Security Architecture

Last reviewed: March 5, 2026 Owner: Security + Engineering Review cadence: Quarterly Status: Implemented This page maps request flow through Tero, the trust boundaries along the way, and the controls that enforce them.

Reviewer focus

Where authentication, authorization, encryption, and logging controls are enforced
Where Tero terminates traffic and whether it requires inbound connectivity
Which architecture layers are Tero-owned vs customer-owned in self-hosted deployments

Implementation status (March 5, 2026)

Tero operates as a control plane. Customer users and systems call Tero APIs over HTTPS. Tero executes operations within tenant and workspace scope and logs security-relevant activity for audit and response.

System flow diagram (hosted default)

End-to-end request flow (hosted default)

A user or integration authenticates to approved endpoints.
Traffic reaches Tero over TLS-protected connections.
Tero authorizes requests to tenant and workspace scope.
Services execute control-plane workflows and metadata processing.
Tero stores required data in encrypted managed services.
Tero records security and operational events for detection and audit.

Trust boundaries and enforcement points

Boundary	What it separates	Key controls
Identity	Authenticated users and integrations vs unauthenticated requests	Auth provider integration, token and session validation, scoped access
Network	Internet edge vs application ingress	TLS-required connections, edge protections, controlled endpoint exposure
Application	Tenant and workspace operations	Tenant-scoped authorization and role-based access patterns
Data	Control-plane metadata vs customer source telemetry systems	Data minimization model and bounded storage scope
Secrets	Runtime services vs credential material	Managed secret stores with least-privilege access

Tenant isolation model (hosted)

Layer	Isolation approach
Application	Tero authorizes requests in tenant and workspace scope; role and operation checks run before execution
Data	Tero applies tenant and workspace context in control-plane data access paths; bounded data model reduces cross-tenant exposure risk
Network	Managed ingress and service boundaries isolate Internet edge, application ingress, and internal service communication paths

Isolation boundary diagram

Architecture diagrams and review artifacts

Tero maintains architecture documentation that describes trust boundaries, tenant isolation, and data-flow separation. This Trust Center includes public overview material; Tero shares deeper architecture walkthrough material for security review under NDA.

Traffic and termination model

Path	Tero-hosted	Self-hosted
External API traffic	HTTPS to Tero-managed endpoints	Customer-defined ingress path
TLS termination	Hosted edge reverse-proxy layer	Customer-defined termination model
Service-to-service traffic	Managed cloud networking controls	Customer networking controls
Inbound connectivity into customer environment	Not required for baseline API integration	Customer-controlled

Hosted vs self-hosted ownership

Area	Tero-hosted	Self-hosted
Infrastructure runtime ownership	Tero	Customer
Environment hardening	Tero platform controls	Customer environment controls
Secrets backend operations	Tero-managed implementation	Customer-managed implementation
Private connectivity model	Tero-managed hosted model	Customer-defined
Incident ownership for infrastructure events	Tero	Customer

Evidence you can request

Control domain	Implementation summary	Primary evidence
Authentication and session controls	Enterprise auth provider integration and scoped session handling	Identity and Access
Authorization	Tenant and workspace scoped access and role enforcement	Identity and Access
Encryption in transit and at rest	TLS-required communication and encrypted managed storage	Encryption and Key Management, Encryption Standard
Secrets management	Centralized secret stores with least-privilege access	Identity and Access, Encryption and Key Management
Monitoring and response	Centralized logging and security event monitoring	Incident Response and Resilience
Change control	Peer review, CI checks, controlled deployment paths	Secure Development

Exceptions and governance

Any architecture-control exception requires documented risk, explicit Security and Engineering approval, compensating controls, and a time-bound remediation date. Evidence requests:

Overview

Foundations

Controls

Assurance

Policies

Reviewer focus

Implementation status (March 5, 2026)

System flow diagram (hosted default)

End-to-end request flow (hosted default)

Trust boundaries and enforcement points

Tenant isolation model (hosted)

Isolation boundary diagram

Architecture diagrams and review artifacts

Traffic and termination model

Hosted vs self-hosted ownership

Evidence you can request

Exceptions and governance

​Reviewer focus

​Implementation status (March 5, 2026)

​System flow diagram (hosted default)

​End-to-end request flow (hosted default)

​Trust boundaries and enforcement points

​Tenant isolation model (hosted)

​Isolation boundary diagram

​Architecture diagrams and review artifacts

​Traffic and termination model

​Hosted vs self-hosted ownership

​Evidence you can request

​Exceptions and governance

Reviewer focus

Implementation status (March 5, 2026)

System flow diagram (hosted default)

End-to-end request flow (hosted default)

Trust boundaries and enforcement points

Tenant isolation model (hosted)

Isolation boundary diagram

Architecture diagrams and review artifacts

Traffic and termination model

Hosted vs self-hosted ownership

Evidence you can request

Exceptions and governance