Financial Services Beta · Security Platform

One platform for the audits, the brokering, and the agents.

Payments, lending, trading, and fintech platforms run inside an unforgiving compliance perimeter. Tessarac collapses identity, secrets, privileged access, EDR, and CSPM into one auditable platform — designed around PCI-DSS v4, SOC 2 and NYDFS Part 500 controls.

Not available yet. This page describes the Security Platform we are building; ACOG is the product you can use today.

Talk to us See what's available now

Regulatory posture

The frameworks the audit team actually has to defend.

A modern fintech maps to PCI-DSS v4 (cardholder data), SOC 2 Type 2 (operational controls), NYDFS Part 500 (NY-regulated entities), and SEC Reg SCI (covered exchanges and clearing agencies). Tessarac's per-tenant compliance presets are designed to set these baselines and surface the evidence in the admin console.

  • PCI-DSS v4 — a reference architecture for cardholder-data deployments is planned
  • SOC 2 Type 2 — Tessarac's first planned attestation; no audit has started (see the Trust Center)
  • NYDFS Part 500 — multi-factor at every privileged access, encryption in transit and at rest, annual penetration testing evidence
  • Reg SCI — designed to capture system audit and change-control evidence continuously
  • GLBA Safeguards Rule + CCPA / CPRA — customer data handling controls + per-tenant audit visibility

The fintech-shaped deployment

Customer identity for the consumer side, workforce identity for the operations side, brokered access for the systems that move money. One platform, one audit log, one cost line.

  • CIAM at consumer scale

    Sign-in flows for the consumer side of your product — passkeys, social federation, magic links. B2B multi-tenant for treasury / corporate-banking customers. Branded hosted UI per customer brand.

  • Brokered access to settlement systems

    SSH, RDP, and database protocol proxy with MFA challenge at every session and full replay. Just-in-time approvals route to Slack or PagerDuty. Standing privilege reduced to zero by default.

  • Sentinel on every host

    Hardware-bound TPM identity defeats credential extraction. eBPF telemetry on every Linux trading server, ETW + WFP on every Windows ops workstation. Out-of-band cordon if anything is compromised.

  • Customer-visible audit

    Every consumer login, every privileged access session, every settlement-system change is captured per tenant. Customers see their own audit log; auditors see the chain. Export to your SIEM or to any object-storage bucket you own.

Migration arc

A migration you can run in parallel first.

The typical fintech swap is Okta + HashiCorp Vault + a homemade PAM stack. Tessarac is designed to run in shadow mode, parallel to the existing IdP, with assertions that the auth events match. Cutover is one allowed-issuer change in your apps.

  • Shadow-mode pilot — Tessarac receives every Okta auth event in parallel; verify before flipping
  • Vault import path — KV first, then database roles, then PKI, then SSH
  • Reference deployments for fintech on the major clouds (active-active across two regions) are planned
  • Designed to generate the PCI-DSS v4 evidence packet continuously, so audit day is not a fire drill

Talk to a Tessarac fintech architect

The Security Platform is in beta. Design partners help shape the fintech migration path.

Get a demo Read the docs