Municipal voucher platform

The problem

Regional municipalities issue 商品券 — gift vouchers spent with local merchants — to stimulate their own economies. Each municipality runs its own scheme, with its own rules, budget and merchant list, and each had been handling issuance on paper. Paper vouchers are slow to distribute, hard to reconcile, and impossible to audit in real time.

Building three separate systems would have meant three deployments, three security reviews and three maintenance burdens. The platform had to serve every municipality from one codebase while keeping each one's data completely separate.

Architecture

Residents and merchants reach the platform over TLS terminated at the load balancer; everything behind it runs in private subnets. The application tier resolves which municipality a request belongs to and scopes every query to that tenant. Ledger records are encrypted through managed keys rather than application-held secrets, so key rotation and access are auditable outside the codebase.

Client names and endpoints are withheld; the diagram describes the architecture only.

Constraints that shaped it

• Public money, real-time truth. Every issuance and redemption moves public funds, so the ledger is the source of truth and reconciliation has to hold under concurrent redemption.
• Tenant isolation. One municipality must never be able to observe or affect another's data, budget or merchants — enforced in the data layer, not only in the UI.
• Peak-day load. Voucher schemes open on an announced date, so traffic is not evenly distributed — it arrives in a spike.
• Public-sector compliance. Encrypted data, scoped access and audited change, to the standards the platform ships under.

Outcome

All three schemes went live on the platform — each with its own rules, budget, merchant list and calendar — running from a single codebase and a single deployment rather than three parallel systems.

The biggest change landed on merchants. Digital redemption removed voucher collection altogether: settlements reach their bank accounts automatically instead of being counted, bundled and reconciled by hand. Residents spend to one-yen precision instead of in fixed paper denominations, so no value is stranded in change. Administrators watch issuance and redemption as it happens rather than reconstructing it from paper weeks after the fact — which is what makes a publicly funded scheme auditable in the first place.

Where residents could choose between formats, more of them took the digital voucher than the paper one.

Stack