Your databases, inside your perimeter, under your compliance controls
Tessell runs your databases inside your own cloud account, under your own encryption keys, on your own network, with the control plane operating from outside your perimeter. For regulated enterprises, data sovereignty is built into the architecture, not promised in a contract.
Trusted by regulated enterprises
Fortune 500 US Bank
Zero public internet exposure
Leading Healthcare Data Platform
67.5 TB migrated, zero compliance gaps
US State IT Services Provider
Public sector compliance on Azure
Compliance is easy to claim. Custody is harder
For regulated data, the hardest security question was never which controls you have. It is where your data actually lives, and who can reach it.
Managed simplicity usually meant your data living in someone else’s infrastructure.
That is a reasonable trade for the operational relief, but for regulated data, where the data sits and who can reach it stays an open question.
Compliance stopped being a point-in-time event.
Frameworks multiply, audit cadences tighten, and regulators increasingly expect continuous evidence rather than an annual snapshot. When the question comes, the answer has to be assembled across systems - and it is rarely as current as you would like.
Where data lives is now a board-level question.
Data residency, sovereignty, and who can access what across regions are no longer just technical details. They are regulatory and reputational concerns - and answering them precisely requires knowing exactly where every database sits and who can reach it.Sovereignty is a choice you get to make
One architectural decision shapes everything else. Tessell runs the same platform across a choice of deployment options, so you decide how much we manage and how much stays entirely within your perimeter, down to your own cloud account.
Full Data Sovereignty
The data plane runs inside your own cloud account, under your encryption keys and your network policies. Tessell's control plane manages operations from outside your perimeter. Your data never leaves your account.
- Full data sovereignty: data plane in your own account (BYOA)
- Your encryption keys (BYOK) and your network (BYON)
- Private-only access, no public internet exposure
Best for regulated enterprises and governments with strict data sovereignty requirements.
Your data, your controls, your tooling - all within your perimeter
Data sovereignty is not a single feature. It is what becomes possible when the data plane runs in your own account: your keys, your network, and your existing security stack all stay in your hands.
Your data doesn’t leave your perimeter.
With VPT@Customer, the data plane runs inside your own cloud account. Tessell manages operations through a scoped service principal limited to specific resource groups, with private-only connectivity and no public internet exposure. Tessell never holds your data.
Your keys. Your network. Your standards.
Encryption keys stay under your control through your own KMS or Key Vault. Databases deploy into your own network topology with your security policies applied. Tessell operates within the boundaries you define, never around them.
BYOK enforced through an AWS-to-Azure migration
Encryption keys remained under the customer's control across a full cloud migration, with 99.99% platform availability maintained throughout.
Integrated with the security and observability tools you already run.
Tessell connects to your existing monitoring, security, and analytics stack rather than asking you to adopt a new one. Vulnerability scanning, log management, and observability flow into the tools your teams already operate, with enterprise authentication through your directory.
67.5 TB migrated with zero compliance gaps
18 Oracle databases brought onto Tessell with full observability and private connectivity maintained throughout a HIPAA-regulated migration.
The compliance baseline your procurement team is looking for.
Tessell maintains the certifications and attestations enterprise security and procurement teams evaluate first. Because your data plane runs inside your own account, your databases operate within your compliance perimeter - under your controls, your audit trail, and your governance.
PCI DSS v4.1
Privacy information management
ISO 27001
Information security management
ISO/IEC 27701
Privacy information management
SOC 2
Security, availability & confidentiality controls
A Fortune 500 bank runs production on Tessell with zero public internet exposure.
For one of the largest banks in the US, moving database operations to the cloud could not mean moving data out of its control. With VPT@Customer, it didn't have to.
Sovereignty is strongest when the estate inside your perimeter is fully governed and fully visible.
Keeping data in your perimeter is one part of a larger architecture. Tessell's Governance and Control brings all three together.
Governance enforced consistently across every database in your perimeter.
Provisioning standards, access controls, and Data Access Policies - including masking sensitive data before it reaches lower environments - applied structurally across the estate.
Explore Policy EnforcementA complete cost picture of the secure estate you operate.
Per-database cost attribution across compute, storage, licensing, and backup - so the estate you have secured is also the estate you can fully optimize.
Explore Cost Visibility
See what running databases on your own terms looks like.
Talk through the VPT@Customer architecture with a Tessell security architect, or request a security review that maps Tessell to your specific compliance and data sovereignty requirements.
Questions