Start on Cloud

Home / Products

Calimero Confidential AI

Your own AI agent, sealed end to end.

Calimero Agent runs in its own Intel TDX confidential VM, on open-weight models it verifies before it sends a word. Plugins connect it to the services you use, with credentials the model never sees, and every action goes through your rules.

Talk to us See how it works
cloud.calimero.network
  • 0people who can read a prompt in a sealed model, including us
  • 4checks before a prompt leaves: image, model, GPU, connection
  • 0plugin secrets the model ever sees
  • 1account per agent, so everything it does carries its own name

02 · What you get

The useful agents need your most sensitive data.

Calimero Agent can have it without handing it to anyone else.

  • 01

    A private agent

    It runs sealed in its own confidential VM. Its keys are made inside it, and its settings are sealed to it.

  • 02

    Open-weight models

    Qwen, GLM, DeepSeek, gpt-oss and more, served from confidential GPUs it verifies before every prompt.

  • 03

    Plugins

    Tools for the services you use, from X to any MCP server, with credentials kept in your Mero Pass vault.

  • 04

    Your rules

    Every action is checked against what you allow. It acts, asks you first, only reads, or does nothing.

03 · In practice

Work on records you could never send to a chatbot.

Two examples of a private agent on data that has to stay private.

A medical practice

Patient notes, lab results and referrals live in the practice's own apps. Its agent reads them where they are.

  • Prepares the visit: summarises a patient's history and recent results before the appointment.
  • Drafts the paperwork: referral letters and follow-up instructions, for the doctor to review and send.
  • Keeps it in the room: the notes go only to a sealed model it verified, never to an outside service.

A law firm

Case files, contracts and client correspondence stay in the firm's private spaces, one per matter.

  • Reviews contracts: flags unusual clauses and compares them with the firm's own templates.
  • Builds the timeline: pulls dates and events from a matter's documents into one chronology.
  • Stays on the matter: it is invited to the matters it works on, and sees nothing else.

04 · The agent

An agent nobody else can read.

Calimero Agent runs in an Intel TDX confidential VM from a published, measured image. Nobody but the agent can read its secrets, its signing key or its state, and anyone can check which build runs.

  • Sealed settings: your browser verifies the agent's quote, then encrypts its keys and settings to that enclave.
  • Keys made inside: its signing key is generated in the enclave and never leaves it.
  • Its own account: it works in the apps you invite it to, under its own name, and drafts what should come from you for you to send.

Calimero Agent

Sealed in a confidential VM. Holds its own keys and the settings you sealed to it.

Your apps

It joins as a member with the role you give it, and writes under its own name.

Verified before trusted

You trust a measured build, not an operator.

05 · Open-weight models

Open models that never see a stranger.

The agent thinks with open-weight models served from NVIDIA H100 GPUs in confidential-computing mode, inside Intel TDX confidential VMs. TLS ends inside the enclave, so nobody between, including us, reads a prompt or an answer.

  • Open weights: Qwen, GLM, DeepSeek and gpt-oss on attested providers, or any open-weight model on our own confidential GPUs, pinned to an exact revision and the hash of its weights.
  • Checked before use: the agent verifies the image, the model and the GPU's own evidence before it sends a prompt, and again as it runs.
  • Attested only: a sealed agent starts only when every model it can reach proves its enclave. Nothing falls back to an unverified one.

  1. The image

    Intel TDX quote matches the published release

  2. The model

    Weights hash to the pinned digest

  3. The GPU

    Confidential-computing evidence checked with NVIDIA

  4. The connection

    TLS key bound into the quote

  5. Prompt sent

    Only to the enclave it verified

06 · Plugins

Plugins for your services. Keys it never shows.

A plugin gives the agent tools for a service outside Calimero: X built in, or any MCP server. It signs in with a credential from your Mero Pass vault, and the agent calls the service for the model, so the model never touches the service or the key.

  • Keys stay sealed: a secret is decrypted only for the plugin that asked, and never reaches the model, a tool result, a log or the feed.
  • Private models only: by default only an attested or local model gets a plugin's tools, so what a plugin reads stays private.
  • You approve: each plugin's actions, such as "Read X" or "Post as you", go through your rules like any other call.

Mero Pass vault

Holds the plugin's credential, encrypted. Only the vault's admin lets the agent in, and revoking it cuts it off.

Calimero Agent

Decrypts the key for the plugin alone, inside its enclave, and calls the service.

The model sees tools, not keys

What comes back is marked as information, never instructions.

07 · You decide

It works for you. It never acts as you.

Every call the agent makes is checked against your rules in Hyperfeed, on the web or on your phone.

  • 01

    Act

    Allowed actions run, and each one is logged in your feed.

  • 02

    Ask first

    It proposes, and waits for you to approve or decline. Your phone is woken when it needs you.

  • 03

    Read only

    It can look, and every write is refused.

  • 04

    Off

    Nothing in that app or service runs at all.

08 · How it works

From console to a working agent.

  1. Get an agent

    From the Agents page of the Calimero Cloud console, and pick its model.

  2. Verify and seal

    Your browser checks the agent's quote, then seals its keys and settings to it.

  3. Invite and connect

    Invite it to your apps with the role it needs, and connect its plugins in Mero Pass.

  4. It works, you decide

    It acts within your rules and asks you about the rest.

Talk to us Bring your own agent

09 · Bring your own agent

Already have an agent? Bring it.

Any agent, running locally, deployed by you or from a frontier lab, gets its own key for your node and works in your apps through the Calimero MCP, under each app's own rules.

Connect an agent

Any agent, any task

Research, records, support or operations: whatever it does, it works under each app's rules.

10 · Verify

Don't trust us. Verify us.

Agent and model images are read-only and measured. Their measurements are published with each release, so you, or anyone, can check what runs before trusting it.

  • Read-only images with no SSH, console or rescue shell.
  • Secrets only after the quote matches the signed release.
  • Open-source verifier so anyone can check an enclave.
Verify an enclave The full trail

11 · Questions

Before you hand an agent your data.

Can Calimero read my prompts or my agent's secrets?

No. Your agent's settings are sealed to its enclave by your own browser, plugin credentials stay encrypted in your Mero Pass vault until the agent decrypts one inside its enclave, and prompts go only to a model whose enclave it has verified, over TLS that ends inside that enclave.

Which models can it use?

Open-weight models only, verified before use: Qwen, GLM, DeepSeek, gpt-oss and others on attested providers, or any open-weight model on our own confidential GPUs, pinned to an exact revision and the hash of its weights.

What can plugins connect to?

X is built in, and any MCP server can be a plugin. Each signs in with a credential from your Mero Pass vault, and each of its actions goes through your rules.

What can the agent do in my apps?

What its role and your rules allow, in the apps you invite it to. It is a member with its own account, so everything it writes carries its name, and what should come from you it drafts for you to send.

Can I use my own agent?

Yes, any agent: one running locally, one you deploy, or one from a frontier lab. Give it its own key for your node, and the Calimero MCP lets it work in your installed apps under each app's own rules.

Where does it run?

The agent runs in an Intel TDX confidential VM. Private models run on NVIDIA H100 GPUs in confidential-computing mode, inside Intel TDX confidential VMs.

Put AI on the data you couldn't share.

Tell us what your agent should work on, and we'll show you how it runs sealed.

Talk to us Explore Calimero Cloud View on GitHub