Actions in your systems

The Texa Relay

For banks and others whose data may not leave their network. The Relay runs inside it, connects out, and runs only the read-only lookups your administrator signed.

The Texa Relay lets Texa AI look things up in your systems (a transfer's status, an account's state) without your data or credentials leaving your network and without opening any inbound port. It is a single program (also a container image) that runs on a server of yours, connects out to Texa over mutual TLS, and runs only the operations your administrator wrote, reviewed and signed.

What it can and cannot do

• It runs only the named operations in your signed file: a SELECT your team wrote, or a call to one of your internal services. Texa sends an operation's name and values for its declared parameters, never SQL, a URL or a header.
• Queries are read-only. Each is checked to be a single SELECT, the database login must be read-only (checked at start), and every query runs in a read-only transaction.
• Limits you set: rows, time, response size, requests a minute, how many at once.
• Masking: account numbers to the last four digits, card numbers to the first six and last four, BVN and NIN hashed, dates of birth to the year. Per column, or by column name everywhere.
• Customer checks: an operation can require that Texa has verified the customer first.
• An audit log on your disk, hash-chained, so a changed or removed line shows.
• Your kill switch: create /var/lib/texa-relay/KILL (or send SIGUSR1) and nothing runs until it's removed. Texa can't lift your switch.

Databases and systems

Postgres, MySQL, SQL Server and Oracle, and HTTP services answering JSON, XML, OFS or text. Templates are included for Finacle, Temenos Transact (T24) and Oracle FLEXCUBE.

Setting it up

The full guide for your IT team, with the configuration file, signing, enrolment and operations, is in Hosting and security → Install the Texa Relay. In outline:

1. Your administrator makes a signing key and keeps the private half off the Relay server.
2. Your team writes relay.yaml: the databases, and each operation's query, parameters, outputs and masking. Start from a template.
3. The administrator signs the file. The Relay refuses an unsigned or changed file.
4. In Texa Desk, Texa AI → Actions → Relay → Add a relay, then run the enrol command it shows on your server. The token works once, for 24 hours.
5. Bind each operation to an action, and name the action in your procedures.

You see each relay's health, operations and alerts on the same screen, and can switch one off.