Design Robinhood

The ask

A person opens an account, adds cash and places an order from a phone. The order goes to a stock exchange for a trade.

The app shows live prices, holdings and the state of each order. A person must always see what is owned and what is pending.

Cash and shares are different records. Cash moves through payment rails and shares move through clearing after a trade.

The app owns the customer relationship. The exchange owns the order book and the match.

Estimate the scale

The app serves 20,000,000 users.

Its users place 10,000,000 orders a day.

Orders compress into the trading day of 23,400 seconds. 10,000,000 / 23,400 = about 427 orders per second while the market is open.

The average user trades rarely. 10,000,000 / 20,000,000 = 0.5 orders per user a day.

API and data

The operations are place an order, cancel an order, read holdings, read cash and read order status.

An order carries the account, the share, a side of buy or sell, a share count and a price limit.

Each order gets a unique reference from the app. The reference follows the order to the exchange and back.

Holdings show settled shares and pending shares apart. Cash shows settled cash and buying power apart.

Market data is a separate stream from orders. A slow price feed must never delay an order.

High-level design

The phone app talks to app servers behind a load balancer. App servers check identity, cash and share rules for each order.

An order service stores the order, stamps its state and sends it to the exchange through a gateway.

Trade reports return through the gateway. The order service updates states and pushes a notice to the phone.

A market data service collects prices from the exchange and fans them out to phones. Popular shares are cached close to readers.

A ledger records cash and share movements for each account. Double entry keeps every movement paired and provable.

Deep dive: the market open rush

Orders gather overnight while the market is closed. They release into a short window when trading starts.

The gateway sends orders in the order they were accepted. Sequence numbers keep that order visible and checkable.

Queues absorb the rush between the app and the exchange. A queued order shows as pending, never as traded.

Refusals come back with a plain reason. A person can fix a refused order instead of guessing.

Capacity follows the exchange trading shape. Quiet weekends need little and open minutes need the most.

Deep dive: cash, holds and settlement

A buy order needs cash behind it. The app places a hold on cash so the same cash cannot back two orders.

A trade does not settle at the moment of the match. Clearing moves cash and shares later, and the app shows that pending state plainly.

A sell order needs shares behind it. Settled shares can be sold, and pending shares wait until they settle.

A cancel frees the hold when the order never traded. A partial trade frees only the untraded part of the hold.

Correcting entries fix mistakes in the ledger. Old entries stay untouched, so account history stays complete.

Market data at phone scale

Millions of phones watch a smaller set of popular shares. One price update can matter to a huge crowd at once.

A cache holds the latest price for each share. Phones read the cache, and the exchange feed updates the cache.

Watch lists drive demand. Prices for watched shares refresh first, and quiet shares refresh on request.

Push updates go to open apps only. A closed app reads fresh prices when it returns.

Failures and retries

A lost answer from the exchange leaves an order in doubt. The unique reference lets the app ask for the stored state instead of sending the order again.

A phone retry repeats the same reference. The order service returns the first result, so one tap can never become two orders.

If market data fails, ordering can stay open with a clear warning on prices. If order state fails, ordering pauses.

Reconciliation with the exchange and the clearing service runs daily. A mismatch becomes a case for a person.

Evaluation and trade-offs

The app is wide and the core is narrow. Millions of readers are cheap, and careful order handling is the scarce part.

Holds give safety and can frustrate. Cash under a hold cannot be reused, and that is the point of the hold.

Borrowed exchange depth keeps the app simple. The app never runs an order book and never matches orders itself.

The design trades control for focus. The exchange makes fair trades and the app makes them easy to use.

Who owns what