Zetu

Zetu is Swahili for “ours”, and the product starts where a great deal of African saving already happens: the group pot. Members pay in on a cycle, one member is paid out, and the ledger has to be right every time or the group stops trusting it.

The application core is wider than the demo, and the two are worth separating. The core covers a single wallet with top-ups, transfers, withdrawals, scheduled payments and transaction history; group pots with joining, contributing and rotating or democratic payout, with per-cycle deduplication so a double contribution cannot be double counted; and escrow as an explicit state machine with release, dispute and refund paths and a 72 hour dispute window. Merchant onboarding and QR payment sit behind a feature flag.

What the demo lets you drive is a path through that core, not all of it: signing in as a seeded member, reading the account panel, sending one transfer to another member, contributing to the group pot, and pressing the blocked transfer. There is no top-up, no withdrawal, no scheduled payment, no transaction history view, no joining or leaving a pot, no payout and no escrow in front of you. Those are in the code and are exercised by its own tests; they are not on screen here.

Underneath, every movement is a double entry, every state change writes into a hash-chained audit log that can verify its own chain, and every external call goes through a timeout and a circuit breaker. Sessions are opaque bearer tokens hashed at rest, and every route carries object-level authorisation rather than trusting the caller’s claim about who they are. The layer boundaries of the architecture are checked mechanically in CI, so the domain cannot acquire a dependency on the database by accident.

What it is not: a licensed or operating payment service. No real money moves, and the default rail is a sandbox that labels every settlement as simulated. AML screening is running: it is what refuses the R900 000 transfer in the walkthrough below, before the debit, and it does not tell the sender which rule fired. What is switched off in the build you are looking at is credit scoring and lending, which is where a regulator’s permission would be needed.