Trust
Subprocessors
Tessera relies on two distinct categories of third party: a small number of named corporate service providers that support the control plane, and a rotating pool of independent storage providers that hold encrypted shards. Both are disclosed here.
A subprocessor is any third party that processes data on our behalf in the course of delivering the service. We keep the list short by design: the fewer parties involved, the fewer parties you have to assess.
It is worth being precise about what each category can actually see. Our hosting provider has physical custody of the machine the control plane runs on, and nothing more: the disks carry full-disk encryption and there is no managed layer through which it could read them. The remaining corporate subprocessors — DNS, email, payments, and the x402 settlement path for crypto top-ups — do process account identifiers, contact details, or payment metadata, because that is what they are for. Storage providers hold encrypted shards and can see neither filenames, nor file boundaries, nor content — a single shard is not decryptable, and no provider holds more than one shard of a slab.
The control plane itself runs on a Kamatera cloud server in Singapore, so account, billing, and placement records sit there. How encrypted shards spread across jurisdictions is a different thing entirely, and the provider pool below describes what we can say about it today.
Corporate subprocessors
These parties support the Tessera control plane, billing, and communications, and each is assessed before onboarding.
| Subprocessor | Purpose | Data categories | Location | Attestations |
|---|---|---|---|---|
| Kamatera, Inc. | Cloud server hosting (cloud server) and network transit for the control plane, plus a second server in Hong Kong holding the encrypted off-site backup copies | No logical access. Account identifiers, placement metadata, and request logs reside on servers Kamatera provides, administered solely by us; the provider has physical custody of the machines. Nightly backups are encrypted (GPG, AES-256) on our primary server before the encrypted copies are pushed to the Hong Kong server; the passphrase is not stored there. | Singapore (control plane) and Hong Kong (encrypted backups) | — |
| Spaceship (Namecheap, Inc.) | Authoritative DNS for tessera.storage | DNS query metadata (IP addresses, requested names) | — | — |
| Spacemail | Transactional email — account, security, and service notifications | Email address, message content | — | — |
| NOWPayments | Crypto payment processing and invoicing for balance top-ups | Order and payment metadata, crypto wallet addresses | — | — |
| Base RPC | Broadcasting x402 USDC payment authorisations to the Base network | Signed payment authorisations, wallet addresses, transaction data | — | — |
Attestations are held by the subprocessor, not by Tessera. A dash means we have not confirmed the item for publication; contact us for the current documentation.
Storage providers
Every object is split into 30 encrypted shards and distributed to 30 independent storage providers on the Sia network — separate businesses, on separate hardware, under separate legal ownership, in a spread of jurisdictions. This is what makes the durability and survivability properties possible, and it is also why the disclosure below is aggregate rather than nominal.
What a storage provider can access
- One encrypted shard per slab. Not a file, not a fragment of readable content — ciphertext produced after erasure coding.
- No filename, path, content type, or object size. Those fields do not exist in anything transmitted to a provider.
- No account identity. Providers see a storage contract held by Tessera, not your account.
- No path to reconstruction. Recovering any plaintext requires 10 shards from 10 different providers plus key material held by your client.
Provider pool
Tessera draws storage from a continuously curated pool of independent providers on the Sia network. The pool is aggregate and changes without notice as providers are vetted, added, and retired based on measured availability, throughput, and contract performance. The current provider set is available to customers on request under NDA; jurisdiction-constrained pools are not offered on the public site today.
Why individual providers are not named here
Three reasons, in order of how much we expect you to care about them. First, the set is not stable: shards move as providers are retired and replaced, so a published list would be wrong within days and would give you false precision about where your data sits. Second, provider selection is the part of Tessera that is genuinely difficult — publishing a live roster hands that work to anyone who wants it. Third, naming a provider tells you nothing actionable about your risk, because no individual provider can affect the confidentiality or availability of your data.
If your compliance programme requires the current provider set — or a pool constrained to specific jurisdictions — we provide both. The former is available under NDA on request; the latter is not offered on the public site today.
Change notification
We will notify customers at least 30 days before adding or replacing a corporate subprocessor that processes personal data, giving you time to object. Changes to the storage provider pool are continuous and operational in nature and are not individually notified — that rotation is a durability mechanism, not a change of service.
To be notified of subprocessor changes, or to raise an objection, contact [email protected].