When an SLA Isn't Enough: Cluster Linking as the Last Line of Defense for Brazil's Capital Markets

A clearing house sits at the heart of a capital market. It guarantees settlement, manages counterparty risk, and cannot stop — an outage doesn't degrade a feature, it freezes a national market. As part of its multi-year partnership with Nasdaq to build a next-generation clearing platform, B3 — the Brazilian stock exchange — is modernizing this Tier-0 workload to the cloud, with Confluent Cloud as the central nervous system: the backbone for messaging, system-to-system integration, and real-time data streaming across the entire clearing flow.

This talk tells that story from the trenches. We'll explain why we chose Apache Kafka and Confluent Cloud as the integration hub for an ultra-critical platform, how we model clearing events as streams, and the governance and operational discipline required to run streaming at this level of criticality — including a SaaS product layered on top of one of the most critical platforms in the Brazilian market.

The core of the session is resilience. For a workload where "the platform is down" is not an acceptable sentence, a managed SLA alone isn't enough — we needed a defensible answer to "what happens if we lose Confluent itself?" Our answer is a dedicated continuity layer built on Cluster Linking. We'll go deep on the mechanics: byte-for-byte, offset-preserving asynchronous replication that keeps a standby cluster continuously hydrated with topic data, consumer offsets, and ACLs — with no Connect cluster to operate. We'll cover our failover design (promote / fail-forward), how we reason about RTO and RPO under a regional or provider outage [insert your real targets], how Schema Linking keeps consumers reading immediately after failover, and the trade-offs we made.

Attendees leave with a concrete blueprint for running mission-critical, regulated workloads on Confluent: positioning Cluster Linking as a continuity layer — not just a migration tool — treating mirroring lag as a first-class SLO, rehearsing failover, and the architectural decisions that let a financial market infrastructure sleep at night. If you operate anything that genuinely cannot go down, this is the playbook.