Service-oriented, single source of truth
Capabilities are separate services over one commercial record. No module keeps its own copy of a rate, a contract or a booking.
Home/Technology
Technology
Unremarkable infrastructure. Deliberately.
The commercial layer can afford to be ambitious because the layer underneath is not. Typed, tested, versioned, observable — and boring enough to trust with someone else’s money.
Typed end to end
Schema and application types are kept in agreement deliberately. A large share of production incidents in this domain are type and rounding mistakes, so they are engineered out rather than tested for later.
Money handled in one place
Currency arithmetic, rounding and tax treatment are centralised. Financial calculations are not reimplemented per feature.
Observable by default
Health checks, structured logs and request tracing across services, so a support question has an answer rather than a theory.
Least privilege throughout
Access is scoped by role at the service layer. The interface hides what a person cannot do; the service refuses it.
Degrades gracefully
Rate limiting and defined fallbacks on dependent services, so one slow integration does not take a booking path down.
- Interfaces
- Documented & versioned
API & connectivity
If it is not documented, it is not an interface.
Partners build against TESSMA. That obligation shapes how the API is treated: stable payloads, explicit versioning, errors that say what went wrong and which field caused it.
Undocumented behaviour is treated as a defect, not a feature.
- REST interfaces with versioned contracts and deprecation notice
- Structured errors with field-level detail
- Integration capabilities provided as part of approved commercial implementation projects
- Certified connections to operational systems, confirmed during scoping
Security & compliance
What we do, and what we have not yet earned the right to claim.
Security pages are where technology companies are most tempted to overstate. Below is the split between what is implemented today and what remains a formal process still under way.
Implemented
Role-based access control enforced at the service layer, scoped tokens, structural tenant separation, recorded administrative actions, and audit records on contract, rate and payment changes.
In progress
Independent certification and formal attestation are handled as a documented programme rather than a marketing claim. Certification status — to confirm
Certification names, audit reports, penetration test summaries and data-residency commitments will be listed here with dates once independently completed. Until then this section states only what is built. A security summary can be requested under NDA via the Contact page.
Applied AI
Three rules we hold ourselves to.
Hospitality does not need a system that guesses confidently. It needs one that drafts the proposal, summarises the account, flags the contract clause — and shows exactly which data it read.
- Show the input. Every assisted output displays the records it read.
- Keep the human. Anything that changes a rate, a term or a payment needs a person to approve it.
- Fail visibly. When a model is unavailable or uncertain, the system says so and falls back to defined rules rather than guessing.
Where TESSMA uses third-party model providers, that is a stated architectural choice and the provider set is disclosed to clients under contract.
Stack
Chosen for longevity, not novelty.
We publish the shape of the stack rather than a logo wall, because what matters to a partner is whether it will still be maintainable in five years.
TypeScriptNode service layerRelational coreReact front endREST APIsServer-side renderingContainerised deploysStructured loggingAutomated test suitesLoad & failure testing
Send us your hardest integration question.
Technical evaluation is welcome and expected. If something is not built yet, we will say so.