You're giving us a view of your cloud. Here's exactly what that means.
The short version: we start read-only. We never change your infrastructure directly; fixes reach your cloud only through pull requests you merge. You can cut us off at any time by deleting one role.
Read-only by default
Assessments and continuous scanning use each provider's standard read-only roles. The exact roles are listed on the assessment page.
Fixes go through your PRs
Tessera opens pull requests against your IaC repository. Your pipeline runs plan and apply. We never hold write credentials to your cloud.
Revoke in one step
Delete the role or service account and our access ends immediately. Ask us to delete your stored data and we will, in writing.
What we store, where, and for how long.
What data does Tessera read and store?
Resource configuration metadata: IDs, types, settings, tags, relationships, and change events from the provider's audit trail. We do not read the contents of your storage buckets, databases, secrets or disks.
Where is it stored?
For SaaS, in an isolated tenant in a single cloud region. For Enterprise, you can run Tessera inside your own VPC, so the data never leaves your account. TODO: name SaaS hosting region(s)
How is it protected?
Encrypted in transit (TLS 1.2+) and at rest. Each customer's data is isolated per tenant. Enterprise customers can bring their own encryption keys.
How is AI used, and does it see my data?
Findings come from deterministic checks, not AI. When you ask for a fix, the configuration of the affected resources is sent to our language model provider to draft the Terraform change. We don't use your data to train models, and our provider contract prohibits training on it. TODO: confirm provider & terms
How long do you keep assessment data?
If you don't continue after a free assessment, we delete the scan data 30 days after we deliver the report, or sooner if you ask. TODO: confirm retention
Are you SOC 2 certified?
Our current status: TODO: state honestly, e.g. "SOC 2 Type I audit in progress, expected Qx 2027". We'll share our security questionnaire answers and architecture overview on request.
How do I report a vulnerability?
Email security@cloudtessera.com. We reply within one business day and won't take action against good-faith research.