (MT940/950 · MT942 · MT900/910) and ISO 20022 (camt.052/053/054) directly — no transformation layer to license or configure — then pairs them against your core-banking GL extract. Four-tier engine — 75–85% auto-match on typical pilot data.
Ingests operator B2W / W2B feeds directly, pairing legs by msisdn in the narration. Pre-seeded profiles for the major networks.
N-way matching on scheme-ref. PCI-DSS storage scope reduction built-in — full PAN never persists, masked at the parser seam.
Reconciles a Central Securities Depository statement of holdings against your investment ledger — matched on ISIN, nominal and maturity. The settlement cash leg is native nostro recon today; native CSD message ingestion (MT535 · semt) is a scoped connector.
Treasury securities
The same engine that reconciles your nostro statements pairs a Central Securities Depository statement of holdings against your investment ledger — position by position, on ISIN, nominal and maturity. The settlement cash leg is already native nostro recon.
ISIN → reference · nominal → amount · maturity → value date. Tier-1 only auto-confirms — the break stays for human review.
One platform
Same UI, same shortcuts, same review flow — three reconciliation engines behind one operator surface.
Every decision across all three streams lands in one tamper-evident, UTC-stamped trail.
Maker / checker, five roles, segregation of duties — identical everywhere.
One self-hosted instance on your VM. No extra services to run.
No per-seat fees, ever. Pay by capacity, not headcount.
Frozen, signed snapshots — figures never shift after sign-off.
Two-sided matching · live
The correspondent's SWIFT statement on the left, your core-banking GL on the right. Lines draw between pairs as the engine runs — tier-graded, with variances and breaks flagged.
The matching engine
Four tiers, strongest-first. Operators review the exceptions; the engine handles the rest — tolerance windows, FX rounding, date drift.
Enterprise-grade
Beyond the engine: the controls, resilience and integration a treasury operations team needs before it trusts a reconciliation in production.
Every decision is sealed under chained SHA-256 anchors — any retroactive edit is detectable, and you can re-verify the whole chain on demand.
A maker requests, a different checker approves — enforced by the server, not by policy documents. Certificates add a multi-signer sign-off matrix.
Active-passive failover on a leader lease with provably zero double-fires. Take the active node down; the standby picks up the schedule.
Seed opening balances and open-item backlog in minutes — dry-run validated first. Any bank, not just a migration off the incumbent.
A read-only reporting API with revocable machine tokens, and HMAC-signed webhooks that push break events to your systems — only to endpoints you configure. Never to us.
Every real statement pathology becomes a permanent regression test, replayed on every change across SQLite and PostgreSQL — part of 1,200+ automated tests guarding the engine.
Security & compliance
Microsoft / Google Authenticator out of the box; pair the optional AD / LDAPS layer for full password-plus-TOTP MFA. A replay cache blocks 30-second code reuse.
Runs as UID 10001, all Linux capabilities dropped, no-new-privileges enforced. Only mounts are writable.
TOTP secrets + SMTP creds protected with Fernet (AES-128-CBC + HMAC-SHA256). Key lives in your secret manager.
Every login, upload, match, dispute and export — UTC-stamped, blocked from UPDATE/DELETE at the DB, and sealed under a chained SHA-256 anchor you can re-verify on demand.
Full PAN never persists — masked to first6 + last4 at the parser seam. No SAD accepted; free-text redacted on ingest.
Runs on your VM or private cloud. No telemetry, no data leaves your infrastructure. You own the key and the data.
The reporting API takes scoped, revocable machine tokens (hashed at rest, constant-time compared) — and an automated test walks every route to prove no token can reach a write. Zero write surface, guaranteed by CI.
Maker-checker on write-offs — the most sensitive disposition — enforced by the server, not by policy: a different user must approve, with a full audit trail. Certificates support a multi-signer sign-off matrix.
Outbound break webhooks are optional, HMAC-SHA256 signed, https-only, and fire solely to the internal endpoints you configure. Verifiable, replay-resistant — and never to us.
Request a demo URL and drop in your own SWIFT, GL extract, mobile-money, or card-switch file. We'll run the engine and show you what week one looks like.
Book a 30-minute demo
