Built to be trusted with your documents.
Invoices, claims and contracts hold personal data, prices and legal terms. This page says plainly what we do with them, where they live and how long we keep them.
Encrypted everywhere
TLS 1.3 in transit. AES-256 at rest with a separate key for each workspace.
No silent access
Staff open a document only through a time-boxed grant that you approve. Every view is logged for you.
No training on your data
Documents and corrections tune your own workflows and nothing else.
You set retention
Zero days to 365, per workflow. Deletion is verified and written to the audit log.
The life of a document
Five stages, and what protects the document at each one.
- 01 Encrypted in transit
Upload and email intake
TLS 1.3 from your system to our edge. Email attachments are received on a dedicated address per workflow.
- 02 Isolated per run
Processing
Documents are read in isolated, short-lived workers. Nothing is shared between workspaces and no worker keeps state after a run.
- 03 AES-256 at rest
Storage
Originals and extracted results live in your chosen region, encrypted with your workspace key.
- 04 Role-based access
Review
Reviewers see a document through an authenticated session. Sessions time out and every view is logged.
- 05 Verified, logged
Deletion
On expiry, originals and derived images are deleted, then the key material for that batch is destroyed.
Retention is yours to set
Set it per workflow. Extracted results and the audit log follow their own schedules, so you can discard an identity document and still keep the record of what was decided.
- 0days
Zero retention
Discarded as soon as routed
- 30days
Default
Original and results kept 30 days
- 90days
Extended
For disputes and audits
- 365days
Maximum
One year, then deleted
Regions: United States and European Union. Chosen once, when the workspace is created.
Controls we operate
Our own descriptions of how we work. We are building towards commonly used trust criteria, and we do not display third-party certification badges we have not earned.
- Identity
- Single sign-on with SAML or OIDC, SCIM provisioning on Scale, and four roles: admin, builder, reviewer, auditor. Multi-factor authentication is required for all Tessera staff.
- Tenant isolation
- Per-workspace storage prefixes and keys, per-workspace processing queues, and no shared model state between customers.
- Staff access
- Just-in-time grants, approved by a workspace admin, expiring after at most 24 hours, recorded in your audit log.
- Logging
- An append-only audit log of every document, decision and access event, exportable and streamable to your own storage.
- Vulnerability management
- Dependency and container scanning on every build, and an independent penetration test every year, with a summary available under NDA.
- Secure development
- Mandatory code review, signed builds, secrets kept out of source, and a staged rollout for every release.
- Incident response
- A written plan, practiced twice a year. Affected customers are notified within 72 hours of a confirmed incident.
- Resilience
- Encrypted backups that stay in your region, restored in a test environment every quarter.
Security questions
Is my data used to train models?
No. Customer documents and corrections are used only to run and tune your own workflows. They are never used to train or improve models for other customers, and they are deleted on the retention schedule you set.
Where is my data stored, and for how long?
In the region you pick at sign-up, United States or European Union. Default retention is 30 days after processing, configurable from zero (documents are discarded once routed) to 365 days. Extracted results and the audit log follow their own retention settings.
Who at Tessera can see my documents?
Nobody by default. Support engineers can open a document only through a time-boxed access grant that you approve, and every grant and view is written to your audit log.
Template note. Every claim on this page describes the fictional company. Replace it with statements you can prove, and never show a certification you do not hold.
Found something? Tell us.
Send vulnerability reports to [email protected]. We acknowledge within two business days, we do not pursue good-faith research, and we credit reporters who want it.