Access checked on every door, and the data encrypted where it rests.

The same role check, row policies and audit run on HTTP, the Postgres wire, Bolt and gRPC. The tenant comes from the access key, never from the request body.

Who may do what.

Keys and service accounts

Create, rotate, revoke and delegate tokens from a screen. A token is shown once and stored only as a BLAKE3 hash; revoking and rotating take effect at once and hold after a restart.

Roles on the data path

Role checks run on every door, and each statement over the Postgres wire is checked against the key's rights.

End users and row policies

Tessera verifies the tokens your own sign-in issues, and row policies limit each end user to their rows. It does not run your sign-up screens or sessions.

Tenants

One tenant's types are named apart from another's, so the other tenant's rows cannot be addressed at all, on every HTTP route, Postgres wire, Bolt, gRPC and the sharded data plane.

Single sign-on (Enterprise)

OIDC and SAML 2.0.

Where the data rests, and what comes in.

Encryption at rest

AES-256-GCM over the write-ahead log, the segments and the audit log, with key rotation by the operator. It fails closed if the key is missing.

Backups that prove they decode

A deep verify decrypts and parses every segment and log record. A wrong or missing key fails the verify, so an encrypted backup with a lost key cannot pass as good.

Query defence (Enterprise)

Eight defence layers are defined and four enforce on a default install. They use rules and cryptography; there is no machine-learning model in the data path.