He told me about how the company is flexible about whether to insource or outsource and how some things are better done yourself.
When two investment companies took the former RBS division off the bank's hands when it was forced to sell assets, Toivonen was brought on board to create an IT infrastructure for the payment processor.
The reason I am blogging about it here is that fact that the project to create an IT infrastructure for a business that requires the tightest security and cannot afford downtime has an interesting take on outsourcing.
When WorldPay went it alone after breaking from RBS it had no IT infrastructure to run its payment processing business. It agreed with RBS to keep the transaction processing on its IT infrastructure until it could build its own.
This was a big job for a business that requires an infrastructure that is highly secure and always available.
To make matters worse it had 149 IT staff who were mainly software engineers and project managers with no IT infrastructure expertise.
So outsource you would think.
This is where it is interesting. It has used a mixed bag.
The first decision to make was about datacentres. It went for a co-location datacentre from SunGard. This was the two buildings only. Then it looked at system integrators to see who could build the IT infrastructure to sit inside.
Toivonen said it was the usual suspects. The likes of HP, IBM, Capgemini, Infosys etc.
But in the end WorldPay decided to build the IT infrastructure itself and hired people with the right skills to do so. It now has a total of 350 IT staff including those working via an outsourcing supplier.
Toivonen said the reason it did it itself was because of the risk. He says it would have been really difficult to get a supplier to sign up to the level of risk required. Any downtime or security breach to a service that transacts millions of people's banking details is about as high risk as it can get.
So it outsourced the building of the datacentres and insourced the building of the IT infrastructure that sits in it. It did however hire the expertise of a consultancy, Xceed Group, to help it plan the infrastructure and used a system integrator for what Toivonen described as discovery, which is about working out what you need.
He also says the company outsources other functions where appropriate. This includes security, although the overall security leadership comes from Toivonen and his internal team.
So it is a bit of a pick and mix and shows that the options are there for outsourcing whatever you want. It is also a good example that helps explain why multi-sourcing is on the up.
Is there a company in the world that doesn't outsource something? I doubt it. Even companies like WorldPay with extremely high risks and security demands can outsource. It is a case of outsourcing where appropriate and retaining checks and balances.