Built to be checked, not taken on trust.
Tessera is a security product, so the bar is our own. Every claim below is something that holds today. Where something is on the roadmap rather than in place, we say so plainly — and we won't publish a certification, logo or testimonial we haven't earned.
Your architecture goes in. It doesn't leak, and it isn't harvested.
Zero-retention path
The model-provider path is run zero-data-retention-clean: your system descriptions aren't retained by the provider and aren't used to train anyone's model.
Identifier minimisation
We keep the minimum identifying data needed to run the work and bill it — no more. What isn't needed isn't collected.
Tenant isolation
Every workspace is isolated. A workspace you're not a member of is never named to you — existence itself isn't disclosed across the boundary.
Evidence, human validation, and a version you can't quietly rewrite.
Every finding cites the part of your architecture it came from. No black-box scoring.
Threat → weakness → control → requirement → standard, followable in both directions.
Security-relevant paths require a second pair of eyes — a human validates before it ships.
Findings map to the frameworks you work to, carried through to the export.
An issued model is pinned — re-runs show exactly what moved, nothing is silently changed.
- ✓ Built in the UK; company registered in England and Wales.
- ✓ Hosted on AWS in the UK (London); infrastructure inherits AWS's compliance posture under the shared-responsibility model.
- ✓ Zero-retention model path, identifier minimisation, tenant isolation.
- ✓ Human validation and four-eyes on sensitive paths.
- ✓ A written trust overview available on request.
- › A public sub-processor list and status page.
- › SSO / IdP federation for larger buyers.
- › Anything we haven't earned — a certification, a logo, a testimonial — stays off this page until it's real.
We'd rather under-claim here than dress up the roadmap as the present. If a proof point isn't above, assume we don't claim it yet.
Want the detail before you commit?
Ask for the trust overview, or book a review and we'll walk your security team through the data path and the controls.