Security and privacy · Tessera Park

The short version

No integration. Tessera does not connect to your student information system, your permit database, your card system, or your network. There is nothing to wire up, which means there is very little to review.

No license plates. We do not read, store, or process plate numbers or vehicle details.

No sale of data, no advertising, no analytics or session-replay tools. The only third-party code that reports usage is the map: Mapbox counts map loads with an anonymous identifier, and receives device type and map load timings until that is turned off.

What we collect

An account is an email address, a username, a campus, and an affiliation — student, staff or faculty, which decides which permit zones the app shows. A university email address is optional and used only to display an affiliation badge.

Activity is lot reports (lot, status, timestamp) and visits (lot, arrival, departure), which is what produces the demand and dwell-time figures.

Location: when a person taps to check in, and only then, we record the position their device reports. There is no background tracking and no trail between lots. Those coordinates are erased automatically after 90 days, and immediately if the account is deleted.

Where it lives, and who else touches it

Processor	Purpose	What it receives
Supabase	Database, authentication, file storage	Account and activity data. US region
Vercel	Hosting, scheduled jobs	Request traffic, IP addresses, logs. US region
Resend	Transactional email	Recipient address, message contents
Mapbox	Map, directions, search	Map area on screen, IP address, device type; the person's location when they ask for a route; text typed into search; anonymous map load counts
Google	Sign in with Google, if chosen	The sign in request; returns name and email
Push services (Google, Apple, Mozilla, Microsoft)	Notifications, if turned on	The device's push address and the encrypted notification
Stripe	Merchandise shop payments	Payment details, shipping address. Nothing about parking

Data is encrypted in transit and at rest. Stripe receives nothing at all from anyone who never places a shop order.

Access and retention

Sign-in is an emailed one-time code or Google. Student accounts have no password, so there is no student password database to breach.
Row-level security is on every table. Most records are readable only by the person they belong to. Since 2026-09-15 that includes parking reports: each is readable only by the person who filed it, and the live map shows a lot status computed on the server, with no username.
Staff access is role-based and audited — every privileged action writes an immutable-by-convention record of who did what, to what, and when.
Anyone can delete their own account from inside the app, with no support request and no conditions.
On deletion: profile fields are cleared at once; reports and visits are de-identified rather than destroyed, so campus-level signal survives without the person and is kept as anonymous records; the anonymized account row is purged after seven years.

What we do not have yet

Because you will ask, and a gap you hear from us is cheaper than one you find.

No multi-factor authentication for student accounts. Staff pages and the university office require an authenticator app code. Student sign-in rests on the security of the email or Google account. This is the most significant item on this page.
No SOC 2 or ISO 27001 audit, and no third-party penetration test. We are early, and an audit before a first paying customer would be theatre. A targeted penetration test is the better first spend and is the one we intend to make.
No accessibility conformance report (VPAT). A map-first interface at a public university deserves a real assessment and has not had one.
No uptime SLA with service credits. We are a small team with no 24/7 rotation, and an SLA we cannot staff is a promise we would be caught on.
Cross-institution isolation is enforced in the application, and is being moved into the database. That work lands before any second university's accounts exist — not after.

What we will do for your review

Complete a HECVAT, Lite or Full.
Answer your own security questionnaire.
Sign a data processing agreement.
Give you a named security contact and an escalation path.
Notify you of a confirmed personal-data breach within 72 hours, and an affected institution even where user impact is still uncertain.
Support a data export guarantee in the agreement — export is included, always, so there is no lock-in to negotiate your way out of later.

Ask us the hard one.

If something here is not enough for your institution, tell us which part. We would rather know now than at the end of a procurement cycle.

Email support@tesserapark.com