Your systems, kept in step. Nobody retypes anything.
We connect the tools you already pay for, such as Xero, Stripe, Microsoft 365 and Google Workspace, so a sale, a booking or a reply moves between them on its own. When partners need a way in, we build you a documented API with keys you control.
If it has an API, we can usually connect it.
An API is the door one piece of software opens for another. Most business tools have one. Where a tool has no API, we find the next safest route and tell you plainly how reliable it will be.
Payments
Card and Direct Debit payments land in your records the moment they clear. Refunds and failed payments are handled too.
Accounting
Invoices, payments and customers sync to your ledger, so finance stops copying figures between screens.
Messaging
Texts, emails and push notifications go out from your system, and replies come back in. Consent is checked before anything is sent.
Calendars and identity
Bookings appear in the right diary, and staff sign in with the work accounts your IT team already manages.
Your own API
A documented, versioned API, so partners, suppliers and your own apps can read and write your data safely, each with their own key.
Older systems
No API at all? We work with the database directly, or with scheduled file drops, and keep both sides in step.
Things go wrong between systems. The log shows what happens next.
Other people’s systems go down, time out and send the same message twice. A well-built connection expects all of that. Here is one morning, seen from the inside.
- 10:02:14INPOST /webhooks/stripeDone: 200 · 61 mscheckout.session.completed · signature verified · queued
- 10:02:15OUTPOST api.xero.com/…/InvoicesWill retry: 503 · timeoutXero busy → retry 1/5 in 30 s
- 10:02:45OUTPOST api.xero.com/…/InvoicesWill retry: 503 · timeoutstill busy → retry 2/5 in 60 s (the wait doubles)
- 10:02:51INPOST /webhooks/stripeSkipped: 200 · 4 mssame event sent again · idempotency key evt_3Qx…a91 already processed → skipped, no duplicate invoice
- 10:03:09INPOST /webhooks/twilioDone: 200 · 38 mssignature verified · Leo Hart replied “YES” → booking confirmed
- 10:03:45OUTPOST api.xero.com/…/InvoicesDone: 200 · 84 msretry 2/5 · succeeded · invoice INV-2041 for Amira Khan
- 10:41:30OUTPOST graph.microsoft.com/…/eventsNeeds a person: 401 · access revokednot retried · moved to the dead-letter queue · Sam Ellis alerted by email
- 11:06:12OUTPOST graph.microsoft.com/…/eventsDone: 201 · 92 msaccess restored by Sam Ellis · replayed from the dead-letter queue · calendar event created
- Retries with backoff
- When a tool is busy, we try again later and wait longer each time: 30 seconds, then 60, and so on. Only errors that can clear on their own are retried.
- Idempotency keys
- Every event carries a unique key. If the same event arrives twice, we spot the key and skip it. One payment never becomes two invoices.
- Signature verification
- Stripe, Twilio and others sign each message with a secret only they and we hold. We check it before acting, so nobody can fake a payment or a reply.
- A dead-letter queue and a person
- If something cannot succeed on its own, such as access being revoked, it is parked safely and a named person is told. Nothing is lost quietly.
How we build a connection that doesn’t break
These are our defaults on every integration, not extras. They are also the questions your IT team and your auditors will ask.
Plain REST and JSON
Predictable web requests any developer can read and any modern tool can call. No formats that lock you in.
Documentation that stays true
Your API is described in an OpenAPI file, which gives partners readable docs and a way to try each call. The file is checked against the code, so the docs do not drift.
Signed webhooks, both ways
A webhook is a message one system sends another the moment something happens. We verify every one we receive, and sign every one we send, so forgeries and replays are rejected.
Idempotency on every write
Any request that creates or changes something carries an idempotency key. If a nervous partner sends it twice, it still happens once.
Retries with backoff
Temporary failures wait on a queue and are retried with growing gaps and a little randomness, so a service that is recovering is not flooded.
Keys per partner that you can revoke
Each partner or app gets its own key or OAuth client, limited to what it needs. Switch one off and the others carry on.
Monitoring and alerts
Every call is logged with its timing and result. If errors rise or a queue backs up, we are alerted before your team notices.
Versioning
When your API changes, existing partners keep working on the old version while they move across, with dates agreed in advance.
The platform we built for nine NHS services is connected to the services it depends on: messaging, email, documents, work accounts and a supplier, with nothing counted twice. Read the case study
Integrations are often one part of a bigger build. They feed a customer or staff portal, keep a bespoke business system in step with your accounts, and follow the same standards we set out on our security and compliance page.
Integration questions
Something else? hello@echticstudios.com
Can you connect a tool that isn’t listed here?
Very likely. If it has an API, we read its documentation before the consultation and tell you what is possible. If it has none, we look at database access, scheduled file exports or email parsing, and say honestly how reliable each would be.
What happens when the other system is down?
Nothing is lost. Outgoing calls wait on a queue and are retried with growing gaps. Incoming events are stored before they are processed. If something still fails, it goes to a dead-letter queue and a named person is alerted.
Can partners or suppliers connect to our system?
Yes. We build you an API with documentation, a test environment and a separate key for each partner. You can switch any one of them off without touching the rest.
Is our data safe moving between systems?
Data travels encrypted over TLS, every webhook is signature-checked, and each connection only gets the access it needs. We document what flows where, ready for your UK GDPR records and any DPIA.
How long does an integration take?
We scope each connection separately, because a Stripe payment link and a legacy warehouse are very different jobs. Your quote sets out each connection and its timeline.
Who owns the integration code and the keys?
You do. The code is yours once paid for, and the API keys and supplier accounts are in your organisation’s name, not ours.
Tell us which systems need to talk to each other.
A free consultation, then a fixed quote for each connection. Larger programmes are delivered in stages, and you can stop after any stage.