0.0.1 — 2026-10-30

This page lists what TessariDB Vault 0.0.1, released on 2026-10-30, brings. It is the first release. Before 1.0 the configuration and the HTTP surface may still change in a minor release. Each released version keeps its own copy of these pages, so choosing an older version in the version picker shows what that version changed.

It needs TessariDB 0.39.3 or later; 0.39.4 is withdrawn. The image is tessaridb/vault:0.0.1.

Added

• Companies, departments and teams, with owners, admins and members, and every route behind one access decision on the caller's standing. See Companies and roles.
• Sign-in: a single-use join link, a password with an authenticator code, passkeys, and an organisation's own OpenID Connect issuer linked from the account page.
• Records sealed in the browser: eleven record types, one-time password codes, SSH keys and files up to 256 MiB, each revision under a key used once. The server and the database hold ciphertext only. See Keys and layers.
• Sharing with a person, a team, a department or the whole company, and taking a share back, which moves the record to a new key at its next revision. See Records and sharing.
• Recovery the company can see: owners hold the company's recovery key, a member who forgot the unlock password gets their keys back from an owner, and every reach of a member's keys is shown to that member. See Recovery.
• The company trail: every admin change recorded with who, what, to whom, when and why in the same transaction as the change.
• One compose file for the server and its TessariDB node. See Running it.

Not in this release

Files in TessariDB S3, and audit events for sharing. What the design does not protect against is listed in What it does not protect against.