Security & Privacy

The short version

No integration. Tessera does not connect to your student information system, your permit database, your card system, or your network. There is nothing to wire up, which means there is very little to review.

No license plates. We do not read, store, or process plate numbers or vehicle details.

No sale of data, no advertising, no analytics or session-replay tools. There is no third-party tracking code in the product.

What we collect

An account is an email address, a username, a campus, and an affiliation — student, staff or faculty, which decides which permit zones the app shows. A university email address is optional and used only to display an affiliation badge.

Activity is lot reports (lot, status, timestamp) and visits (lot, arrival, departure), which is what produces the demand and dwell-time figures.

Location: when a person taps to check in, and only then, we record the position their device reports. There is no background tracking and no trail between lots. Those coordinates are erased automatically after 90 days, and immediately if the account is deleted.

Where it lives, and who else touches it

Processor	Purpose	What it receives
Supabase	Database, authentication, file storage	Account and activity data. US region
Vercel	Hosting, scheduled jobs	Request traffic, IP addresses, logs. US region
Resend	Transactional email	Recipient address, message contents
Anthropic	Reads a typed report like "Lot 42 is full"	That one sentence and the campus lot list. No identifier, no email, no location
Stripe	Merchandise shop payments	Payment details, shipping address. Nothing about parking
Printful	Merchandise fulfilment	Recipient name and address. Nothing about parking

Data is encrypted in transit and at rest. Stripe and Printful receive nothing at all from anyone who never places a shop order.

Access and retention

Sign-in is an emailed one-time code. No passwords are stored, so there is no password database to breach.
Row-level security is on every table. Most records are readable only by the person they belong to. Parking reports are deliberately shared — a live campus map is the product — and show the lot, status, time, and reporter's username.
Staff access is role-based and audited — every privileged action writes an immutable-by-convention record of who did what, to what, and when.
Anyone can delete their own account from inside the app, with no support request and no conditions.
On deletion: profile fields are cleared at once; reports and visits are de-identified rather than destroyed, so campus-level signal survives without the person; the remaining anonymized record is purged after seven years.

What we do not have yet

Because you will ask, and a gap you hear from us is cheaper than one you find.

No multi-factor authentication, for users or for our own staff accounts. Sign-in security currently rests on the security of the email account. This is the most significant item on this page.
No SOC 2 or ISO 27001 audit, and no third-party penetration test. We are early, and an audit before a first paying customer would be theatre. A targeted penetration test is the better first spend and is the one we intend to make.
No accessibility conformance report (VPAT). A map-first interface at a public university deserves a real assessment and has not had one.
No uptime SLA with service credits. We are a small team with no 24/7 rotation, and an SLA we cannot staff is a promise we would be caught on.
Cross-institution isolation is enforced in the application, and is being moved into the database. That work lands before any second university's accounts exist — not after.

What we will do for your review

Complete a HECVAT, Lite or Full.
Answer your own security questionnaire.
Sign a data processing agreement.
Give you a named security contact and an escalation path.
Notify you of a confirmed personal-data breach within 72 hours, and an affected institution even where user impact is still uncertain.
Support a data export guarantee in the agreement — export is included, always, so there is no lock-in to negotiate your way out of later.

Ask us the hard one.

If something here is not enough for your institution, tell us which part. We would rather know now than at the end of a procurement cycle.

Email support@tesserapark.com