American Express details a cell-based architecture for payment resilience

Category: Engineering post
Status: confirmed
Sources: americanexpress.io, discussion
Summary: Benjamin Cane describes how American Express runs core payments on independent cells, each holding its own microservices, databases, and infrastructure. Static reference data is replicated to every cell to avoid synchronous lookups; a Global Transaction Router is the only cross-cell path and routes by deterministic data locality. On a mid-transaction cell failure, the system reroutes and restarts in a healthy cell with idempotency keys rather than resuming across boundaries, and critical-path components avoid blocking on logging or config.
Why it matters: It is a concrete, production account of bounding failure domains and preserving predictable latency in a high-volume payments system.