CENTRAL CLOUD · COPIES IN THE WILD
19
Private data network
Move permission,
not possession.
Tresolo lets teams work on files directly from the owner's own storage. Every connection is identity-verified, encrypted end to end, governed by policy and written to a tamper-evident audit trail. The file never leaves home.
■ Data stays home
◇ Relay · ciphertext only
● Authorised device
The film
See Tresolo in motion
Cloud storage asks
"Where should we put your data?"
Tresolo asks
"Who should be allowed to touch it, and how do we prove what happened?"
Core principles
Six rules built into the data path
P1
Data stays home
Files remain on owner-controlled storage. Tresolo never needs a permanent central copy.
P2
Never trust, always verify
Every user, device and session is verified before any byte moves, and re-verified throughout.
P3
Least privilege
Access is scoped to the exact project, folder, file, time window and action, and expires automatically.
P4
Nothing exposed
No open inbound ports. The agent only makes outbound, authenticated connections.
P5
Everything recorded
Every access and policy decision is written to a tamper-evident ledger.
P6
Security is the product
Encryption, policy, DLP and audit live inside the data path, not as add-ons.
What customers get
Control
Decide who sees what, on which device, for how long, with which rights. Revoke instantly.
Proof
An immutable record of every view, download, share and policy decision.
Speed at scale
Terabyte media, imaging studies and CAD streamed on demand, never re-uploaded.
Resilience
Ransomware behaviour detected and contained at the agent, with protected snapshots.
Sovereignty
Data never leaves the premises, country or jurisdiction the owner chooses.
Interactive
Open a 2 TB folder you'll never download.
Play the colourist, the radiologist or co-counsel. Change the device posture, then try to break the rules.
Platform
A secure fabric, not a bucket.
The control plane decides who may access data. The data plane delivers encrypted bytes directly between the owner's agent and the authorised user, through relays that cannot read them.
Product family
Seven components, one path
Data owners · IT
Tresolo Agent
Lightweight service next to the data on a workstation, NAS, server or private-cloud VM. Indexes, encrypts and serves files, and enforces policy locally.
Enterprise IT
Tresolo Gateway
Appliance or VM that fronts many storage systems for a whole site, with high availability.
Tresolo-run or self-hosted
Relay Network
Global relays that broker encrypted connections between agents and users. They only ever see ciphertext.
Admins · Security
Control Plane
Identity, policy, key management, device trust and the admin console.
End users · Externals
Tresolo Apps
Desktop, web and mobile clients, a mounted virtual drive, and a secure in-browser viewer and player.
Security · Legal · Compliance
Tresolo Ledger
Immutable, hash-chained audit trail with SIEM export and compliance reports.
Regulated organisations
Tresolo Shield
The enterprise plan: DLP, ransomware resilience, advanced device trust and compliance packs.
Architecture
Six layers, each with a guarantee
Hover or tap a layer.
Life of an access request
A colourist opens 2 TB of unreleased footage
The footage lives on a studio's on-premises storage. Here is everything that happens between the click and the first frame.
01 · Invite
Share under policy
Stream-only, no download, forensic watermark, 14-day expiry, managed devices only, two approved countries.
02 · Identity
Own company SSO
Or a Tresolo identity with phishing-resistant MFA such as a passkey.
03 · Device check
Posture reported
OS version, disk encryption, screen recorders, jailbreak status, MDM, endpoint protection.
04 · Policy
Scoped token
User, device, location, time, classification and risk score produce a short-lived session token.
05 · Key release
Wrapped per device
The data key is wrapped for this device and session. Relays never see plaintext.
06 · Connection
Direct path first
The agent's outbound link is matched to the user. Peer-to-peer first, relay as ciphertext otherwise.
07 · Streaming
Only what's needed
Just the frames or byte ranges requested, decrypted on device, rendered with a watermark.
08 · Continuous
Always re-checked
Bulk reads, network change or a revoked share ends the session in seconds.
09 · Evidence
Written to the Ledger
Who, what, when, where, which device, which policy allowed it, and what they did.
Tresolo Shield
Nine pillars. Zero seams.
File collaboration, zero-trust network access, data-loss prevention and compliance auditing are usually four products stitched together. In Tresolo they run in the same agent that serves the file.
Encryption model
Keys stay where trust is
In transit
TLS 1.3 plus an end-to-end session layer, with perfect forward secrecy.
End to end
Encrypted at the agent, decrypted only on the authorised device.
At rest
Optional agent encryption so a stolen disk or NAS is unreadable.
Keys
Per-file data keys wrapped by per-project keys. Hold your own root in HSM or KMS.
Post-quantum ready
Crypto-agile design ready for hybrid post-quantum key exchange.
Granular permissions
Control down to the page and the frame
| Control | What it does |
|---|---|
| Permission levels | View only, stream only, comment, edit, download, re-share, admin. |
| Download disabled | Files render in the secure viewer or player. No local copy is created. |
| Expiry | Links, shares and sessions expire on a date, after N views, or at project wrap. |
| Watermarking | Visible watermark (name, email, time, IP) plus an invisible forensic mark that traces leaks to a person. |
| Scope | Project, folder, file, file type, or page and time-range level. |
| Geo and network fencing | Access only from approved countries, offices or IP ranges. |
| Copy, print, screenshot | Block clipboard, printing and, on supported platforms, screen capture. |
| Revocation | Remove access instantly, including files already open in the viewer. |
Compliance package
Controls and evidence for the frameworks you answer to
| Framework | How Tresolo helps |
|---|---|
| HIPAA | Access controls, audit logs, encryption, minimum-necessary sharing, BAA available. |
| UK GDPR / Data Protection Act 2018 | Data residency, minimisation, access records, deletion and subject-request support. |
| SOC 2 / ISO 27001 | Evidence exports for access control, change and logging controls. |
| Legal discovery | Chain of custody, legal hold, defensible access history. |
| Film-studio security | Forensic watermarking, stream-only review, vendor access controls, content-security reporting. |
| Defence (CMMC, ITAR-style) | Data stays on controlled infrastructure, self-hosted option, strict nationality and location policies. |
Tresolo provides controls and evidence that support these frameworks. Certification remains a separate responsibility of the customer and Tresolo.
Tresolo vs. cloud storage
Cloud is a place.
Tresolo is a protected path.
Central cloud storage
Tresolo
Not anti-cloud
Point the agent at your own S3, Azure or GCS bucket and get zero-trust access, your own keys and full audit on top.
The difference is custody
You hold the data and the keys. Tresolo provides the security and delivery layer.
Target markets
Large files.
Costly leaks.
Tresolo starts with creators for adoption and expands into regulated industries for revenue. The common thread is files that are expensive to move and costly to leak.
Screening room
The Tresolo film
Seen enough? Try it.
The demo runs the full nine-step access flow in your browser.
Live demo · simulated
Open the file. Try to break the rules.
Pick who you are and what device you're on, then request access. Watch the nine checks run, stream the content, and see every action land in the hash-chained ledger.
1 · Who are you?
2 · Your device
3 · Where are you?
Data path
Content stays on the owner's storage
Request access to open a policy-checked, encrypted stream. Nothing will be downloaded.
Risk score
—
Streamed
0 MB
Local copies
0
Tresolo Ledger · append-only
0 events
Every decision will appear here with its SHA-256 link to the previous event.
Try a blocked deviceTurn on "Jailbroken" and request access. The policy engine refuses before any key is released.
Try a downgradeTurn off MDM or switch on a screen recorder. You still get in, but with a restricted, heavier-watermarked view.
Try to exfiltrateOnce streaming, hit Bulk read or Switch network. Continuous evaluation ends the session in seconds.
This is an in-browser simulation for illustration. No real files, keys or identities are used.