Trust & security
Trusting software with your company's money
Being careful about that is the right instinct. This page sets out what Telore can see, what it cannot do, why your books cannot be quietly rewritten, how it protects you from invoice fraud — and what we have not done yet. No badges, because we have not earned any.
The short version
-
Reads, never pays on its own
No bank or payment connection lets Telore move, withdraw or send your money. A payment is always started by a person and confirmed on the bank's own screen.
-
Encrypted and kept in the UK
Data and files are encrypted and stored in London, on Amazon Web Services.
-
Books that cannot be rewritten
A posted entry is permanent. Corrections are new entries, and the database itself refuses an edit.
-
Built against invoice fraud
Verified companies, guarded bank details and invoices your customers can check.
- Registered in England and Wales
- Company no. 17458232
- ICO registered (ZC267397)
- Data stored in the UK
What a connection can and cannot do
Connecting an account is the moment most people hesitate. Here is the whole arrangement.
It cannot move your money, by design
When you connect your bank, Telore asks for permission to read transactions and balances. With Stripe it also asks to open payment pages for your own invoices, so your customers can pay by card. Neither permission lets Telore move, withdraw or send your money.
Your banking login never touches Telore
You approve the connection on your bank's own app or website. Your password is typed into their screen, never ours.
The access key is encrypted
What Telore keeps is a key that lets it read the account, encrypted with AES-256-GCM using a key held apart from the database.
Paying a bill is yours to start
Paying an approved supplier bill is started in Telore by a person and confirmed on the bank's own screen through Open Banking — each payment, every time.
Open Banking permission lasts for a limited time set by the rules, then you approve it again on your bank's app. Disconnect any account in one press and nothing new arrives.
Where your data lives, and who can open it
- In London
- Your company's data and files are kept on Amazon Web Services in London (eu-west-2).
- Encrypted at rest and in transit
- Every connection uses TLS. Stored files are encrypted, and credentials are encrypted again before they are written down.
- Files that are not public
- Receipts and documents sit in private storage. A file is opened only after Telore checks you may see it, through a link that expires in 30 minutes.
- One company at a time
- Every record belongs to exactly one company, and every query is limited to the company you are signed in to.
- Kept as the law asks
- Accounting records are kept for as long as the law requires — usually six years from the end of the financial year — and permanent deletion waits until that has passed.
Once an entry is posted, it can never be edited or deleted
Plenty of software lets a figure be changed after the fact and notes that it happened. Telore does not allow the change at all. If a payment was recorded in the wrong place, the original stays exactly where it is and two new entries put it right — one that cancels it, one that records it properly.
| Entry | Date | Amount | Status | |
|---|---|---|---|---|
| JRN-0184 | 23/08/2026 | Apple — recorded as Equipment | £89.00 | Posted, locked |
| JRN-0207 | 02/09/2026 | Reverses JRN-0184 in full | −£89.00 | Correction |
| JRN-0208 | 02/09/2026 | Apple — recorded as Software | £89.00 | Posted, locked |
The refusal comes from the database, not from a screen, so a bug in our own code cannot get round it.
Telore also checks its own books: every entry balanced, every account's total agreeing with the entries behind it, every document matched to its record. A disagreement is raised, not hidden.
Built against invoice fraud
Most invoice fraud is a convincing invoice with a different bank account on it. Telore makes that harder to pull off, from both ends.
- Verified companies A company shows "Verified company" only after a person who runs it proves who they are and that they can act for it. The badge goes the moment that stops being true.
- Bank details guarded A change to the account printed on your invoices is confirmed again, every owner is told, and invoices printing it are held until someone says yes.
- Checkable invoices Each invoice has its own page at telore.com, reached by its link or QR code, so a customer can check it before paying.
- A report button on every email Anyone who receives a Telore email can report it to us in one click.
- Limits for new companies A brand-new account can email only a few customers a day until it has shown who runs it.
Northstar Labs Ltd via Telore
Invoice INV-0042 from Northstar Labs Ltd
Hello Amara,
Please find attached invoice INV-0042 for £3,600.00, due by 4 November 2026.
View invoiceTelore has verified this company's identity and authority.
The account on your invoices changed
Ben Carter changed the receiving account at 09:14. Invoices that print it are held until an owner confirms the change.
Example view
Signing in, and staying signed in safely
Two-step sign-in and passkeys
Use an authenticator app or a passkey on your phone or computer, with recovery codes kept for the day you lose a device. An account with a passkey confirms with it after a password or an emailed code too.
Leaked passwords are refused
A new password is checked against known leak lists. The password itself is never sent anywhere: only the first five characters of its fingerprint are asked about, and the comparison happens on our own server.
Told about new devices
A sign-in from a device Telore has not seen is emailed to you at once, and cannot be switched off.
A second look for sensitive changes
Changing your email, the account customers pay into or who can act for the company asks you to confirm who you are again.
Signed out when idle
An open screen nobody is using signs itself out, and repeated wrong passwords are slowed down and then stopped.
Ask Telore, and the rules it works under
- Ask Telore suggests and explains; it never posts, sends or files anything on its own.
- Tax, VAT and payroll figures are worked out by the published rules, not by AI.
- Your company's data is not used to train AI models.
- An owner can switch Ask Telore off for the company.
What we have not done yet
Security pages usually end with a row of logos. Ours would be an empty row, so here it is in words.
- Telore holds no security certification yet, such as ISO 27001 or SOC 2.
- No independent penetration test report has been published yet.
- Telore is a young product built by a small team, and launches in 2027.
When any of that changes, this page will name it, date it and link to the evidence — and if a line above stops being true, it comes off this page with the reason.
Found something wrong? Tell us.
If you have found a security problem in Telore, we would much rather hear it from you than from a customer. Write to us; a person reads it.
- We will not pursue anyone who reports a genuine problem responsibly and gives us a fair chance to fix it first.
- There is no paid bug bounty. We will credit you by name if you would like, and tell you when the fix is out.
- Please include what you found, where, and how to see it again.
Launching in 2027
Be one of the first companies on Telore
Telore launches in 2027. Leave your email and we will write when you can sign up. Every plan starts with a 30-day free trial.
One email at launch, and nothing else unless you ask.