Every session isolated. Every byte accounted for.
Tessera is built for teams that answer to security reviews. Here's how we protect your code, your credentials and the data your agents touch.
SOC 2 Type II
Audited annually by an independent firm. Report available under NDA.
ISO 27001
Certified information security management across every team.
GDPR & CCPA
EU data residency, a signed DPA and zero-retention mode on request.
HIPAA ready
BAAs available on Enterprise for healthcare workloads.
One browser. One microVM. Destroyed on exit.
Sessions never share a kernel, filesystem or network namespace. When a session closes, its VM and disk are wiped, and only the artifacts you asked us to keep survive.
- Firecracker microVMs with a hardened, read-only base image
- Per-session egress policy and network isolation
- Credentials in profiles encrypted with per-project keys
Security in the details.
Encryption everywhere
TLS 1.3 in transit, AES-256 at rest, and customer-managed keys on Enterprise.
SSO, SCIM and RBAC
SAML SSO, automated provisioning and least-privilege roles for every project.
Audit logs
Every console action and API call, exportable to your SIEM in real time.
24/7 monitoring
Intrusion detection, anomaly alerts and an on-call security engineer around the clock.
Background-checked team
Security training every quarter and hardware keys for every employee.
Responsible disclosure
Report vulnerabilities to security@tessera.dev. We reply within 24 hours and pay bounties.
Who else touches your data.
We keep this list short and notify customers 30 days before adding anyone.
| Subprocessor | Purpose | Location |
|---|---|---|
| Amazon Web Services | Compute, storage and networking | US · EU |
| Google Cloud | Overflow compute in select regions | US · EU · APAC |
| Cloudflare | Edge network and DDoS protection | Global |
| Stripe | Payment processing | US |
| Postmark | Transactional email | US |