Tessa is self-sovereign identity infrastructure: a credential issued once by your home state, verified at any border or bank: offline, privately, and on your terms.
Every border crossing today asks a database “is this person real?” Tessa asks the person, and lets them answer without anyone phoning home.
Your wallet generates a key on your phone. A camera makes a one-way “face-seal.” The state signs a credential binding the two, then throws the photo away. Nothing about you is kept in a database.
Your wallet shows only what's asked, your nationality, and proves it's really you with a live selfie. Signature, revocation and liveness checks all run on the kiosk's local cache. No internet to your government required.
Weeks later a bank's KYC asks the same credential for less: just your nationality, no face. One enrolment, many uses, no re-registration, no database lookup at your home state. Ever.
The home state signs; any verifier checks the signature against a cached masterlist. There is no database lookup at the moment of verification: the issuer signs once and gets out of the way.
The load-bearing property. African land borders often have no connectivity. Signature and revocation checks run against locally cached, periodically-synced material, so the gate opens with no WAN at all.
Enrolment derives a one-way biometric hash and discards the photo. There is no pooled biometric store. At the border, a live selfie with anti-spoofing (a printout or screen recapture is rejected) confirms the holder is the bound person.
The credential reveals “a valid national of X”, never the holder's life. The wallet trims to exactly the claims a verifier asks for; everything else never leaves the phone.
One credential, many verifiers, each seeing only what its policy needs. Open a bank account weeks after crossing a border, with no re-enrolment and no call to your government. This is the revenue surface.
A state can revoke at any time, but the signed credential remains permanent, non-repudiable evidence of what it asserted. Every status change is anchored on a public chain, so a revocation can't be silently rolled back.
The bank never learns about the border. The border never learns about the bank. Neither calls your government.
Every status change is anchored on a public chain. Anyone with the chain's address can prove a revocation wasn't silently rolled back, and a verifier that sees the chain disagree with a new list simply refuses to load it.