Skip to main content

Security Overview

Last reviewed 31 August 2026

note

This page is Annex 2 of the Data Processing Addendum and populates Annex II of the Standard Contractual Clauses. It is maintained here so it stays current without amending the DPA itself.

Encryption​

  • AES-256 encryption of Personal Data at rest
  • TLS 1.2 or above for all data in transit
  • Encrypted backups

Access control​

  • Role-based access control on a least-privilege basis
  • Mandatory multi-factor authentication for all personnel with production access
  • Unique named accounts; no shared credentials
  • Access reviewed quarterly and revoked within 24 hours of a person leaving
  • Passwords stored using a modern one-way hashing algorithm

Pseudonymisation and minimisation​

  • Personal Data is segregated by organisation and event
  • Analytics and benchmarking use aggregated or de-identified data
  • Production data is not used in development or testing environments

System security​

  • Segregated production, staging and development environments
  • Firewalling and network segmentation
  • Rate limiting and bot protection on public endpoints
  • Automated dependency and vulnerability scanning
  • Peer code review before deployment to production

Monitoring and logging​

  • Centralised logging of authentication, access and administrative actions
  • Application performance and error monitoring
  • Alerting on anomalous access patterns
  • Logs retained for 90 days

Resilience and recovery​

  • Automated encrypted backups, with documented recovery point and recovery time objectives available to customers on request
  • annual restoration testing

Incident management​

  • Documented incident response plan with defined severity levels
  • 24-hour breach notification commitment to Controllers
  • Post-incident review with corrective actions tracked to closure

Personnel​

  • Confidentiality obligations for all staff and contractors
  • Background checks where lawful and proportionate
  • Security and data protection training at onboarding and annually
  • Documented onboarding and offboarding procedures

Supplier management​

  • Security and data protection review of each Sub-processor before onboarding
  • Written data processing terms with every Sub-processor
  • Periodic reassessment

Certification and testing​

  • Tessera does not currently hold SOC 2 or ISO 27001 certification. Our security documentation, including this overview and our sub-processor register, is provided to customers on request
  • annual third-party penetration testing

Payment security​

  • No cardholder data enters Tessera systems; all card data is handled by Stripe (PCI DSS Level 1 Service Provider)
Last updated on