The platform
Three products, one register and two backends
Issuance, payments and prediction markets over a single identity store, ledger and audit trail — served today by a NestJS runtime and, phase by phase, by a Rust engine built against the same frozen API contract. Both are in the source you licence.
What you are licensing
Three applications, each with its own web and mobile surface, over shared infrastructure.
Primary issuance & cap table
Tessera Invest
Tokenized issuance end to end: securities, multi-phase offerings, four-eyes approval before an offering can take money, subscriptions, the register, distributions and a secondary order book with configurable market making.
- ERC-20, ERC-3643, ERC-1400, ERC-721, ERC-1155
- Multi-phase offerings with per-phase pricing and bonuses
- Order book, stop orders, automated market making
- Register, cap table and distribution runs
Payments & stablecoin rails
Tessera Pay
Accounts, transfers and on-chain settlement over the same double-entry ledger the issuance side posts to. Amounts are exact integers in minor units at every trust boundary, so a payment and a subscription reconcile against one another rather than approximately.
- Double-entry ledger in exact minor units
- Custodial and self-custody wallets
- On-chain ERC-20 transfer engine with retry and reorg handling
- Sanctions screening at the transfer gate
Prediction markets
Tessera Predict
Parimutuel event markets settled off-chain on the same ledger. It ships disabled behind two independent module gates and a jurisdiction gate, because whether you may operate it is a question about your licence and not about the software.
- Parimutuel pricing, no counterparty book to fund
- Auditable settlement oracle with recorded sources
- Two module gates plus a geographic gate
- Ships disabled — you decide if it is switched on
Enterprise Features
Complete infrastructure for launching and operating a regulated STO platform.
Three products, one register
Invest, Pay and Predict are separate applications over one identity store, one ledger and one audit trail. An investor onboarded once is an investor everywhere, and the balances reconcile because there is only one set of them.
9 Blockchain Networks
Native support for Ethereum, Polygon, BSC, Arbitrum, Optimism, Avalanche mainnets plus Sepolia, Polygon Amoy, and BSC testnets.
Multiple Token Standards
Full support for ERC-20, ERC-3643, ERC-1400, ERC-721, and ERC-1155 token standards with deployment wizard.
Secure Custodial Wallets
AES-256-GCM encrypted wallet infrastructure with multi-step approval workflows and OpenBao Vault integration.
Professional Trading Engine
Complete trading infrastructure with order book, market making, stop orders, and real-time WebSocket updates via Socket.io.
Built-in Compliance
Sumsub KYC integration, internal KYC provider option, OFAC compliance checks, and immutable audit logs with database triggers.
8-Language Support
Full internationalization with English, French, Spanish, German, Mauritian Creole, Chinese, Arabic (UAE), and Russian.
Comprehensive Admin Dashboard
Modular admin interface with role-based access, KPI dashboards, user management, custody approvals, and market controls.
Native Mobile Applications
iOS and Android native apps included with full trading, portfolio management, KYC, and real-time notifications.
Third-Party Integrations
Integrated with industry-leading services and infrastructure providers.
Institutional Custody
- Fireblocks native integration (production-ready)
- 3 custody modes: internal, hybrid, full Fireblocks
- TAP (Transaction Authorization Policy) support
- Automated treasury sweeps and refills
KYC & Identity
- Sumsub integration with webhooks
- Internal KYC provider with document uploads
Blockchain
- Hardhat 2.22 for smart contract deployment
- Ethers.js 6.16 for blockchain interactions
- Pinata IPFS for NFT metadata
Infrastructure
- Redis for caching and rate limiting
- BullMQ for job queue processing
- Elasticsearch 9.2 for search
Security & Secrets
- OpenBao Vault for secrets management
- AWS CloudWatch Logs integration
- OFAC API for compliance checks
Security & Compliance
Enterprise-grade security controls built into every layer of the platform.
Authentication & Sessions
- JWT tokens in HttpOnly cookies (30-minute expiration)
- SHA-256 hashed refresh tokens with rotation (7-day expiration)
- TOTP MFA with backup codes
- Step-up authentication for sensitive operations (5-60 min)
- Multi-device session tracking with theft detection
Encryption & Data Protection
- AES-256-GCM for wallet private keys
- bcrypt with work factor >= 12
- TLS for all data in transit
- OpenBao Vault for master keys
Audit & Compliance
- Immutable audit trails with database triggers
- Comprehensive event tracking for all actions
- CSV/JSON export capabilities
- OFAC compliance checks
Access Control
- Role-based access control (RBAC)
- Module-level permissions with overrides
- Account lockout after failed attempts
- Multi-step approval workflows
Multi-Signature Workflows
- Customizable M-of-N approval workflows (e.g., 2-of-3, 3-of-5)
- 13 operation types: withdrawals, transfers, token minting, custody changes
- Role-based approver requirements (Admin, Finance, Compliance)
- Time-limited approval requests with auto-expiry
- Full audit trail of approval chains and rejections
Securities & Token Management
- Controlled token minting with approval workflows
- Transfer restrictions based on KYC/AML status
- Supply caps and investor limits per token
- Investor whitelist/blacklist management
- Token lifecycle management (issuance, trading, redemption)
Compliance Standards
Architecture designed to meet regulatory and security standards.
Platform architecture implements security controls including audit logging, access controls, encryption, and data protection aligned with SOC 2 requirements.
Information security management practices built into the platform including risk management, security controls, and audit procedures.
Full GDPR compliance with data export, deletion capabilities, consent management, and privacy-by-design principles.
Two backends, one contract
You are not buying a bet on a rewrite. You are buying the runtime that works and the one being built beside it.
The runtime behind every screen in this demonstration. NestJS 11 on Node.js, TypeScript end to end, TypeORM against PostgreSQL, BullMQ for asynchronous work. It is the supported engine, and it stays supported: buying Tessera does not commit you to a migration.
A domain-by-domain rewrite in Rust — 24 crates covering the platform spine, ledger, identity and compliance — built against a frozen copy of the NestJS API contract, with a CI gate that fails on any added route or changed request shape. Foundations, platform core, database, security spine, ledger and identity are closed against published exit gates; compliance is open. Because the contract is frozen, adopting it is an engine swap rather than a re-integration.
Migration progress is reported from the record kept in the repository, phase by phase, with the exit gate for each phase written down before it is attempted. It is a statement of where the work has got to, not a delivery date.
Technology Stack
Built with proven, enterprise-grade technologies.
Ready to look at the code?
Contact our team to discuss deployment options and technical requirements.