What it is

TessariDB Vault is for a company that shares secrets inside itself: database passwords, cloud consoles, SSH keys, door codes, licence keys. A record is shared with a person, a team, a department or the whole company, and a change of team changes who can read it without rewriting the record.

Status. Release 0.0.1, the first.

What it keeps, and where

• Records, sealed in the browser: title, field names, values and files. The server keeps each revision's sealed body in the company's own TessariDB vault.
• People and groups: companies, members with a role, departments and teams, each member's public keys and their private keys wrapped in their browser.
• Sign-in state: sessions and attempt counters, as TessariDB spaces that expire on their own.
• The trail: every admin change and every read of a sealed record, written in the same transaction as the act.
• Files: up to 64 KiB in the company's vault, larger ones in a TessariDB bucket, encrypted in the browser in 64 KiB chunks either way.

There is no second store beside TessariDB.

Two passwords

Signing in proves who you are to the server: a password and an authenticator code, an OpenID Connect issuer, or a passkey. Unlocking happens in the browser alone: the unlock password is turned into a key with Argon2id and unwraps your private keys for one company. It is never sent, and nobody at the server can reset it; an owner can restore your access through recovery.

What the server reads

The server sees who belongs to which company, department and team, who shares which record with whom, record types, sizes, counts and timestamps. It does not see a record's title, fields, values or files. The full list of what the design does not protect against is on its own page, and it is the same list the product README carries.

What it is not

• Not a browser extension and not an autofill client: 0.0.1 is the web application the server serves.
• Not a hosted service: you run it beside your own TessariDB node.