Tessr, back to the top
Join the waitlist

Tessr · encrypted client rooms

Drop any file. It's encrypted here, in your browser, and never uploaded.

Drop a file here

Any file up to 64 MB. Nothing is stored, downloaded or sent.

Or read how Tessr works

01 Why

Confidential files still travel in the open.

Every service that carries an attachment or a share link could open it.

  1. An email attachment

    Both mail services keep a readable copy.

    Who can open it
    • You
    • Your client
    • Both mail services
    • Anyone it's forwarded to

  2. A cloud drive link

    The provider holds the keys to what you upload.

    Who can open it
    • You
    • Your client
    • The drive's provider
    • Anyone the link reaches

  3. A Tessr room

    Research prototype

    Sealed on your device before it leaves.

    Who can open it
    • You
    • The people you invite
    • Not Tessr

We store sealed boxes we hold no key for, so a breach of our servers, a curious employee or a court order to us gets sealed bytes and the little metadata we list under Security. Client rooms are designed; their engine runs today as a research prototype.

02 How it works

One file, sealed from end to end.

Our server is in the middle of all four steps and can open none of them.

Sample file. Rooms are not built yet; steps 2 to 4 run in the rooms engine at /proof.

  1. Seal it on your device

    Built

    Your device makes a new key for the file and seals it with AES-256-GCM before anything leaves.

  2. Lock the key to the room

    Research prototype

    The file's key is locked with the room's key, which lives only on the devices of the people in the room, never on our server.

  3. Invite your client

    Research prototype

    Your client gets a link, and a short code from you by phone or text, never in the same message. Their browser makes its own keys and joins the room.

    Whoever holds both the link and the code counts as your client at the first visit.

  4. They open it on their device

    Research prototype

    Their device unlocks the room key, then the file. Or you show it for a set time instead: view only, with their name on every page.

What our server holds so far

  • A sealed box, its padded size and the time it arrived
  • The file's key, locked with a room key it doesn't have
  • That an invite was used, and when
  • That the file was opened, and when. Never what's inside

Step 1 is how the vault and desktop app already work. Steps 2 to 4 run today only in the rooms engine, a research prototype that hasn't been reviewed outside Tessr. Run it in your browser.

03 Features

Every client file, in a room of its own.

Nothing in a room opens for anyone you didn't invite, us included.

  • One sealed room per client or deal. Its engine runs at /proof today; the apps are next.

    Early pricesIn Pilot, then €15 to €30 a person a monthJoin the pilot: A room for every client

  • The vault seals any file today. Asking a client for papers comes with rooms.

    Early pricesIn every plan. Clients don't pay.Join the pilot: Send and ask for files

  • Next: a file shown for a set time, view only, with the viewer's name on every page.

    Early pricesIn Pilot and Firm, once builtJoin the pilot: Show it, don't send it

  • Planned: sign with Smart-ID or the EU wallet, and each side keeps its own signed copy.

    Early pricesPlanned. Signatures at cost plus a small feeAsk about it: Qualified signing

  • Your devices hold the keys. A recovery kit split between your admins runs at /proof; the app comes next.

    Early pricesIn every planJoin the pilot: Keys, not passwords

  • Planned: files kept sealed for years, two people to approve each open, and the key destroyed at the end.

    Early pricesPlanned. Priced with the first firmsAsk about it: Archive, for the long term

04 Who it's for

For firms that hold other people's secrets.

Small and mid-size law firms, notaries, accountants and private clinics, starting in Lithuania.

Law firms

Contracts, disclosure letters, board resolutions and ID copies.

Accounting and tax firms

Bank statements, payroll files, tax returns and company accounts.

Deal advisers

Share purchase agreements, due diligence files and the papers of a sale.

Their clients

Next

Free for them. They will open their room in any browser, with nothing to install.

05 Security

What we can see, in plain words.

Then what is built, and the limits we'd rather you hear from us.

What Tessr can see

  • Which company pays, and for how many people
  • The IP address you connect from
  • Padded file sizes, and when files go up or are opened
  • Which devices are in which room, and which invite added each client
  • Which public keys belong to your firm

What Tessr can't see

  • What's inside any file or note
  • File names
  • Your keys, or your recovery shares

The building blocks

  • AES-256-GCM, a new key for every file, Built

    Every file and note is sealed on your device before it leaves.

  • Argon2id, Built

    Turns your account number into a key slowly on purpose, so guessing is expensive.

  • X-Wing key exchange, Built

    Post-quantum and classic together, built so files sealed today stay closed even if a future quantum computer breaks today's key exchange. X-Wing is still an IETF draft.

  • A signed list of company keys, with a safety code, Research prototype

    So a client can check they joined the right firm.

  • A recovery kit split between three admins, Research prototype

    Any two restore the firm's access. Tessr never holds a share it can open.

  • An independent security audit, Planned

    Before any real client data. None has been done yet.

Honest limits

  1. Tessr is a prototype.

    The vault, teams and desktop app work. The rooms engine runs as a research prototype; the apps, server and browser viewer around it are not built, and there is no independent audit yet.

  2. A camera beats any screen.

    The desktop app asks Windows to keep it out of screenshots, but that is a request, macOS no longer honours it, a browser can't block a screenshot, and nothing stops a phone camera. That is why timed views will put the viewer's name on every page.

  3. We can't protect a compromised device.

    Spyware on your computer or phone sees what you see.

  4. We see a little metadata.

    Sizes, times, devices and which keys are your firm's, as listed above. Never what's inside.

  5. You still trust our server in two places.

    App updates, and the public keys it hands out for rooms and teams. Signed releases are planned.

  6. No back door means no rescue.

    If every key and two of the three recovery shares are lost, nobody can open the files, us included.

  7. You trust the code a website sends you.

    As with every website, this page included. Clients will open their rooms in the browser, so they will trust the code our site sends them. Signed releases are planned.

  8. The waitlist needs an email.

    Sealed in your browser, but we hold its key so we can write once. Deleted after launch.

06 Pricing

Clients free. Firms per person.

A range we are testing, set with the first firms. Nothing is on sale yet.

  • Client

    Invited by a firm

    Free

    Clients don't pay

    • Open your room in any browser
    • Send the papers your firm asks for
    • Nothing to install

    Where the sealed boxes are kept Sealed in your firm's room

    Comes with client rooms

    Ask a question

  • Pilot

    First five firms

    Try it with real clients

    Set with you

    For the first five firms

    • Client rooms for your real clients
    • We sit with you for your first room
    • A say in what we build next

    Where the sealed boxes are kept Sealed, on EU servers

    Starts when client rooms are ready, on test files until the audit is done

    Join the pilot

  • Firm

    Every client in a room of their own

    €15–€30

    A person a month. This is the range we are testing.

    • A room per client, with timed view links
    • An activity log you can export
    • A recovery kit split between admins

    Where the sealed boxes are kept Sealed, at two EU providers

    Comes with client rooms

    Ask about Firm

  • Your servers

    The boxes stay in house

    Ask us

    Priced with you

    • Sealed boxes kept on servers you run
    • The same rooms and apps
    • For firms that must keep data in house

    Where the sealed boxes are kept Only your own servers

    Planned for after launch

    Ask about it

Euros, before VAT. Prices are set with the first firms and may change before launch.

07 Roadmap

Built, next and planned.

What works today and what comes after. No firm uses Tessr yet.

  1. Built
    • The encryption core, Built

      AES-256-GCM with a new key per file, Argon2id and X-Wing.

    • The sealed vault, Built

      Encrypted notes and files, teams, and linking a new device with a one-time code.

    • The desktop app for firms, Built

      Files and teams on the sealed vault. Clients, requests and reviews run on a sample firm until client rooms are connected.

  2. Research prototype
    • The rooms engine, Research prototype

      Invites with a code, a signed list of company keys, timed views, agreements both companies sign and the recovery kit, compiled to run in a browser. Run it in your browser

  3. Next
    • Recovery words, Next

      Twelve words at sign-up that bring your own account back on a new device (the firm's root key in Proof has its own 24). Tessr can't get anything back for you; for a firm, the admins' recovery kit still restores the firm.

    • Client rooms in the apps, Next

      With the first five pilot firms, on test files until the audit is done.

    • The clients' browser room, Next

      Clients open their room in any browser, with nothing to install.

    • Timed views, Next

      A file a client can open for a set time, with the viewer's name and the time on every page.

    • An independent security audit, Next

      Before any real client data. None has been done yet.

  4. Planned
    • Archive, Planned

      Long-term encrypted storage for contracts, tax and HR files. A key agent at your company keeps the keys locked to one approved computer and uses them only in memory. A document opens after approval, by two people by default, with the viewer's name on every page, and every open is logged. When the retention period ends, the key is destroyed.

    • The iPhone app, Planned

      The firm app on your phone.

    • Qualified signing, Planned

      Smart-ID and the EU wallet, through a trust service.

    • Signed releases, Planned

      So you can check that an app update, and the site's code, came from us.

    • Your own servers, Planned

      Sealed boxes kept on servers your firm runs.

  5. Later
    • An assistant on Tessr's own servers, Later

      It would learn how you move through your workspace and suggest your next step. Planned, not built.

08 Questions

Plain answers.

If something isn't answered here, the founders read every note.

Can Tessr open my files?

No. Each file is sealed on your device with its own key, and only the devices of the people you share it with can open it. We store sealed boxes we hold no key for. That is how the vault works today, and client rooms will work the same way.

Was the file I dropped really not sent?

Yes. It was read and encrypted in your browser, and the last line counted the page's network requests during the load from your browser's resource list, which holds every request, fonts and styles included. You can check with the Network panel, or in airplane mode. It used your browser's encryption with Tessr's method, not Tessr's code.

Can I use Tessr today?

Not yet. The encryption core, the sealed vault with teams and the desktop app are built. The rooms engine runs as a research prototype. The apps, server and browser viewer around it come next, and an independent security audit comes before any real client data.

Is it peer to peer?

Not in the sense of a network of strangers' computers: we run no such network and no token. What is peer to peer is the key. It lives only on the devices at each end, and our servers store sealed boxes and run the timers without being able to open them.

What if someone loses a key?

Recovery words come next: twelve words at sign-up that bring your account back on a new device. For a firm, each device will get its own keys, so a lost laptop can be switched off, and a recovery kit will be split between three admins, any two of whom can restore access. Tessr will never hold a share it can open.

Can someone screenshot a timed view?

Yes, in the end. The desktop app asks Windows to keep it out of screenshots, but macOS no longer honours that, a browser can't block one, and no app stops a phone camera. So, once timed views are built, every page will carry the viewer's name and the time, and a leak points back to whoever leaked it.

Is it safe from quantum computers?

It is built for that: the key exchange, X-Wing, mixes a post-quantum method with a classic one, so files sealed today should stay closed even if a future quantum computer breaks today's key exchange. X-Wing is still an IETF draft, and nobody can promise what future machines will do.

What does it cost?

Clients never pay. For firms, €15 to €30 a person a month is the range we are testing, and the first five firms join a pilot at a price set with them. Nothing is on sale yet.

Why the name Tessr?

It comes from the tessera. In ancient Rome, a host and a guest would break a small tile in two and keep a half each. Whoever held the matching half was trusted, no name needed. Tessr keeps that idea: in the prototype you sign in with a random 21 digit number made on your device, not your name, email or phone.

What happens to my waitlist email?

We send one email when Tessr launches, then delete the list. Your browser seals the address before it is sent; we hold the key to open it, so that we can write that one email.

Still a question? Write to the founders.

Waitlist

One email, at launch. Then we delete it.

What our server receives

467 characters of sealed text, the same length for every address.

Sealed in your browser. Only a key we keep offline opens it. No IP or time is kept with it; our host keeps short request logs.

  • One email, ever. Never shared or sold.
  • News until then goes out on X, not by email.