Tessa is self-sovereign identity infrastructure: a credential issued once by your home state, verified at any border or bank — offline, privately, and on your terms.
Every border crossing today asks a database “is this person real?” Tessa asks the person — and lets them answer without anyone phoning home.
Your wallet generates a key on your phone. A camera makes a one-way “face-seal.” The state signs a credential binding the two — then the photo is thrown away. Nothing about you is kept in a database.
Your wallet shows only what's asked — your nationality — and proves it's really you with a live selfie. Signature, revocation and liveness checks all run on the kiosk's local cache. No internet to your government required.
Weeks later a bank's KYC asks the same credential for less — just your nationality, no face. One enrolment, many uses, no re-registration, no database lookup at your home state. Ever.
The home state signs; any verifier checks the signature against a cached masterlist. There is no database lookup at the moment of verification — the issuer signs once and gets out of the way.
The load-bearing property. African land borders often have no connectivity. Signature and revocation checks run against locally cached, periodically-synced material — the gate opens with no WAN at all.
Enrolment derives a one-way biometric hash and discards the photo. There is no pooled biometric store. At the border, a live selfie with anti-spoofing (a printout or screen recapture is rejected) confirms the holder is the bound person.
The credential reveals “a valid national of X” — never the holder's life. The wallet trims to exactly the claims a verifier asks for; everything else never leaves the phone.
One credential, many verifiers, each seeing only what its policy needs. Open a bank account weeks after crossing a border — no re-enrolment, no call to your government. This is the revenue surface.
A state can revoke at any time — but the signed credential is permanent, non-repudiable evidence of what it asserted. Every status change is anchored on a public chain, so a revocation can't be silently rolled back.
The bank never learns about the border. The border never learns about the bank. Neither calls your government.
Every status change is anchored on a public chain. Anyone with the chain's address can prove a revocation wasn't silently rolled back — and a verifier that sees the chain disagree with a new list simply refuses to load it.