Stabilizing a mission-critical lending platform

Challenge

A Madison, Wisconsin-based financial services provider serving credit unions and their members with insurance, investment, lending, and employee benefits products since 1935 had a challenge to solve.

They had a partner-built platform generating real business value, but no internal team that understood how it worked. Through its joint venture with a renowned lending platform, they co-owned the rights to Lenders Protection, a system that let credit unions extend near-prime and non-prime auto loans with default insurance coverage attached. When the client moved to acquire full rights to the platform, including its application code, that decision raised a problem: an independent, external audit was required to confirm the platform was secure and maintainable before they could responsibly take it on.

The stakes went beyond a single audit. The client needed a partner to migrate the platform to a new data center, and to a more robust architecture.  Then they needed the partner to thoroughly review the code, identify vulnerabilities, and take on mitigating vulnerabilities, as well as ongoing maintenance and enhancement, all without disrupting the credit unions and members who relied on the product. 

Complicating matters, the platform hadn’t been built with documentation or clean installation processes in mind; running it required knowledge that lived only in the heads of the people who’d built it. And a volatile lending market was forcing the company to change its underwriting rules in the middle of the engagement, adding urgency to work that had little capacity for changes.

Approach

Flexion won this project the way it recommends any vendor should have to: by demonstrating capability before being handed the contract. The client ran a competitive bid process against three vendors, and during the pre-proposal phase, Flexion’s team performed an independent code and security assessment, mapped the platform’s architecture and data flows, and identified more than 40 risks requiring attention, all within a short evaluation window. That work was the proof they needed to award Flexion the contract and hand over the platform.

Once engaged, Flexion staffed the project with a senior Linux admin, senior Java and SQL developers, testers, and QA specialists, and worked directly with the lending platform team to take over and improve an application that had never been packaged as an installable, documented system. Rather than just patching the immediate vulnerabilities, Flexion introduced a repeatable delivery discipline the platform had never had: automated build and deployment, automated unit and integration testing, structured bug and work-item tracking. They did this using the SCRUM agile methodology. 

That discipline mattered most when the business itself was moving underneath the project, new underwriting rules had to be built into the platform in the middle of the security remediation work, and the automated test suite made that possible without destabilizing what had already been fixed.

Flexion also took on the business side of the platform, not just the technical side. Because the client hadn’t built Lenders Protection, its team didn’t fully understand the calculations and workflows embedded in it; Flexion consulted directly with them to translate that logic and integrate it into their broader claims process, including building an XML-based bridge to their Oracle APEX claims system after weighing several integration approaches. 

When they needed to meet PCI compliance requirements, Flexion resisted the instinct to run a large, expensive compliance overhaul across the whole platform. Instead, the team identified the single piece of data that actually required protection, determined the platform didn’t need it at all, and rerouted the system so that data never touched Lenders Protection in the first place, solving the compliance problem by removing the exposure rather than managing it.

Throughout the engagement, Flexion also served as a steady, independent technical advisor between them and the lending platform, two organizations navigating an increasingly strained business relationship as the joint venture wound down. Flexion’s consultants kept both sides moving forward on the technical work even as the underlying business dispute grew more adversarial.

Outcome

Flexion’s initial assessment identified more than 40 security and stability risks, and the team remediated them as part of the platform stabilization effort. Automated testing and deployment practices, introduced where none had existed before, measurably lowered defects and gave our client confidence in every subsequent release. Lenders Protection became the first application within their organization to meet the PCI compliance standard, a milestone driven by Flexion’s targeted data-isolation approach rather than a costly full-platform overhaul.

Flexion also trained roughly half a dozen of their staff to design and run structured user acceptance test cases, including positive, edge, and negative tests, building in-house testing capability they could carry forward. Throughout the engagement, the client had no internal technical staff for this system, which meant every major business decision about the platform’s future depended on Flexion’s independent, objective assessment; that trust let them make and implement decisions quickly during an uncertain economic period.

When the time came to retire the platform, Flexion managed a phased decommission that spanned more than a year without disrupting the credit unions and members still using it. The team built a data migration process to move insurance data into an organization-standard SQL database, archived image-based records into an enterprise content repository to support future audits and customer service needs, and ported the system’s remaining maintenance functions onto organization-supported technology to minimize the ongoing cost of running an end-of-life product.

The relationship outlasted the project. The lending platform retained Flexion as a security and development partner for the next generation of the Lenders Protection platform, and the client continued retaining Flexion for other work beyond this engagement.