Sensitive data security

Tessera.
Sensitive data under control.

card••••••••••

token••••••••••

phone••••••••••

aws key••••••••••

email••••••••••

password••••••••••

iban••••••••••

npm token••••••••••

db url••••••••••

api key••••••••••

ssh key••••••••••

jwt••••••••••

card••••••••••

private key••••••••••

national id••••••••••

registry••••••••••

phone••••••••••

email••••••••••

secret••••••••••

token••••••••••

iban••••••••••

password••••••••••

cert••••••••••

key••••••••••

Safe. Under Control. Audited.24 / 24

About us

We are consultants in sensitive data security. We work in DevSecOps and application and infrastructure security — from design through to operation.

We focus on the places where security meets day-to-day operation: credentials, certificates and sensitive data, whose management in modern infrastructure has outgrown what manual procedures can cover.

What we do

Finding unsecured credentials across systems

We locate credentials, keys and certificates stored in the clear in source code, configuration and CI/CD environments. The output is an inventory of findings ranked by severity — usually the first step before any other measure.

source codeconfigurationCI/CD

FROM node:20-alpine WORKDIR /app ENV NPM_TOKEN=npm_9f3cK2mQ7xR4tB8wZ1 COPY package*.json ./ RUN npm ci --omit=dev ENV DB_URL=postgres://app:Pa55w0rd!@db COPY . . CMD ["node","server.js"]

hardcoded credentials0 / 2 found

Secure storage and auditing of sensitive credentials across the organisation

We centralise the management of credentials, keys and certificates. Access is issued dynamically and time-limited, rotated automatically, and every issue is recorded in an audit trail. This covers the NIS2, DORA and ISO 27001 requirements on access control and auditability.

NIS2DORAISO 27001

PKI automation — internal and external certificates

We deploy an internal certificate authority for mutually authenticated service-to-service communication (mTLS) and automate both issuance and renewal, including integration with public certificate authorities. With the lifetime of public TLS certificates shortening to as little as 47 days, this is now a precondition for running at all. It relates to the NIS2 and DORA requirements on encrypted communication.

mTLSinternal CAexternal CANIS2DORA

Data transformation

Masking, pseudonymisation and tokenisation of sensitive data — typically for production data in test and development environments, for analytics and reporting, or to reduce the number of systems handling payment data. It narrows PCI DSS 4.0 audit scope and satisfies the GDPR requirement for pseudonymisation. Format-preserving encryption lets existing applications stay unchanged.

PCI DSS 4.0GDPRFPE

Phone +420 771 226 918 masked irreversible · last three digits kept for support

Name Jan Novak encrypted reversible with the key · ciphertext length hides the input

Card 4539 8871 0025 1147 pseudonymised format preserved · same input, same token · still validates and joins