Standards-Compliant Data Security Solutions
Data-centric protection for documents on Windows and Linux, labelled storage shared across sites, and controlled cross-domain exchange for classified and sensitive environments — built to ADatP-5674, ACP-240, STANAG 4774, STANAG 4778 and ADatP-5636.
Tessera implements NATO's and CCEB's data-centric security model, where the protection is part of the data and travels with it wherever it goes.
Each document is encrypted and carries a signed label. Its key is released only after the reader's clearance has been checked against that label, wherever the document is stored.
Information that moves between security domains is checked against the policies of both. A guard is the only path between them, and any error results in a denial.
Labels, bindings, key management and metadata follow the ADatP and STANAG series. Interoperability is tested with published test vectors.
Five products that cover the classified information lifecycle: protection on the desktop, labelled editing, shared storage across sites and controlled exchange between domains.
Labels and protection for the Windows desktop. Files carry a bound NATO confidentiality label, and the key is released only after the reader’s clearance is checked.
An office editor for labelled documents, spreadsheets and presentations on Windows and Linux. The marking is always on screen, and every save is sealed.
Labelled storage shared across sites. Storage nodes replicate sealed documents between sites and never hold a readable copy or a key.
A locked-down Linux workstation that carries the Tessera applications and little else. The session is confined, and documents live in the datalake.
A gateway for controlled exchange between security domains. Every flow is checked against the policies of both domains before it passes.
Standards implemented
ADatP-5674 ACP-240 STANAG 4774 STANAG 4778 ADatP-5636 XMLSPIF v2.1/v3.0 RFC 5652 CMSTraditional perimeter security protects a network boundary. Once data leaves that perimeter — shared with a partner, archived, or transferred to another domain — the protection is gone.
The NATO data-centric model inverts this: the protection travels with the
data. A .ztdf archive is an encrypted package whose access
policy is embedded and cryptographically bound to the encrypted payload. No key is
ever released without a real-time policy check against the requester's attributes.
Security labels (STANAG 4774) declare the sensitivity of the information. Binding assertions (STANAG 4778) tie those labels to the content with a digital signature that cannot be stripped or replaced without detection.
Read: How security labels workNothing about the classification vocabulary is built into the software. The levels, the order they rank in, and the categories allowed to qualify them are read from the domain's XMLSPIF — the machine-readable form of the security policy that the policy authority publishes.
Point the desktop at a different policy and the whole interface changes with it: different levels, different releasability groups, different compartments. That is what makes one product deployable in a national domain, a coalition mission network and a partner enclave without a rebuild.
Shown here with TESSERA, a fictional policy we publish for demonstration and testing — so nothing in the screenshot is a real classification marking.
Tessera Desktop is a locked-down Linux workstation for labelled data. It carries Tessera Office, Tessera Viewer, Tessera Browser and Tessera Map, and keeps every document in the Tessera Datalake.
It shares identity, key access services and storage with Tessera for Windows. A document sealed on one platform opens on the other with the same marking and the same access decision.
See Tessera Desktop
Our concepts guide explains classification levels, clearances, categories, SPIFs, and multi-point enforcement — starting from physical-world analogies and building up to the NATO standards that implement them electronically.
How Security Labels Work