Security
Built to pass your security review
Tessel reads metadata, logs and code. Your rows never leave your warehouse, and we can show you exactly how.
Audits and standards
Our SOC 2 Type II report, ISO 27001 certificate, penetration test summary and Data Processing Addendum are available on request under NDA.
-
SOC 2
Type II report covering security and availability, audited annually (demo)
-
ISO 27001
Certified information security management system, audited every year (demo)
-
PDPL
Data Processing Addendum under the UAE Personal Data Protection Law, Federal Decree-Law No. 45 of 2021
-
SAML
Single sign-on and SCIM provisioning on Enterprise
-
PEN
Independent penetration test every year, latest in June 2026
Controls we run
-
Least-privilege access
Warehouse roles see metadata only. The GitHub App can open pull requests in the repositories you choose and nothing else.
-
Encryption
All traffic is encrypted in transit and all stored metadata at rest. Credentials sit in a managed secrets vault, never in our database.
-
Employee access
Engineers get time-limited access to production only for an open support case, with your permission, and every session is logged.
-
Logging and monitoring
Every API call and admin action is logged. Enterprise customers can export their workspace audit log.
-
Vulnerability management
Dependencies are scanned on every build. Critical issues are fixed within 7 days; we run a public disclosure program at security@tessel.dev.
-
Business continuity
Metadata is backed up hourly to a second data centre in the same region, and restore drills run every quarter.
-
People
Every employee passes a background check and annual security training, and signs a confidentiality agreement.
How we handle your data
Tessel stores pipeline metadata: model and column names, run times, row counts, error messages and compiled code. It never runs queries that return your rows, and it never writes to your warehouse.
You choose where your workspace lives when you create it: our UAE region, in cloud data centres inside the UAE, or our Saudi region in Dammam for teams whose data has to stay in the Kingdom. Metadata stays in that region, including backups. Enterprise customers can also run the collector in their own cloud account.
Run history is kept for 13 months, then deleted. When you close a workspace, we delete its metadata within 30 days and its backups within 60, and confirm in writing. We process personal data under the UAE Personal Data Protection Law, and our current list of sub-processors is in the Data Processing Addendum.
Security questions
Can we see your SOC 2 report?
Yes. Email security@tessel.dev and we’ll send it under a standard NDA, usually the same day.
Do error messages ever contain our data?
Sometimes a database error quotes a value. Tessel masks values in error messages by default before they are stored.
Will you fill in our security questionnaire?
Yes, for Team and Enterprise customers. Most come back within five business days.
How do we report a vulnerability?
Email security@tessel.dev. We reply within one business day and won’t take action against good-faith research.
Need more for your review?
Ask for our SOC 2 report, data flow diagram and DPA, or book a call with our security lead.