Skip to main content

Security

How Tessera protects tenant data: project isolation with tenancy in every storage key, cryptographic controls (CMEK envelope encryption via Cloud KMS), credential handling, and the deny-by-default schema-contract model.

  • Data handling — encryption in transit and at rest, tenant isolation, credential handling, and retention.
  • Audit streaming, hash chain & retention — SIEM streaming of the audit log, tamper-evident chain verification, legal hold and configurable retention, and opt-in read audit.
  • Subprocessors — the complete subprocessor list, rendered from a schema-validated data file.
  • API deprecation & versioning policy — versioning, notice windows, and deprecation headers, rendered from the same policy file CI enforces.

Operational transparency lives on the status page and the changelog.