What this page answers
- Which controls are Tero-owned vs customer-owned
- How baseline integration traffic flows between customer systems and Tero
- Where enterprise teams typically add stricter controls
Current state (as of March 5, 2026)
Tero supports two deployment models:- Tero-hosted control plane
- Self-hosted control plane in customer-managed infrastructure
Scope and integration boundary
- Baseline integration model is customer-initiated outbound API traffic over HTTPS.
- Baseline operation does not require vendor-initiated inbound connectivity into customer environments.
- Identity policy inside the customer IdP remains customer-owned in both models.
Ownership model diagram
Responsibility matrix
| Control area | Tero-hosted | Self-hosted |
|---|---|---|
| Infrastructure security and patching | Tero | Customer |
| Network perimeter and private connectivity | Tero-managed baseline | Customer |
| Identity provider policy (IdP side) | Customer | Customer |
| Application authn and authz implementation | Tero | Tero software with customer runtime controls |
| Secrets and key administration | Tero-managed services | Customer-managed services |
| Data retention and deletion operations | Tero | Customer-operated runtime with product-defined behavior |
| Incident response for platform operations | Tero | Customer for environment ops, Tero for product support |
| Subprocessor management | Tero | Customer (for customer-chosen stack) |
Where enterprise teams usually tighten controls
- Self-hosted deployment for full environment ownership
- Customer IdP policy enforcement for authentication lifecycle controls
- Destination allowlisting and private routing in customer networks
- Customer-selected AI provider path where required
Go-live checklist (recommended)
- Confirm identity and role mapping model.
- Confirm network allowlisting and routing requirements.
- Confirm data handling and retention expectations.
- Confirm incident communication paths and named contacts.
Evidence you can request
| Topic | Primary evidence |
|---|---|
| Ownership split by deployment model | This page |
| Architecture and trust boundary | Security Architecture |
| Data handling scope and storage model | Overview, Data Handling |
| Encryption and key management | Encryption and Key Management, Encryption Standard |