Start on Cloud

Confidential compute, secure and easy to manage.

Ship the app. Skip the infrastructure.

Write your app once and run it sealed on Calimero Cloud, on your own nodes when customers need it on premises, or peer to peer on devices people own. No enclaves, key policies or sealed databases to manage, and nobody, including us, can read data inside a sealed node.

Start on Calimero Cloud How it works
One buildOur cloud, your servers, or both
One signed app bundle, running in Calimero Cloud and on your servers A signed bundle named my-app.mpk connects to Calimero Cloud, marked sealed and verified, and to your servers, marked your control. A connector between the two says they run the same app, in sync. SIGNED BUNDLE my-app.mpk ├ frontend├ app logic└ signature ✓ Calimero Cloud managed · Intel TDX ✓ SEALED · VERIFIED Your servers on-prem · run by you YOUR CONTROL same app, in sync

Backed by

  • Khosla Ventures
  • NEAR
  • GSR Ventures
  • FJ Labs
  • Eniac
  • Hypersphere
  • Lyrik
  • Daedalus
  • Warburg Serres
  • Metaweb Ventures

02 · The problem

Today, control means hosting.

Customers want their data on their terms. Delivering that usually means an on-prem edition, patching, secrets, backups, on-call and long security reviews, and the admins can still see everything.

  • No servers to run on Calimero Cloud.
  • Nobody, including us, can read data inside a sealed node.
  • Every node proves which image it runs.
See the comparisonShow less

Self-hosting

  • Ship and support an on-prem edition
  • Patch the OS and dependencies
  • Manage secrets
  • Configure backups
  • Staff on-call
  • Sit through long security reviews
  • Admins and vendors can still see the data

Calimero

my-app.mpkfrontend and app logic, signed
  • You run no servers on Calimero Cloud
  • Nobody, including us, can read data inside a sealed node
  • Every node proves which image it runs

03 · Why Calimero

Everything self-hosting asks of you, handled.

Each cost of running it yourself has a direct answer.

  • Sandbox

    Before: One bad dependency owns the box.

    With Calimero: Apps run as sandboxed WebAssembly and only reach their own state through the node.

  • Security

    Before: Harden, rotate, pen test, repeat.

    With Calimero: Read-only images with no SSH. Keys are released only to nodes that prove their image.

  • Maintenance

    Before: Patches, backups, on-call.

    With Calimero: Signed, versioned bundles. On Calimero Cloud we run the nodes and their upgrades.

  • Privacy

    Before: Admins and vendors can read it all.

    With Calimero: Nobody, including us, can read data inside a sealed node. Storage is encrypted at rest.

  • Serverless

    Before: Self-hosted means provisioning.

    With Calimero: Install a bundle, not a server.

04 · How it works

Build. Deploy. Verify.

Bundle your Rust logic with its frontend into one signed package, install it, and every sealed node proves what it runs before it gets keys.

  • Build one signed bundle with cargo mero bundle.
  • Deploy to Calimero Cloud or your own node; state syncs on its own.
  • Verify every sealed node attests before it gets any keys.
How it worksRead the quickstart
Terminal
cargo mero bundle --dev --no-icon
  logic · frontend · signed
  ✓ my-app.mpk
meroctl --node node1 app install --path ./dist/com.example.my-app-0.1.0.mpk
  ✓ installed
The three stepsShow less

  1. Build

    Write your app logic in Rust and bundle it with its frontend into one signed package.

    cargo mero bundle

  2. Deploy

    Install it on Calimero Cloud or your own node; state syncs between nodes on its own.

  3. Verify

    Every sealed node proves which image it runs before it gets any keys.

05 · Where it runs

Write once. Run anywhere.

Our cloud, your nodes, the devices your users own, or all of them, connected as one app. One build serves SaaS, on-prem and people who want to keep their data.

  • Calimero Cloud sealed nodes on Intel TDX confidential VMs, run for you.
  • Your nodes on your own servers, or peer to peer on the devices your users own.
  • Both, connected they join the same app and stay in sync.
Compare the optionsShow less
Available

Calimero Cloud

Fully managed nodes on Intel TDX confidential VMs. The fastest start.

Available

Your servers

Run nodes on your own infrastructure for customers who need data on premises.

Both, connected

Your servers and Calimero Cloud nodes join the same app and stay in sync. One build serves SaaS and on-prem customers.

Peer to peer, on devices people own

People run the app on their own node with Calimero Desktop, and it syncs directly between their devices and the people they invite. No server keeps a copy of their data, and they can add Calimero Cloud later to stay online while their computer sleeps.

Explore Calimero CloudRun a node locally

06 · Products

Run it on Cloud. Run it on your machine.

The same signed app runs on sealed Cloud nodes or on a node you run yourself.

07 · Verify us

Don't trust us. Verify us.

Before a sealed node gets any keys, it proves which image it booted, and the key service checks that proof against the published release policy.

  • Read-only images with no SSH, no serial console and no rescue shell.
  • Keys only to nodes whose quote matches the signed release.
  • Open-source verifier so you can check a node yourself.
How we prove itVerify a node
The five checksShow less

  1. Signed release

    Measurements published

  2. Node boots

    Intel TDX, read-only image

  3. Node proves

    Hardware attestation quote

  4. Key service

    Checks it against release policy

  5. Keys released

    Data unlocked inside the node

08 · Platform

One attested node, every layer built in.

You write the logic; we bring the stack.

Why not just put your stack in a TEE?

Compare DIY in TEEs

09 · Use cases

Built for teams whose customers ask hard questions.

All use casesTalk to us

10 · Open source

The runtime is open source.

The node, the SDK and the protocol are on GitHub, with a full protocol reference you could reimplement a node from.

View on GitHubDevelopers
  • GitHub stars on core
  • latest core release

Your customers want control. You want to ship.

Start on Calimero Cloud, or build on the open-source runtime.

Start on Calimero Cloud Talk to us View on GitHub