Security & compliance

Tessera never receives your data. Objects are encrypted and erasure-coded on your machine, and the resulting shards are written directly from your client to storage providers. The API coordinates; it does not carry payloads. In practical terms this means a full compromise of Tessera's servers would expose placement metadata and slab parameters — not a browsable copy of your files, because no such copy exists anywhere in our infrastructure.

Two properties follow that are worth stating plainly. First, no single storage provider holds anything reconstructable, so provider compromise is not a confidentiality event. Second, because the service is not in the data path, its availability is not a precondition for your data's continued existence — see resilience and continuity.

The Tessera control plane runs on Amazon Web Services. We inherit the security of the underlying physical and virtualised infrastructure, which is audited annually and covered by:

• SOC 2 Type II and SOC 3
• ISO/IEC 27001:2022 — information security management
• ISO/IEC 27017 — cloud security controls
• ISO/IEC 27018 — protection of personal data in the cloud
• PCI DSS Level 1 and CSA STAR

Underlying regions are not published. Region and residency commitments are made contractually for customers with a specific requirement, and are disclosed under NDA on request.

This section describes the technical controls applied to customer content at each stage of its life — in transit, at rest, in respect of keys, and at deletion.

Data in transit

Public APITLS 1.3

All requests to the Tessera API terminate over TLS 1.3 with modern cipher suites, HSTS, and no support for deprecated protocol versions. Certificates are issued by a public CA and renewed automatically.

Shard transferRHP4 over QUIC

Object shards travel directly between your client and each storage provider over an encrypted QUIC session. Tessera is not an intermediary and never sees the payload.

Provider identityed25519 key possession

A provider is identified by its ed25519 public key and must prove possession of the corresponding private key inside the protocol. Identity is therefore bound to the key, not to a transport certificate — an important distinction we would rather state than gloss over.

Request authenticityed25519 signatures

Every authenticated API call carries a signature over the HTTP method, host, path, expiry timestamp, and request body. Replay is bounded by a caller-set expiry, and a tampered body invalidates the signature.

Data at rest

Client-side encryptionBefore transmission

Data is encrypted by your client before erasure coding. Providers only ever store ciphertext fragments, and cannot determine file boundaries, content type, or structure from what they hold.

Fragmentation as a control1 of 15 is useless

Erasure coding is not only a durability mechanism, it is a confidentiality one. A single shard is mathematically insufficient to recover any portion of plaintext, and no provider receives more than one shard of a slab. An attacker must compromise 10 unrelated companies before decryption is even a question.

Integrity verificationMerkle sector roots

Each shard is content-addressed by a Merkle root recorded at write time. Shards are verified against their root on read; a provider returning altered or truncated bytes is detected, rejected, and scheduled for repair. Silent corruption cannot propagate into a reconstruction.

Control-plane storageEncrypted volumes

Placement metadata is held in the Tessera control plane on encrypted storage, with snapshots taken continuously and stored encrypted. The control plane holds no object payloads.

Key management

Your credentialPrivate half never transmitted

Your API credential is an ed25519 keypair. The private key is generated for you once at provisioning, returned exactly once, and never stored by us in a recoverable form — we hold only the public half, which doubles as your account identifier. If you lose it, we cannot recover it; you provision a new credential and revoke the old one.

Object data keysStored wrapped

The key protecting an object's contents is stored in the manifest in wrapped form. Tessera cannot unwrap it without key material held by your client.

Slab parametersHeld by Tessera

To serve reads and to drive repair without your participation, the control plane holds the per-slab encryption parameters recorded at write time. You should therefore treat Tessera as a party with logical access to slab-level key material, and treat our controls — not cryptography alone — as what protects it. Moving to client-wrapped slab keys, which would remove that access entirely, is on our roadmap; we will say so on this page when it ships, and not before.

Access control

Tenant isolation

Every manifest record is bound to the account that created it. A request signed by one credential cannot read, modify, or delete another account's objects; cross-account attempts are refused, not silently ignored.

No ambient authority

There are no sessions, no cookies, and no bearer tokens that remain valid once copied. Each request is independently signed and independently expires.

Rate limiting

Requests are limited per credential — 30 per minute with a 3 per second burst allowance — and credential provisioning is limited per source address to 5 per hour.

Internal access

Operator access to production systems is restricted to named individuals, requires multi-factor authentication, and is scoped to the minimum required for the task. Administrative endpoints are separated from the customer API surface and are not reachable with customer credentials.

Retention, deletion & portability

DeletionImmediate, then reclaimed

Deleting an object removes it from the manifest immediately: it becomes unreadable through the API and unrecoverable by us. The underlying shards are then reclaimed from providers and, in any case, cease to be retained when the storage contract covering them expires. We do not claim instantaneous cryptographic erasure of already-distributed fragments, because that is not what happens.

RetentionContract-bounded

Shards persist only for as long as a funded storage contract covers them. Contracts run roughly 12 weeks and are renewed while an object is live.

Data portabilityNo lock-in

Objects and their placement records are readable through the API at any time, in a documented format, with no export fee and no notice period.

Account terminationCredential revocation

Revoking a credential stops authorisation at the next request. Revocation is immediate and does not wait for a token lifetime to elapse.

Each framework below carries a status label. Certified — inherited means an independent auditor has certified our infrastructure provider, not us. Self-assessed means we have completed the assessment ourselves and can share the workbook. Aligned — internal means we use the standard as an engineering checklist without external verification. Roadmap means not yet started.

Roles

For customer content, you are the controller and Tessera is the processor: we store what you instruct us to store and nothing more. For account, billing, and security records we act as controller in our own right.

Lawful basis

Processing of account and billing data rests on performance of a contract. Security logging rests on our legitimate interest in protecting the service. We do not process customer content for any purpose beyond providing the service — no analytics, no training, no profiling.

Data minimisation by architecture

The object model has no field for a filename, a directory, a content type, or a size in cleartext. This is not a policy that could be reversed by a configuration change; the columns do not exist.

Subprocessors

All subprocessors are published, with purpose and data categories, and material additions are announced before they take effect.

International transfers

Where personal data is transferred outside the EEA, transfers rely on Standard Contractual Clauses together with supplementary technical measures — principally that content is encrypted before it leaves your machine and is never held as a reconstructable whole in any single jurisdiction.

Data subject rights

Requests for access, rectification, erasure, restriction, portability, and objection are handled within one month. Because we cannot read customer content, requests concerning content are routed to you as controller and we assist as processor.

Records & agreements

A data processing agreement incorporating the Article 28 requirements is available on request, along with our record of processing activities and a transfer impact assessment.

Our public website sets no cookies, loads no third-party scripts, and runs no analytics. There is nothing to consent to because there is nothing being collected.

Privacy enquiries and data subject requests: privacy@PLACEHOLDER_DOMAIN.example.

Change management

Changes reach production through version control with peer review. Builds are reproducible, and deployments are automated rather than performed by hand on live hosts.

Secrets management

Production credentials and signing material live in the operator environment, are injected at runtime, and are rotated on compromise or personnel change. Application configuration carries no long-lived secrets.

Logging & monitoring

The control plane emits structured operational and error logs with request identifiers. Provider behaviour — availability, throughput, contract state — is continuously measured, and degradation triggers automated remediation before it becomes a customer-visible fault.

Vulnerability management

Dependencies are tracked and patched on a defined cadence, with out-of-band patching for actively exploited issues. Application code is reviewed against OWASP ASVS as an internal checklist.

Incident response

We maintain a documented response process covering detection, triage, containment, customer notification, and post-incident review. Where a personal data breach is involved, notification follows the GDPR 72-hour requirement.

Personnel

Everyone with production access is bound by confidentiality obligations and works under least-privilege access grants that are removed on role change or departure.

Manifest backups

The placement manifest is snapshotted continuously and retained on a rotation, with the ability to freeze rotation during an incident so that no evidence or state is lost to routine pruning.

Continuous repair

Slab health is scanned on a schedule. Degraded slabs are queued for reconstruction from parity onto replacement providers, restoring full redundancy without a customer-initiated read.

Provider redundancy

No single provider, operator, autonomous system, or jurisdiction holds enough of a slab to matter. Tolerance is 5 simultaneous provider losses per slab with zero data loss.

Provider-side collateral

Providers post collateral against their storage commitments, so failing to serve data carries a direct financial penalty for them. Durability is enforced by incentive as well as by arithmetic.

Survivability without us

Storage contracts are funded ahead of need. If Tessera ceased operating permanently and nothing was renewed, shards would remain retrievable for at least 60 days, and any party holding the placement record could reconstruct the data directly from providers.

We welcome reports from security researchers and will not pursue legal action against anyone acting in good faith under our published policy. Reports go to security@PLACEHOLDER_DOMAIN.example, are acknowledged within five business days, and follow a 90-day coordinated disclosure timeline.

For procurement and vendor assessment we can provide, under NDA where appropriate: our completed CSA CAIQ workbook, a data processing agreement, our subprocessor list with change notification, the current storage provider set and jurisdictions, an architecture description, and infrastructure audit reports from our cloud provider.

We answer bespoke security questionnaires for Enterprise customers. We will also tell you what we have not done — there is no penetration test report or SOC 2 report for the Tessera entity yet, and we would rather you learn that from us than from a gap in a spreadsheet.