Nine modules, one database.

SQL

Real SQL over tabular data — SELECT with filters and aggregation, INNER and LEFT JOIN, upserts, prepared statements, materialized views and triggers — so BI tools and ORMs need no new language.

Cypher

The declarative graph pattern language Neo4j uses. Tessera supports the common, widely used subset; teams that rely on advanced Cypher should check their queries before migrating.

TQL

Tessera's native language, built around role-typed hyperedges, with temporal, branch and confidence context — readable, and designed for language models to write.

EXPLAIN

The plan the optimiser will run — operations, index use, cost and row estimates — shown without executing the query.

Vector search

Nearest-neighbour search over embeddings you supply, through an HNSW index with configurable M and ef.

Vector from text

Send plain text; the server embeds it with the model used on your data and returns the nearest records. Needs a configured embedding provider.

BM25 full-text

Language-aware tokenisation and BM25 ranking, searchable on insert — names, codes and exact phrases that semantic search misses. No Elasticsearch sidecar.

Range search

BETWEEN queries over a sorted B-tree index — amounts, timestamps, counts, scores — without a full scan.

Snippets and highlighting

Matched terms wrapped for display, or a short preview centred on the first match.

Hybrid retrieval

Keyword and vector results fused with Reciprocal Rank Fusion, so records strong in either or both rise to the top, with no score normalisation.

Three signals

GraphRAG adds graph proximity — multi-hop neighbourhood expansion — to vector similarity and BM25 text relevance, each with a configurable weight. Enterprise.

Your model

Tessera does the retrieval and grounding and hands ranked context to the model you choose: OpenAI-compatible, Anthropic or local.

In-database pipeline

Document chunking with overlap, pluggable embedding providers and cosine similarity, without a separate retrieval service.

Projections

A named, in-memory snapshot of the graph, filtered by type and directed or undirected. Build it once and run many analyses against it.

Centrality

PageRank, betweenness, closeness, degree and eigenvector — the accounts, people or assets that matter most, and the bottlenecks.

Community detection

Louvain, label propagation and weakly connected components, for hidden clusters, rings and disconnected islands.

Pathfinding

Dijkstra, BFS, A*, Yen's k-shortest paths and random walks — how value or influence can move from A to B.

Similarity

Jaccard and cosine over neighbourhoods — nodes alike by the company they keep, the basis for recommendations and de-duplication.

Graph embeddings

FastRP and Node2Vec turn each node's structural position into a vector for search, clustering or downstream models.

Influence propagation

Independent Cascade and Linear Threshold diffusion from seed nodes, for contagion, cascading failure or rumour spread.

Structural link prediction

Common Neighbours, Jaccard, Adamic-Adar, Preferential Attachment and Katz score likely links from graph shape alone, with no training.

Node classification

A fast logistic-regression baseline over node properties plus graph-structure signals.

GNN classification

A message-passing graph neural network, so an account is judged partly by the accounts it transacts with.

Link prediction

Logistic regression, random forest or gradient-boosted models trained on real edges and negative samples, reported with AUC-ROC.

GAN synthetic data

Synthetic numeric rows that follow the statistical shape of your data without copying real records, deterministic per seed.

Online learning

Streaming linear regression and streaming k-means that update as data arrives, without full retraining.

Model evaluation

AUC-ROC, accuracy, precision, recall, F1, specificity and a confusion matrix, for scores from any source.

Model catalogue

Every trained model with its name, type, version and training metrics, kept through restarts by atomic snapshots.

An honest limit

Accuracy depends on your data. Meaningful results need real, sufficiently large datasets.

Stored procedures

Named query templates in SQL, Cypher or TQL, called by name with safely quoted arguments. Every registration is versioned, with one-call rollback.

Materialized views

A query's result stored as a table, so expensive aggregations are cheap to serve; refreshed on demand.

Triggers

A stored procedure run before or after inserts, updates or deletes on a table. A BEFORE trigger can veto the write.

Time-series operations

Any set of facts treated as an ordered series: bucketing into windows, gap-filling, downsampling and anomaly detection over compressed storage.

Moving averages and rate of change

Computed over the bitemporal data already stored, with no replication into a separate time-series database.

Data lineage

Any record traced back to its sources and forward to everything derived from it, with root sources and a hop-stratified provenance graph.

Connectors

Register an external source and sync its rows in as facts across all five dimensions. PostgreSQL (foreign keys discovered as graph connections) and REST ship in version 1; MySQL, MongoDB, S3/Parquet and Kafka are on the roadmap.

Synthetic data templates

Banking, fraud-scenario, corporate-ownership, compliance and stress-test templates populate a fresh instance, deterministic per seed.

1 · Injection detection

Every query checked against a catalogue of known SQL and Cypher injection shapes, with case and comment normalisation, and logged or blocked before it executes. On by default.

2 · Behavioural anomaly scoring

A running risk score per account, from 0.0 (normal) to 1.0 (highly unusual), flagging unusual amounts, velocity, new counterparties and amounts parked just under reporting thresholds.

3 · Canary records

Honeypot records that reveal unauthorised exploration of the data.

4 · Adaptive query defence

Defences that tighten automatically as suspicious activity rises.

5 · Behavioural biometrics

Each session classified as AI or human from five scored indicators.

6 · Meta-detection

Attempts to probe or evade the detectors themselves, caught.

7 · Security-posture escalation

The engine raises its own guard level: green, yellow, orange, red.

8 · Ensemble blocker

A final decision layer that acts on the combined signal.

Red-team simulation

Attack your own defences on demand — enumeration, exfiltration, schema reconnaissance, timing inference, injection, privilege escalation, structuring — and get the detection rate and concrete recommendations.

Fraud cycle detection

Circular money movement (A → B → C → A) found in the transaction graph, every cycle up to a chosen length.

Monitoring and alerts

Risk scores, pattern matches and alerts as data flows, with on-demand compliance scans, acknowledgement and log management.

API keys

Bearer keys bound to a named principal and roles. Open for a zero-config trial; registering the first key switches the server to closed mode. Community.

Role-based access control

Reader, writer, admin and auditor, with inheritance, enforced at the HTTP layer before any handler runs. Community.

Tamper-evident audit log

Append-only and BLAKE3-chained: altering, deleting or reordering a past entry breaks the chain and shows on verification. Enterprise.

Single sign-on

OpenID Connect (Okta, Auth0, Azure AD, Keycloak, Google) and SP-initiated SAML 2.0 with signed assertions (ADFS, Okta, OneLogin, Ping, Azure AD), mapping identity-provider roles onto Tessera roles. Enterprise.

Encryption at rest

Opt-in, layer-by-layer AES-256-GCM over the audit log and storage layers. The reader detects encrypted and plaintext data, so it turns on without a migration. Enterprise.

Fail-closed licensing

Signed keys decide the tier. A missing, malformed, expired or wrongly signed key falls back to Community rather than unlocking anything.

Sanctions screening

Names screened against the lists you load, with normalisation, alias checks and fuzzy matching, returning confidence scores and a blocking signal. No bundled lists and no list fetcher.

AML alerts

Structuring, layering and high-velocity typologies raised as a triage-ready queue — typology, severity, account, score — for case-management tooling.

Regulatory classification

Fields auto-classified for PII sensitivity and applicable regulations, then mapped to the FIBO ontology and the BIAN service landscape.

REST and OpenAPI

Every capability as a JSON-over-HTTP endpoint, described by an OpenAPI 3.0.3 spec compiled into the binary, so it always matches the running version.

PostgreSQL wire protocol

psql, Postgres JDBC and ODBC drivers, and BI tools such as Tableau, Metabase, DBeaver and Grafana connect and run SQL as if Tessera were Postgres.

JDBC driver

A pure-Java Type-4 driver — one JAR, no native libraries — on a jdbc:tessera:// URL.

SDKs

Typed Python, Rust and TypeScript clients for query, SQL, insert and hybrid search.

Admin dashboard

A web console bundled into the binary: query editor, schema browser, interactive graph visualisation, live stats, and views for time-series and vector data.

CLI and REPL

Embedded mode opens a database on local disk with no server; remote mode connects to a running one. The quick start is tessera serve --demo.

Observability

Counters, gauges and histograms in Prometheus and OpenTelemetry (OTLP) formats, for Grafana, Datadog, Honeycomb or any OTLP backend.

Rate limiting

Per-principal and global gates. A noisy caller gets HTTP 429 and exhausts only its own budget.

Diagnostics

Read-only health, storage and query-performance endpoints over HTTP.