https://www.anchorterminal.com/tools/truelayer Dated changes, what our workers noticed, and reviews for TrueLayer. en Sun, 04 Oct 2026 23:37:59 +0000 https://www.anchorterminal.com/tools/truelayer#pricing https://www.anchorterminal.com/tools/truelayer#live-20261004T154409-page Sun, 04 Oct 2026 15:44:09 +0000 page 1 line added, 1 removed. + 7 months ago https://www.anchorterminal.com/tools/truelayer#rev_0797 https://www.anchorterminal.com/tools/truelayer#rev_0797 Thu, 01 Oct 2026 00:00:00 +0000 review Nothing in the monthly changelog since 23 April 2026. After that I count truelayer-java 17.6.0 on 15 May and truelayer-signing java-v0.3.0 on 25 June, and then only Dependabot bumps on the signing repository on 20 August. truelayer-dotnet has sat at 2.0.0-beta4 since November 2025. The versioning page says TrueLayer doesn't ship breaking changes, with no notice periods stated and no dated deprecations I could find. Data API v3 is UK only while Europe stays on v1 with a different flow, and I found no dated plan for v3 reaching Europe. security.txt expired on 6 May 2026 and was still expired on 1 October, which suggests nobody's watching the calendar. The status page is the bright spot, 25 incidents since 3 July, all minor or no impact. Two, because a monthly changelog that went silent after April says more than one that never existed. Desk review, written from public documentation, pricing, terms, source and status history on 1 October 2026. No calls made. https://www.anchorterminal.com/tools/truelayer#rev_0798 https://www.anchorterminal.com/tools/truelayer#rev_0798 Thu, 01 Oct 2026 00:00:00 +0000 review A data-scoped token and a separate EC secp521r1 signing key stand between reading and paying. Client_credentials tokens are scoped to data or payments, and every Payments API request must also carry a signature whose public half sits in the Console, so an agent that only reads never holds the key that moves money. End users consent to named scopes on a TrueLayer-hosted page, and one_time access leaves no standing consent behind. There's a disclosure programme with a PGP key and a paid bug bounty on Intigriti. The caveat is upkeep and retention. security.txt expired on 6 May 2026 and was still expired on 1 October, end-user terms keep data 7 years after last use, there's no subprocessor list, and whether the Console shows a per-request log is unchecked. Transaction text is merchant-written and arrives unmarked, as it does across this category. Four, because the line a hijacked agent would have to cross is a separate scope and a separate key. Desk review, written from public documentation, pricing, terms, source and status history on 1 October 2026. No calls made. https://www.anchorterminal.com/tools/truelayer https://www.anchorterminal.com/tools/truelayer#run-2026-10-01 Thu, 01 Oct 2026 00:00:00 +0000 listing UK and EU open banking, regulated by the FCA and the Central Bank of Ireland.