GrinGo Pay
A mobile app that lets UK and EU tourists pay Brazilian merchants via PIX, funded from a GBP or EUR balance held at a regulated payments partner. No cash, no card FX gouging, no Brazilian bank account.
GrinGo orchestrates a small set of vendors to make this work end-to-end:
- Apple & Google native OAuth — sign-in. No auth vendor; we verify each provider's ID token and issue our own session JWT.
- Infinia — regulated custodian for user balances, KYC (HOSTED mode), GBP/EUR virtual accounts for deposits, FX (GBP/EUR → BRL, routed internally through a transient per-user USDC pivot — two legs, never surfaced to the user), and payouts to PIX / FPS / SEPA.
GrinGo itself is a stateless orchestration layer: it never custodies funds and never signs money-moving transactions directly. See architecture/custody-model for why this matters, and architecture/privacy for the GDPR posture.
Where to start
| Audience | Start here |
|---|---|
| Product / biz | Product overview → How it works |
| New engineer | Architecture overview → Developer setup |
| API consumer | API overview → Endpoints |
| Ops / deployment | Deployment → Secrets → Migrations |
Project status
Pre-launch redesign. The architecture layer and user-flow docs reflect the current Model A design (Infinia + native OAuth + no crypto). The API reference and ops sections are still being updated to match — they may reference concepts (Bridge, Privy embedded wallets, USDC on Base) from the previous architecture until their own rewrite pass lands.
See custody-model for the documented escape hatch back to a wallet-based model if we ever need it.