Security
Your bank data, handled like a bank would.
Treasury software sees every account you own. We built Tessaly so that seeing is all it does unless you explicitly allow more, and so that every action leaves a record your auditors can follow.
Certifications and audits
SOC 2 Type II
Audited annually by an independent CPA firm across security, availability and confidentiality. The latest report is available under NDA.
ISO/IEC 27001:2022
Our information security management system is certified for the full Tessaly platform and the teams that operate it.
GDPR and UK GDPR
We act as a processor under a standard data processing agreement with EU Standard Contractual Clauses.
How the platform is built
Read-only by default
Bank connections are provisioned with balance and statement scopes only. Payment rights are a separate, opt-in connection that requires an administrator and a second approver.
Encryption
Data is encrypted in transit with TLS 1.2 or higher and at rest with AES-256. Bank credentials and tokens are held in a dedicated key management service and never shown to staff.
Data residency
US customers are hosted in AWS us-east-2 (Ohio). EU customers can choose AWS eu-central-1 (Frankfurt), with backups kept in the same region.
Access control
SAML single sign-on, SCIM provisioning, enforced MFA and role-based permissions down to the entity and account level.
Approvals
Payments and transfers above a limit you set require two approvers. Nobody can approve their own request.
Audit trail
Every login, rule change, forecast edit and payment is logged with who, what and when, retained for seven years and exportable as CSV.
Testing and response
An outside firm runs a full penetration test of the application and infrastructure every year, and we run continuous automated scanning between tests. Incidents are handled under a documented response plan, and affected customers are notified within 72 hours.
Found a vulnerability? Write to security@tessalyfi.com. We acknowledge reports within one business day.