What tech stack does American Express use?

American Express's backend engineering is primarily Java-based, using Spring Boot for enterprise service delivery across its payments, card management, and risk systems. The company has also adopted Node.js with Fastify for high-throughput API services, reflecting a broader shift toward event-driven microservices that can be independently scaled and deployed. Job postings consistently list Java, REST APIs, Docker, and Kubernetes as core requirements, with Spring Boot named as the preferred framework for new service development.

At the infrastructure layer, American Express has published engineering blog content on Istio for large-scale enterprise service mesh management and cell-based architecture for building resilient payment systems — an approach that isolates failure domains and enables fault-tolerant transaction processing at $1.67 trillion annual billed volume. Kubernetes orchestrates containerized workloads at scale. The company operates a hybrid multi-cloud model across AWS and Azure, with an active strategic migration of its core on-premises data warehouse to Google Cloud BigQuery — confirmed via Google Cloud partnership announcements in 2025. This migration signals that the company is modernizing away from legacy on-premise data infrastructure toward managed cloud-native analytics. Radhakrishnan has publicly stated that AI governance and continuous modernization are the two defining themes of Amex's technology strategy through 2026 and beyond.

On the frontend, American Express has built and open-sourced its own React-based framework called One App (github.com/americanexpress/one-app), which has been in production since 2016. One App is a modular, server-side-rendering-first framework with independently deployable UI modules, Redux state management via One App Ducks, and dynamic routing via one-app-router (forked from React Router 3) — designed for the complexity of a large multi-team engineering organization. The project is Apache 2.0 licensed and actively maintained. A companion project, Holocron, handles composable React component loading without server restarts, enabling seamless UI deployments at Amex's scale.

For data and analytics, the strategic direction is Google Cloud BigQuery, replacing legacy Hadoop/Spark-based on-premises infrastructure. Internal ML and AI models power fraud detection, spend pattern analysis, and cardmember personalization — the first-party data advantage of the closed-loop model makes Amex's training data among the richest in financial services.

On the GTM and marketing technology side, detected tools include Oracle Eloqua (marketing automation), Salesforce and Salesforce Audience Studio (CRM and CDP), Google Tag Manager and Ensighten (tag management), Mixpanel (product analytics), and LivePerson (chat and digital customer service). Advertising infrastructure spans Google Ads, Bing Ads, LinkedIn Ads, and Pinterest Business. For open banking in Europe, Amex uses Yapily's API infrastructure.

American Express's technology footprint is that of a large, compliance-heavy financial institution in the midst of active cloud modernization — which creates distinct buying patterns. The active BigQuery/Google Cloud migration signals spend on data warehouse modernization, data governance, ML ops, and analytics tooling; vendors in these categories should find receptive buyers in the CIO/CDO organization under Radhakrishnan. The Kubernetes/Istio adoption signals appetite for cloud-native infrastructure, API security, and observability platforms that can operate at transaction volumes measured in trillions of dollars annually.

The One App open-source framework signals a strong internal build culture — Amex tends to build rather than buy for core infrastructure, meaning pure frontend or developer tooling pitches need a compelling build-vs-buy argument backed by engineering community credibility. For GTM and marketing technology vendors, the existing Salesforce, Eloqua, and Mixpanel footprint means displacement pitches need to demonstrate meaningful differentiation or deep integration capability with the existing stack.

Security, compliance, and fraud tooling (fraud detection, identity, data privacy, API security) are perpetually in-budget at a company processing $1.67 trillion in annual billed business across 130+ countries. The new 2 World Trade Center headquarters (construction 2026–2031) will also drive multi-year procurement in smart-building technology, physical security, AV/collaboration infrastructure, and LEED-certification-related systems — an underappreciated budget cycle for relevant enterprise vendors.