Security Overview

Last Updated: September 29, 2026

T-X AI, Inc. handles sensitive financial data on behalf of our customers, and we design our infrastructure and practices around that responsibility. This page describes our security program as it operates today. We don’t list controls we haven’t implemented, and we update this page as our program matures.

Infrastructure

• Hosting: The Service runs on Microsoft Azure Kubernetes Service (AKS) in the Azure US East region.
• Database: PostgreSQL, run as a managed or dedicated instance within our Azure environment and not exposed directly to the public internet.
• File storage: Bank files (for example, BAI2 and CSV), other files customers upload or transfer to us, and generated artifacts are stored in Azure Blob Storage, isolated per environment.
• Network isolation: Production runs in its own Kubernetes namespace and virtual network, separated from development and staging environments.

Encryption

• In transit: All traffic between users and the Service is encrypted with TLS. Production serves HTTPS only, with no unencrypted HTTP endpoints.
• At rest: Data in Azure Blob Storage and our PostgreSQL database is encrypted at rest using Azure platform encryption (AES-256).
• Secrets: Application secrets (API keys, connection strings, signing keys) are stored in Azure Key Vault, not in source control or container images.

Authentication and Access Control

• Customer sign-in: Sign-in runs through Keycloak, an open-source identity and access management server we self-host inside our own infrastructure. We control how credentials and sessions are handled rather than relying on an external identity vendor.
• Password storage: Keycloak stores passwords as salted hashes and handles verification itself. Passwords never reach our application code in plaintext.
• Brute-force and session protection: Keycloak locks accounts after repeated failed login attempts, issues short-lived signed tokens (OIDC/OAuth 2.0) instead of long-lived credentials, and lets us revoke sessions centrally if an account is compromised.
• Role-based access: Each user’s roles determine what they can see and do in the Service, including which organization’s data they can access.

Internal Access

• Need-to-know: Access to production systems and Customer Data is limited to engineers who need it to operate and support the Service.
• Individual accounts: Every person uses an individual account. There are no shared credentials.
• Least privilege: Database and infrastructure access is scoped per service and role rather than granted as broad standing access.
• Remote access: Authorized personnel may access systems remotely, including from outside the United States. The same access controls apply wherever they are, and Customer Data remains stored in the United States.
• Access reviews: We review who has production access at least quarterly and remove access that is no longer needed.

Data Isolation

Customer Data is logically separated by organization at the application and database layers, so one customer’s bank data, files, and forecasts are not accessible to another customer.

AI and Your Data

The AI chat interface is designed so that your financial data stays in our infrastructure:

• Your question is sent to our AI provider (OpenAI), which interprets it and selects the right calculation.
• That calculation runs only in our own backend, which retrieves and computes on your bank and transaction data.
• To phrase the answer in plain language, the model may receive your message plus limited context, such as balances, category totals, forecast values, or scenario results.
• Raw bank files, full transaction ledgers, and bank account numbers are never sent to OpenAI.
• Anything you type into the chat is sent as written, so please don’t enter account numbers in chat messages.

Before sending data to OpenAI, we replace company, vendor, employee and account identifiers with pseudonymous codes. OpenAI receives amounts and categories, not who they relate to. Data is encrypted in transit and is not used to train OpenAI’s models.

OpenAI does not use data sent through our account to train its models. Forecasting and categorization models that learn from your corrections are used only for your organization’s account; we do not use Customer Data to train models shared across customers. We may create de-identified, aggregated benchmarks that cannot be linked to any customer, as described in our Privacy Policy, Section 2.

Integrations and Transfers Between Your Own Accounts

These controls apply when a customer enables an ERP integration:

• Access tokens: We store the access tokens you authorize in encrypted form and use them only to operate that integration. You can revoke them at any time, and we delete them when the integration is disconnected or your subscription ends.
• Own accounts only: The Service generates transfer instructions only between bank accounts your organization has registered as its own. It cannot send funds to an outside party.
• Human approval: No transfer instruction is sent to your ERP until an authorized user in your organization approves it.
• Audit trail: We record who created, approved, and sent each transfer instruction, and when.
• No AI in the file: The chat may suggest a transfer, but instructions and files are generated by our own software, not by the AI model.
• Execution stays with you: Transfers are executed by your ERP and your banks. T-X does not hold funds or connect directly to your bank to move money.

Application Security

• Files and data submitted to the Service are validated and processed within our own infrastructure.
• Dependencies and container images are kept up to date against known vulnerabilities.
• The Site and Service use no third-party analytics, advertising cookies, or tracking scripts, which reduces the number of outside parties that can observe activity in your session.
• Code changes are reviewed before deployment to production.
• Security-relevant events (sign-ins, permission changes, data exports, transfer approvals) are logged and retained for 12 months.

Retention, Backups, and Deletion

• Customer Data is kept for the length of your subscription plus up to 90 days, so you can recover or export it. It is then deleted from active systems.
• We take encrypted backups daily. Deleted data may remain in these backups until they are overwritten on our regular cycle. Backups are used only for disaster recovery.
• You can request earlier deletion at any time; we complete requests within 30 days.
• You can request an export of your Customer Data in a machine-readable format.

Subprocessors

We use a small number of vendors, each bound by written contracts that limit their use of data and require appropriate security:

• Microsoft Azure: hosts our compute, database, and storage in the United States.
• OpenAI: powers natural-language processing for the chat interface, as described above.

The current list, with what each vendor can access, is in our Privacy Policy, Section 3. We notify customers by email at least 30 days before adding or replacing a subprocessor that processes Customer Data.

Incident Response

If we confirm a security incident affecting Customer Data, we will notify affected customers without undue delay and provide the information they reasonably need to meet their own obligations. Details are in our Data Processing Addendum.

Certifications and Testing

T-X has not yet completed a SOC 2 audit or an independent penetration test. We will list them here when completed. In the meantime, we are glad to walk your team through our controls or complete your security questionnaire.

Reporting a Security Issue

If you discover a vulnerability in the Service, please report it to dk@t-x.ai before disclosing it publicly. We acknowledge reports within 1 business day and will work with you to understand and fix the issue. We will not pursue action against researchers who report in good faith and avoid accessing other customers’ data.

Questions

For security questions or to request our security questionnaire responses, contact dk@t-x.ai.