Multi-cloud governance for platform teams

See the part of your cloud that isn't in code.

Tessera inventories every resource across AWS, Azure and GCP, catches drift and click-ops, and gives you AI-recommended fixes you apply in one click. Read-only to start. Findings in about two days. From $199/month.

Get the free assessment → See a sample report

Read-only · No card · No sales call

Read-only startNo write access until you grant it.
Every price publishedFrom $199/mo. No "book a demo" wall.
AWS · Azure · GCPOne inventory, one policy set.
SaaS or in your VPCYour data stays where you need it.
The status quo

Your source of truth is a spreadsheet called cloud-inventory-FINAL-v7.xlsx

The estate grew faster than anyone could govern it. Some of it is in Terraform. A lot of it was clicked into existence during an incident, by a contractor, or by someone who left. It all lands on the platform team, unannounced, on top of the roadmap.

01

Surprise bills

Finance forwards the invoice with a "?". Finding the waste means days of console archaeology across three providers.

02

Invisible resources

Things created in the console never made it into code. Tools that read your Terraform can't see them.

03

Silent drift

What's running no longer matches what's in the repo. Every deploy is a small gamble.

04

Audit asks

"Are we CIS-compliant?" has no honest answer, and the whole map lives in one person's head.

Tessera Ops

A system of record for everything you run, not just what's in the repo.

Connect read-only. Tessera builds the inventory, compares it to your code, and tells you what's drifted, unmanaged, risky or wasted, with the fix ready to review.

Discover

Every resource across every account, subscription and project, including the ones nobody wrote down.

Detect drift

Field-level diffs between what's live and what's in Terraform or OpenTofu, continuously.

Enforce policy

CIS and custom policy-as-code, checked on live resources and on every pull request.

Fix in one click

AI-recommended fixes, written as a Terraform pull request you review. Nothing changes without your approval.

Everything in Tessera Ops →
# finding TSR-0142 · severity HIGH · aws/eu-west-1 resource aws_security_group.payments_api ~ ingress.cidr_blocks code: ["10.20.0.0/16"] live: ["10.20.0.0/16", "0.0.0.0/0"] changed: console · 2026-09-14 02:41 UTC by: arn:aws:iam::…:user/oncall-temp # recommended fix (opens a PR, you merge) → revert live rule to match code → or adopt into code with justification # also found in this account 212 resources outside IaC 38 drifted resources 17 idle volumes & snapshots

Illustrative finding. Your assessment uses your own estate.

One lifecycle

Move it. Govern it. Keep it governed.

Tessera covers the whole life of a cloud estate. Migrate gets workloads where they need to be. Ops keeps them accountable afterwards, every day, on every cloud.

Tessera Migrate

Move

Discovery, dependency maps and cross-cloud Terraform translation, delivered by our consultancy partners.

Tessera Ops

Govern

The migrated estate lands in Ops already inventoried, in code, and under policy from day one.

Continuous

Stay governed

Drift, click-ops, policy breaks and waste are caught as they happen, not at the next audit.

For platform & DevOps teams

Get control of the estate you inherited.

Start with a free, read-only scan of your own cloud. You get a findings report in about two days, and it's yours to keep.

  • Inventory across AWS, Azure and GCP
  • Drift, click-ops and policy findings by severity
  • Self-serve plans from $199/month
Get the free assessment → For cloud consultancies & MSPs

Better margins on fixed-price migrations. Recurring revenue after.

Migrate productises discovery and translation. Every estate you move can land on Ops, with a recurring revenue share and your client relationship intact.

  • Weeks of senior discovery work, compressed
  • 15–25% recurring share on Ops
  • Co-branded deliverables, rules of engagement in writing
See the partner program →
Fair questions

What a skeptical platform lead asks first.

I could build this myself.

You could write the first scan. The hard part is keeping it working: provider APIs change every month, and a script stack quietly rots. With Tessera you're paying for the maintenance, not the first run.

Is it safe to connect?

The assessment uses a read-only role you create and can revoke at any time. We publish the exact permissions on the security page. No write access and no card.

Another dashboard I'll ignore.

You don't start with an empty console. You start with a findings report on your own estate, ranked by severity, with the fixes already drafted.

Pricing will be "call us."

Every self-serve price is on the pricing page. A $199 plan shouldn't need a sales call.

Pricing

From $199/month. Every price is on the page.

Priced by the number of resources you govern, not seats. Start free, upgrade with a card, and never wait for a quote unless you need Enterprise.

See all plans →
Free

$0

Up to 300 resources

Starter

$199/mo

Up to 2,500 resources

Growth

$599/mo

Up to 10,000 resources, SSO

Enterprise

from $1,750/mo

SaaS or in your VPC

Start with evidence

Find out what's really running in your cloud, this week.

If the scan turns up real waste and risk, the subscription pays for itself. If it doesn't, you've lost nothing.

Get the free assessment → I'm a consultancy