# The Texa Relay

For banks and others whose data may not leave their network. The Relay runs inside it, connects out, and runs only the read-only lookups your administrator signed.


!!! note "On request"
    The Texa Relay is built and tested. Its connection point on Texa's hosting is set up per
    company: ask [info@texadesk.com](mailto:info@texadesk.com) before you plan a rollout.

The Texa Relay lets Texa AI look things up in your systems (a transfer's status, an account's
state) **without your data or credentials leaving your network** and **without opening any inbound
port**. It is a single program (also a container image) that runs on a server of yours, connects
*out* to Texa over mutual TLS, and runs only the operations your administrator wrote, reviewed and
signed.

## What it can and cannot do

- It runs **only the named operations in your signed file**: a `SELECT` your team wrote, or a call
  to one of your internal services. Texa sends an operation's name and values for its declared
  parameters, **never SQL, a URL or a header**.
- **Queries are read-only.** Each is checked to be a single `SELECT`, the database login must be
  read-only (checked at start), and every query runs in a read-only transaction.
- **Limits you set:** rows, time, response size, requests a minute, how many at once.
- **Masking:** account numbers to the last four digits, card numbers to the first six and last
  four, BVN and NIN hashed, dates of birth to the year. Per column, or by column name everywhere.
- **Customer checks:** an operation can require that Texa has verified the customer first.
- **An audit log on your disk**, hash-chained, so a changed or removed line shows.
- **Your kill switch:** create `/var/lib/texa-relay/KILL` (or send `SIGUSR1`) and nothing runs
  until it's removed. Texa can't lift your switch.

## Databases and systems

Postgres, MySQL, SQL Server and Oracle, and HTTP services answering JSON, XML, OFS or text.
Templates are included for **Finacle**, **Temenos Transact (T24)** and **Oracle FLEXCUBE**.

## Setting it up

The full guide for your IT team, with the configuration file, signing, enrolment and operations, is
in [Hosting and security → Install the Texa Relay](/hosting/relay-install). In outline:

1. Your administrator makes a signing key and keeps the private half off the Relay server.
2. Your team writes `relay.yaml`: the databases, and each operation's query, parameters, outputs and
   masking. Start from a template.
3. The administrator signs the file. The Relay refuses an unsigned or changed file.
4. In Texa Desk, **Texa AI → Actions → Relay → Add a relay**, then run the enrol command it shows on
   your server. The token works once, for 24 hours.
5. **Bind** each operation to an action, and name the action in your procedures.

You see each relay's health, operations and alerts on the same screen, and can switch one off.