Torrington Savings Bank Mobile — API integration & OpenFinance services

Deliverables checklist

• OpenAPI 3.1 specification covering every wrapped endpoint
• Protocol & auth report (token chain, device binding, refresh, anti-replay)
• Runnable Python (FastAPI) and Node.js (Express) reference servers
• FDX-shaped JSON samples for accounts, transactions, statements
• Pytest / Vitest suite plus a Postman / Bruno collection
• Compliance memo: Section 1033 readiness, NACHA notes for ACH transfers, retention guidance

Engagement workflow

1. Scope confirmation — which TSB Mobile screens you actually need (typically balances + statements + mobile deposit + bill-pay).
2. Authorization & sandbox setup — letters of authorization, test account, environment isolation.
3. Protocol analysis (2–5 business days) — reverse engineering of the mobile client's request surface, captured against an authorized account.
4. Build & internal validation (3–8 business days) — endpoints, FDX shaping, retries, idempotency keys.
5. Docs, sample apps, hand-off (1–2 business days) — runnable repo, OpenAPI, Postman, compliance memo.

1 · SMB accounting sync

A landscaping company holds its operating account at TSB. Their bookkeeper wants every posted transaction to land in QuickBooks Online without screen-scraping. We wrap /accounts + /transactions with FDX-style payloads and wire them into the QBO bank-feed sync. Pending and posted records are kept distinct so the books never double-post.

OpenFinance mapping: FDX Accounts + Transactions resources, paginated cursor model, daily incremental delta.

2 · Multi-bank net-worth dashboard

A wealth-tech app aggregates a customer's TSB checking, mortgage, and auto-loan alongside positions at other banks. We expose a unified balance + loan endpoint, refresh on a 4-hour cadence, and stream change events so the dashboard updates without polling on every tab change.

OpenFinance mapping: FDX Accounts.deposit + Accounts.loan, server-sent events for delta, consent receipts per refresh.

3 · Mobile deposit for a property manager

A property manager receives 200+ rent checks a month. Instead of a teller line, ops staff capture the check pair through our wrapper, which submits to the TSB mobile-deposit pipeline and emits a webhook for each state transition. Returned items are routed straight into a chargeback queue.

OpenFinance mapping: custom mRDC resource on top of the bank's mobile deposit flow, idempotent submission, signed webhook.

4 · Card-Controls fraud automation

A fraud-ops team needs to disable a stolen TSB debit card the moment a SIM-swap signal fires from their identity provider. We expose Card Controls as POST /cards/{id}/state and POST /cards/{id}/restrictions so the SOAR playbook can flip the card off, narrow it to a single zip code, or whitelist only ATM withdrawals.

OpenFinance mapping: stateful card resource, audit-logged state transitions, role-bound consents.

5 · Mortgage origination data packet

A non-bank lender needs 24 months of statements to underwrite a refinance. Under written customer authorization, we pull the structured statement record plus the PDF, hash both, and deliver them into the lender's encrypted intake bucket. The consent receipt is retained alongside the documents to support GLBA and CFPB review.

OpenFinance mapping: FDX Statements resource, retention markers, evidentiary consent log.

1 · Login & session bridge (pseudocode)

POST /api/v1/tsb/auth/login
Content-Type: application/json

{
  "user_id": "tsb_user",
  "password": "<redacted>",
  "device_token": "<binding token from /auth/device>",
  "biometric_assertion": null
}

200 OK
{
  "access_token": "tsb-acc-2c1f...",
  "refresh_token": "tsb-ref-9aab...",
  "expires_in": 1800,
  "device_bound": true,
  "mfa_required": false
}

Mirrors the TSB Mobile chain (User ID, password, optional Touch ID / Face ID assertion, device binding). Refresh tokens rotate; device binding is sticky.

2 · Statement export (FDX-shaped)

POST /api/v1/tsb/statement
Authorization: Bearer <ACCESS_TOKEN>
Content-Type: application/json

{
  "account_id": "ACC-1029384756",
  "from_date": "2026-04-01",
  "to_date":   "2026-04-30",
  "format":    "fdx-json"
}

200 OK
{
  "page": { "next": "cursor:af12..." },
  "transactions": [
    {
      "transactionId": "TXN-2026-04-15-00012",
      "postedTimestamp": "2026-04-15T14:02:11Z",
      "amount": -42.18,
      "currency": "USD",
      "description": "STOP & SHOP #234 TORRINGTON CT",
      "category": "Groceries",
      "status": "POSTED"
    }
  ]
}

3 · Mobile deposit webhook

POST <your-webhook>
X-OFL-Signature: sha256=...

{
  "event": "deposit.state_changed",
  "deposit_id": "DEP-2026-05-02-441",
  "account_id": "ACC-1029384756",
  "previous_state": "PROCESSING",
  "new_state": "POSTED",
  "amount": 1850.00,
  "occurred_at": "2026-05-02T11:14:09Z",
  "check_meta": { "front_sha256": "...", "back_sha256": "..." }
}

Errors follow RFC 7807. Idempotency on every POST via Idempotency-Key; replays return the stored response, never re-submit a deposit.

Regulatory frame

U.S. retail-bank integrations land under the CFPB Required Rulemaking on Personal Financial Data Rights (commonly "Section 1033"). The October 2024 final rule set phased dates of April 2026, 2027 and 2029 by institution size and is currently in reconsideration; small banks under the SBA $850M threshold sit outside the direct mandate, but their customers still have the same expectation of structured data access. We design every payload so it can be flipped from a documented bank-app integration to a direct Section 1033 endpoint with zero schema churn.

Adjacent rails — Reg E for electronic transfers, NACHA rules for ACH, the GLBA Safeguards Rule for data handling — are folded into the compliance memo we ship with every engagement.

Data flow / architecture

• 1. TSB Mobile client — authorized end user signs in.
• 2. Protocol bridge — our service replays the documented mobile request, with a per-call consent record.
• 3. Normalizer — payloads are reshaped into FDX-aligned JSON; PII is minimized to what the consumer scope grants.
• 4. Egress — REST API, webhooks, or batched delivery into your S3 / GCS / SFTP target.
• 5. Audit ledger — append-only consent and access log retained per your retention policy.

Connecticut neighbors

• Union Savings Bank — A Danbury-based mutual savings bank serving western Connecticut. Customers who hold a TSB checking and a Union Savings mortgage often want one combined transaction feed.
• Northwest Community Bank — Headquartered in Winsted with branches across Litchfield County; identical retail-banking record types to TSB.
• Litchfield Bancorp — A division of Northwest Community Bank with its own Android/iOS app; used heavily by small businesses in the same county.
• Torrington Federal Credit Union — Local credit union with a free mobile app; share-account data overlaps the same FDX deposit-account schema.

Regional & large banks customers also use

• Liberty Bank — Connecticut's largest mutual bank; common pairing for Litchfield County households who want a wider branch footprint.
• Webster Bank — A regional bank with strong small-business mobile tooling; integration teams often unify Webster commercial transactions with TSB personal accounts.
• Dime Community Bank — Mid-Atlantic community bank exposing the same RDC and treasury surface; useful reference for cross-bank API design.
• Community Bank N.A. — Multi-state community bank whose mobile app covers the same balance / transfer / RDC stack.

About us

OpenFinance Lab is an independent technical studio focused on mobile-app protocol analysis and API integration for fintech, banking, and payments. Our engineers come from card networks, core-banking platforms, and cloud security teams; we ship integrations that pass internal security review at our customers' counterparties.

• Banking, payments, lending, and treasury — across U.S., EU, MENA, and APAC
• FDX, OFX, Plaid Core Exchange, and Section 1033 conversance
• Custom Python, Node.js, and Go SDKs, plus runnable test harnesses
• End-to-end engagement: protocol analysis → build → validation → compliance memo
• Source-code delivery from $300 — runnable API source plus full documentation; pay after delivery upon satisfaction
• Pay-per-call API billing — call our hosted endpoints and pay only for the calls you make, no upfront cost

Contact

For a quote or to submit your target app and integration scope, open our contact page. We respond inside one business day.

Contact page

FAQ

What do you need from me to start a Torrington Savings Bank Mobile integration?

How long does delivery take for a US community bank app?

How do you handle compliance for US bank data integrations?

Can you cover Card Controls and account alerts as part of the integration?

Why this app, why now

U.S. open banking moved from voluntary to formal in late 2024, when the CFPB finalized its Section 1033 rule. Even with the 2026 reconsideration, every U.S. depository institution — including community banks like Torrington Savings Bank — is being pulled toward structured data access. Building the integration today, against the documented mobile surface, gives you a head start; the same code path flips to a direct 1033 endpoint when one is published.

Pair that with the bank's own 2024 refresh of its business checking line, and the small-business case for an accounting / treasury sync becomes immediate rather than aspirational.