Solvexia Security Architecture Guide for IT Teams

This page is a starting point for your security review, not a substitute for one. Confirm current certification status and specific requirements directly with Solvexia's security team.

Solvexia security, architecture and integration, what IT teams need to know

This page covers Solvexia security architecture, hosting infrastructure, certifications, permissions model, SSO configuration, data residency, and API connectivity for IT and security teams conducting a procurement review. It is a starting point for a formal security evaluation, not a substitute for one.

Is this page for you? (Audience note)

This page is written for IT and security evaluators conducting a technical procurement review of Solvexia's architecture, certifications, and integration layer. If you are a controller, finance operations manager, or finance team lead evaluating Solvexia's reconciliation capabilities rather than its technical infrastructure, the pages you need are different.

For how to evaluate Solvexia against other reconciliation platforms, see How to Evaluate Reconciliation Software.

For what implementation actually looks like from the finance team's perspective, see How Solvexia Implementation Works.

How is Solvexia hosted and where is data stored?

Solvexia runs on Microsoft Azure. According to Solvexia's security documentation, Solvexia's Azure hosting setup includes encryption in transit and at rest within the client database. Microsoft Azure infrastructure is used with appropriate system hardening and data privacy processes in place.

Instances are available in Australian, EU, and US regions, covered in more detail in the data residency section below.

Following the January 2026 acquisition, Solvexia is part of Ripple Treasury (formerly GTreasury), a treasury platform trusted by more than 1,000 customers across 160 countries. Solvexia's infrastructure sits within a platform serving regulated financial institutions globally, with the compliance expectations that accompany that scale.

What APIs and connectors does Solvexia offer?

Solvexia connects to source systems through two mechanisms: API-based connectivity and file-based transfer over SFTP. Prebuilt connectors cover four systems, with a general API connector handling everything else, the full breakdown, including SAP and Oracle, is in the ERP connector section below.

How the integration layer works in practice

The no-code rule builder abstracts the integration layer so the finance team configures connections without writing API code. The underlying connectivity is genuine API-level integration, not file upload presented as one. 

IT teams evaluating the integration architecture should note that initial API connections to back-end systems such as ERPs typically require IT involvement for authentication and access configuration, estimated at approximately one day of IT time. All ongoing data ingestion after initial setup runs without IT involvement.

For technical integration documentation and Solvexia API documentation, see Solvexia Security and Trust.

How does Solvexia handle user permissions and role-based access?

Solvexia uses a role-based access control model with fixed permission bundles. There are three account-level roles:

Subscriber

Can access Subscriber View and execute processes but cannot create or modify them. This is the appropriate role for finance team members who run reconciliations but do not build or maintain workflows.

Designer

Has access to Subscriber and Designer views. Can create automated solutions using Solvexia's core features, including processes, data storage, and reporting. This is the role for finance users who build and maintain matching rules and workflows.

Client Admin

Has the same permissions as a Designer, with the added ability to manage the organization directory through Solvexia Admin. This is the appropriate role for the internal platform owner responsible for user management.

The model is role-based with fixed permission bundles rather than attribute-based or fully custom per organization. Access changes and all workflow actions are logged in the audit trail, providing a system-generated record for compliance and review purposes.

For how the audit trail captures match decisions, rule changes, and approvals, see How to Evaluate Reconciliation Software and Questions to Ask Every Reconciliation Software Vendor.

Does Solvexia support SSO and what identity providers?

Solvexia supports single sign-on using the SAML 2.0 protocol. SSO is available to all organizations regardless of plan and is not restricted to an enterprise tier.

SSO is not enabled by default. It requires individual configuration as part of your implementation setup. If your identity provider federates over SAML 2.0, it can be configured to work with Solvexia. Confirm the specific configuration requirements with Solvexia's team during implementation rather than assuming compatibility based on protocol alone.

For a complete list of supported identity providers and configuration documentation, contact Solvexia directly or raise it during your security review. Do not rely on third-party sources for SSO compatibility claims, as these may not reflect the current product configuration.

What security certifications does Solvexia hold?

If you’re wondering “Is Solvexia SOC2 compliant?” know that Solvexia holds a SOC 2 Type 2 report covering its system of controls and operational processes against the standards established by the AICPA. Its processes and practices are GDPR compliant, and Solvexia applies GDPR standards across all locations rather than only for EU customers.

Penetration testing and review of the service is carried out every four months by the security firm Division 5. Current reports and the full security summary are available from Solvexia's trust center on request. 

Solvexia is part of Ripple Treasury (formerly GTreasury), a platform serving regulated financial institutions globally, but the certifications stated above reflect Solvexia's own confirmed status rather than the parent entity.

How does Solvexia handle data residency for regulated industries?

Solvexia instances are available in three regions: Australian, EU, and US. Confirm the specific region available for your deployment with Solvexia's team during your security review, as regional availability may vary depending on your organization's requirements and contractual arrangements.

On data protection, Solvexia applies European GDPR standards across all locations rather than only for EU customers.

Two distinctions regulated buyers should make explicit before contracting:

First, a regional instance and a specific regulatory attestation are not the same thing. A deployment in the Australian region does not automatically constitute APRA compliance or Australian data sovereignty attestation. Buyers with specific sovereignty obligations under APRA, EU financial services regulation, or equivalent frameworks should seek written confirmation of the contractual commitments available for their specific regulatory context, not rely on regional instance availability alone.

Second, this page is a starting point for a security review, not a substitute for one. Regulated industry buyers should engage Solvexia's security team directly for jurisdiction-specific commitments before contracting.

For full data privacy and Solvexia data residency documentation, see Solvexia Security and Solvexia Trust Center.

Which ERPs does Solvexia have prebuilt connectors for — and what about the rest?

Solvexia ships prebuilt API connectors for the following systems:

• NetSuite
• Xero
• Microsoft Dynamics 365
• OneDrive

SAP

For SAP, there is no prebuilt connector. Integration runs through Solvexia's general API connector, which works with any system that exposes an API. SAP integration is achievable but configured rather than prebuilt. The effort depends on what your SAP instance exposes. Raise this early in your evaluation as a scoping question, not a blocker.

Oracle

For Oracle, there is also no prebuilt connector. The same general API connector applies. Oracle integration is configured per deployment depending on the APIs your instance supports.

All other ERPs, banks, and payment service providers

Solvexia's general API connector handles any system that exposes an API. For systems that do not support API access, SFTP file-based transfer is available as the fallback. There are too many payment service providers for prebuilt connectors to every one, so the general connector handles them. The major PSPs work through this route without issue.

If your primary source system is SAP or Oracle, confirm the specific integration approach with Solvexia's technical team during scoping.

How does Solvexia support segregation of duties at the system level?

Segregation of duties in Solvexia is configured through role separation between preparation, review, and approval. The three account-level roles, Subscriber, Designer, and Client Admin, define what each user can access and modify at the platform level, with approval steps within individual processes configured separately from these account-level roles.

In practice, the three account-level roles are access permissions rather than workflow gates: they control what a user can see, run, build and administer, not whether a particular reconciliation requires a second person to approve it. That control sits in the approval steps configured within each process. 

Separation of duties is therefore achieved by configuration, assigning permissions and approval steps so that no individual holds the combination needed to both prepare and approve the same reconciliation, rather than by a platform-level block that cannot be switched off.

The distinction that matters to auditors and compliance reviewers is whether this separation is system-enforced, meaning the platform technically prevents a single user from completing an entire workflow end-to-end without a second approver, or merely configurable, meaning an administrator sets it up but the system does not structurally block self-approval. Confirm with Solvexia's team whether your required separation is enforced at the workflow level for your specific configuration.

For the buyer-facing treatment of segregation of duties in demo evaluation, see Questions to Ask Every Reconciliation Software Vendor.

Conclusion

Solvexia security architecture is built on Microsoft Azure with SOC 2 Type 2 attestation, GDPR compliance applied globally, four-monthly penetration testing by Division 5, and role-based access controls with a full system-generated audit trail on every run. 

Following the January 2026 acquisition, Solvexia is part of Ripple Treasury (formerly GTreasury), a platform serving regulated financial institutions across 160 countries. This page is a starting point for a formal security review, not a substitute for one. 

For full documentation, see Solvexia Security and Solvexia Trust Center, or contact Solvexia's security team directly.