When a financial data vendor only reads data, with no trading, no withdrawals, and no ability to move funds, it’s tempting to treat security as someone else’s problem. We don’t see it that way, and no vendor in our position should.
Why security matters even without write access
Being “read-only” limits what an attacker can do with a compromised account, but it does nothing to limit what they can learn, or where they can go next. Three reasons stand out:
- Data is a crown jewel in its own right. Balances, holdings, transaction histories, and account structures are sensitive on their own terms, independent of whether they can be used to move money directly. In the wrong hands, that information fuels fraud, extortion, and highly targeted social engineering. No trading permissions required.
- The vendor-customer relationship itself is a path to lateral movement. An attacker doesn’t need to breach a customer directly if it can compromise a vendor sitting inside dozens of customer environments at once. A single weak link in a vendor’s systems, credentials, or internal access controls becomes a bridge into every organization on the other side of it.
- Every exposed data point increases the attack surface. Each API key, each read-only connection, each shared credential is one more thing that has to be provisioned, secured, monitored, and revoked correctly. Multiply that across hundreds of customers, and the exposure compounds quickly – one missed rotation or one overly broad permission is all it takes.
What does TRES do to manage this problem?
Because we sit in this position, we treat security as core infrastructure, not an afterthought:
- Corporate security built on Fireblocks. Our internal security posture runs on the same infrastructure that secures trillions of dollars in digital assets across the industry. We don’t build critical controls from scratch, we inherit the best in the business.
- A culture of disciplined alertness. Every employee goes through continuous security training, but the real control is cultural. Recognising phishing, social engineering, and suspicious requests is second nature here, and everyone stays on constant alert. It isn’t a once-a-year compliance checkbox, it’s the way TRES operates day-to-day.
- Internal security experts. A dedicated internal team continuously, and relentlessly, reviews our systems, access controls, and practices. Security ownership isn’t outsourced or occasional, it’s a standing function inside the company.
- Secured vendor-customer communication. We hold our communication channels to the same standard as our systems:
- Official email only, always.
- Slack for day-to-day customer communication.
- Never Telegram, under any circumstance.
- No requests to install software during meetings or calls.
- When in doubt, we verify through an official channel before acting on anything that feels off.
None of this is optional, and none of it is new for us, it’s how we’ve operated from day one. Being a ‘read-only’ ecosystem doesn’t reduce our responsibility to protect our customers; it defines it. A vendor that can’t move your money can still put it, and you, at risk if it isn’t careful with what it can see and who it talks to.
Trust is one of the core products that we’re actually selling, whether or not it appears on the invoice. We work to earn it every day, in every connection, every message, and every line of code.
Interested in TRES?
