Security
How Tessarac protects your data
Tessarac is the system you trust with every other system’s credentials. We hold ourselves to the standard our customers will be audited against — and publish exactly where we are on each framework so you can plan, not guess.
Security posture
How Tessarac is built and run. Items about the Sentinel agent, cordon, sandbox and HSM describe the Security Platform, which is in beta and not available yet. The planned Federal plan adds stricter defaults on top (FIPS-validated crypto enforced, STIG-hardened base images, 24-hour critical-patch SLA).
-
End-to-end agent envelope encryption
Every Sentinel agent payload is wrapped at the agent with a per-event AES-256-GCM data encryption key, then wrapped again with the per-tenant ECDSA P-384 trust anchor. Even our load balancers can't read it — they're a TLS-stripping pass-through. The trust boundary is the agent on your host, not our cloud account.
-
Bring (or hold) your own keys
Customer-managed keys via every major cloud key-management system or HashiCorp Vault. HYOK (hold your own key) is planned with the Dedicated HSM add-on and the Federal plan — root keys would live inside your own HSM that we never see. The agent ↔ control plane envelope decrypts inside your boundary.
-
Hardware-bound agent identity
Sentinel's signing key is generated inside the host's TPM, Secure Enclave, or WPCP — private half never leaves hardware. Defeats the credential-extraction class of attack against the agent. There is no agent token sitting in a file to steal.
-
IPv6-native control + data plane
Every endpoint listens on dual-stack [::]:port, AAAA records published alongside A records, cordon rules are designed to emit both IPv4 and IPv6 ACLs, in line with OMB M-21-07.
-
Ephemeral sandbox infrastructure
Suspect file gets detonated in a sandbox spun up in your tenant's compliance region, captured indicators land in the audit log, sandbox is torn down. Pay-per-detonation, near-zero idle cost, no cross-tenant data exposure.
-
Tenant isolation by default
Every tenant runs inside a strict logical boundary with cross-tenant access blocked at the database RLS layer. Self-host gives you a physically isolated deployment; the planned Federal plan is designed to give you a sovereign one.
-
Hardware-backed admin access
Tessarac staff access production only with a phishing-resistant hardware key (FIDO2 / smart card), plus role-based, time-bound elevation. No long-lived production credentials exist.
-
Signed releases and SBOM (planned)
Planned: Sigstore-signed container images, a reproducible-build attestation, and a software bill of materials in SPDX and CycloneDX with every release, so you can verify what you run before you run it.
-
Continuous scanning
Static analysis, dependency-vulnerability scanning, and infrastructure-as-code review run on every commit. Patch SLAs: Critical = 2 business days on Paid (24 hours planned for the Federal plan); High = 10 business days.
Compliance status
Honest snapshot of where each framework stands today. We update this table when status changes, not when an audit closes.
| Framework | Status | Notes |
|---|---|---|
| SOC 2 Type 2 | Targeted | Our first attestation, and the next one we will pursue. No auditor is engaged yet and no observation period has started, so there is no report to share. |
| ISO 27001:2022 | Roadmap | Not started. We will consider it after SOC 2 Type 2. |
| HIPAA | Roadmap | We do not sign Business Associate Agreements today, so do not send protected health information through Tessarac. |
| PCI DSS | Ready | For our own billing only: card details are entered in our payment processor's fields and never reach Tessarac systems (SAQ A scope). Tessarac is not a PCI-validated service provider for your cardholder data. |
| GDPR | Ready | Data Processing Agreement available. Customer data is stored in the United States (AWS us-east-1); EU data residency is not offered. |
| FedRAMP | Roadmap | Not started. No sponsoring agency or assessor is engaged. |
| DoD IL5 | Roadmap | Not started. It would follow a FedRAMP authorization. |
| CMMC 2.0 L2 | Roadmap | Not started. |
“Ready” means in place today, as the note describes. “Targeted” means the next attestation we will pursue; not started. “Roadmap” means planned, not started. None of these is a third-party attestation.
Reporting vulnerabilities
We rely on the security community. If you’ve found something, get in touch — we’ll respond fast and we don’t pursue good-faith researchers.
- Where to report
-
security@tessarac.com
PGP key published at/.well-known/security.txt - First response
- Within 1 business day.
- Triage
- CVSS 9.0+ within 24 hours. CVSS 7.0+ within 3 days.
- Patch SLA
- Critical: 2 business days (Paid; 24 hours planned for the Federal plan). High: 10 business days.
- Safe harbor
- Good-faith research that respects user privacy and doesn’t disrupt service is welcomed and protected from legal action under our coordinated-disclosure policy.
Sub-processors
The current sub-processor list (cloud providers, payment processors, observability tooling) is available on request and updated 30 days before any change. Customers under contract are notified by email.
Open source & licensing
Tessarac is open-core. The Community edition is source-available under the Tessarac Community License. Paid deployments are licensed under a standard commercial agreement, as the planned Federal plan will be, that includes IP indemnification.