Regulated enterprise (finance & health)
Defense-in-depth reference: Sentinel, Fabric isolation, Archive retention, Insight audit logs — aligned with common audit expectations. Tessera is not SOC 2 / ISO 27001 / HIPAA certified; Enterprise contracts can include a tailored compliance roadmap.
Diagram
Use cases
- Fintech API
- Health records portal
- Gov contractor SaaS
Components
| Layer | Role | Product |
|---|---|---|
| Perimeter | WAF + DDoS + rate limits | Sentinel |
| Edge | TLS 1.3 + HSTS | Gateway |
| Network | Zero-trust private net | Fabric |
| Application | Audited API services | Compute |
| Primary data | HA PostgreSQL | Datastore |
| Compliance store | Immutable archives | Archive |
| Event audit | Tamper-evident log | Conduit |
| Async audit | Compliance jobs | Lane |
| Operations | SIEM-style monitoring | Insight |
Products
When to use
- Financial services, health tech, or gov contractors with audit requirements.
- Contracts mandating WAF, encryption at rest, and immutable audit trails.
- Data residency discussions with legal/compliance teams.
When to avoid
- Early-stage MVP without compliance scope.
- Teams without capacity to run incident response playbooks.
Design notes
Audit everything
Insight retention ≥ 365 days. Export logs to Archive for immutable cold storage. Conduit for tamper-evident event streams.
No public Compute
All application Compute on private Fabric. Only Sentinel + Gateway expose public endpoints.
HA by default
Datastore HA and multi-region are Enterprise options fulfilled manually today — plan replicas and backups explicitly until auto-provisioning ships.
Blueprint
Use this JSON as a starting point when creating a project via the Tesserra API or console. Replace image URLs, domains, and resource references with your values.
{
"nome": "Regulated Core",
"resiliencia": "multi-regiao",
"recursos": [
{
"tipo": "fabric",
"nome": "secure-net",
"config": {
"cidr": "10.60.0.0/16",
"publica": false
}
},
{
"tipo": "compute",
"nome": "core-api",
"config": {
"subtipo": "api",
"replicas_min": 2,
"replicas_max": 8
}
},
{
"tipo": "compute",
"nome": "compliance-worker",
"config": {
"subtipo": "worker",
"replicas_min": 1
}
},
{
"tipo": "datastore",
"nome": "primary-db",
"config": {
"engine": "postgres",
"ha": true,
"tamanho_gb": 200
}
},
{
"tipo": "archive",
"nome": "compliance-archive",
"config": {
"tamanho_gb": 2000,
"publico": false
}
},
{
"tipo": "conduit",
"nome": "audit-log",
"config": {
"particoes": 12,
"retencao_horas": 8760
}
},
{
"tipo": "lane",
"nome": "compliance-jobs",
"config": {
"duravel": true
}
},
{
"tipo": "sentinel",
"nome": "perimeter-waf",
"config": {
"modo": "bloquear",
"regras_basicas": true,
"alvo_recurso_id": "core-api"
}
},
{
"tipo": "gateway",
"nome": "public-edge",
"config": {
"dominio": "api.acme.com",
"tls": true,
"alvo_recurso_id": "core-api"
}
},
{
"tipo": "autoscale",
"nome": "ha-scale",
"config": {
"alvo_recurso_id": "core-api",
"metrica": "cpu",
"limiar": 55
}
},
{
"tipo": "insight",
"nome": "siem",
"config": {
"retencao_dias": 365,
"alertas": true
}
}
]
}