Tessera PQC
PX-04
Where it runs
Installed inside your network. Sends nothing out.
A security tool has to pass the checks it asks of others. Tessera PQC runs on one server you control, reads without writing, never touches key material, and protects its own data with the post-quantum cryptography it recommends.
01
03
Built for a bank's security review
01
Read, never write
It reads code, artefacts and key inventories and changes nothing in your systems.
02
Your keys stay yours
HSMs and key stores are listed by type and size only. No key material is read, copied or stored.
03
Offline by design
Runs with no internet connection. Updates arrive as a package you bring in, after your own review.
04
Nothing runs unchecked
Every target is checked against scope at run time, and anything that touches the network waits for a second person.
05
Nothing sensitive is stored
Only the matching line is kept, and cloned repositories are deleted after the scan.
06
No outside AI
The optional assistant runs on your own GPU host, and its proposals need human approval. No third-party AI calls.
02
03
The platform's own cryptography
Web access | TLS 1.3 with X25519MLKEM768 hybrid key exchange |
Signatures | Ed25519 + ML-DSA-65, on evidence packs and audit checkpoints |
Data at rest | Data key wrapped with X25519 + ML-KEM-768 |
Access | Roles: admin, lead, operator, auditor, viewer; MFA |
Deployment | One Linux host or container, on-premises or air-gapped |
Pipelines | The scanner runs in GitHub Actions, GitLab, Jenkins, Azure DevOps and Bitbucket, and blocks new weak cryptography at merge time |
← Swipe for the rest of the table →
← Drag for the rest of the table →
03
03
Quality evidence
Area | Result |
|---|---|
Tests | 1,400+ automated tests; full line and branch coverage of the scanner core |
Code quality | Every reliability, security, maintainability and duplication gate graded A in our own strict scan |
Supply chain | No known-vulnerable dependencies; every shipped dependency permissively licensed; the scanner core has no third-party runtime dependencies |
Containers | No critical or high vulnerabilities in the delivered images |
SBOM and CBOM | Both generated for the product itself, in CycloneDX, and shipped with each release |
← Swipe for the rest of the table →
← Drag for the rest of the table →
These results come from our own scans on 3 November 2026. An independent review on your own tooling is welcome as part of a pilot, and the full scorecard is available on request.