Home / Platform
Security
Don't trust us. Verify us.
Calimero nodes run sealed in Intel TDX confidential VMs. Production images are read-only and have no SSH. Before a node gets any keys, it proves which image it booted, and the key service checks that proof against the published release policy. You can check it too.
Attestation record
one sealed node · Calimero Cloud
- Hardware
- Intel TDX confidential VM
- Image
- read-only · no SSH
- Measurements
- match the signed release
- Quote freshness
- bound to your nonce
- Keys released
- only after proof
- Data readable by operator
- no
- 5checks before a node gets a key
- 0ways to log in: no SSH, console or shell
- 64bytes of your choosing in every quote
- 1key per session, never reused
02 · The trail
Five checks before a node gets a key.
A node that fails any step never gets keys, so it can never open your data. Anyone can check step 3 with the open-source verifier.
Signed release
Each node image release publishes its measurements, signed by the release workflow.
§ measurements publishedNode boots
The node starts in an Intel TDX confidential VM from a read-only image.
§ no SSH, no shellNode proves
The hardware signs a quote of what booted, bound to a fresh challenge.
§ checkable by anyoneKey service
The attested key service checks the quote against the release policy.
§ match or refuseKeys released
Only now does the node get its storage key, and data unlocks inside it.
§ only after 01–04
03 · The quote
What a node's quote binds.
A quote is signed by the processor, not by us. It names the exact image that booted and carries 64 bytes the caller chooses.
- Freshness: your nonce, so a quote can’t be replayed.
- The image: measurements compared with the signed release.
- A binding: the app’s code hash, the node key or the transport key.
signed by the processor · verifiable offline with Intel-signed collateral
What each binding provesShow less
- 01
Freshness
Your nonce in
report_data[0..32]proves the quote was made for your request, not replayed. - 02
The app
The binding can carry the app's code hash, so you know which app the node is running.
- 03
The node's key
Or it binds the node's identity key, so anything signed with that key comes from the attested machine.
- 04
The transport key
Or it commits to the key a client opens a sealed session to, so traffic ends inside the node.
04 · Sealed transport
Traffic ends inside the node.
Clients encrypt end to end to a key the hardware quote vouches for. That key is made when the node starts, held only in memory and never leaves the confidential VM.
- No TLS proxy outside the enclave to read your traffic.
- Ephemeral session keys for forward secrecy.
- Vouched for by the quote, so you know where the session ends.
See the differenceShow less
Usual: TLS at the edgereadable
Calimero: sealed sessionend to end
Calimero nodesealed
transport key · made at start-up · in memory only · never leaves the VM · vouched for by the quote
05 · Keys and storage
No login. No key without proof.
The things a security review asks about, and where each one is enforced.
- Image
Read-only, nothing to log in to
Production images have no SSH, no serial console and no rescue shell. Not for you, not for us.
enforced by the image · measured into the release - Storage
Keys only from the attested key service
A node's storage key comes from the key service only when its quote matches the signed release policy.
enforced by the key service · itself attested - Access
Group keys and capabilities
Every node enforces who may read and write. Each company in a shared app sees only the data its group is granted.
enforced by every node - Checking
Verify without asking us
Quotes can be checked offline against Intel-signed collateral, for example from a browser with mero-js.
open-source verifier · Intel-signed collateral
06 · What we see
We run the machines. We can't read your data.
Operating a fleet means seeing that it runs, not what runs inside it. Nobody, including us, can read data inside a sealed node.
- We see health, resource use, releases and billing.
- We can’t read data, log in, or get a key without proof.
- You can check which build has access to your data.
As the operator, we seeto run the fleet
- That nodes are uphealth and heartbeats per node
- Resource useCPU, memory and disk
- Which release each node runsthe measurements are public anyway
- Billingper account
Nobody, including us, cansealed
- Read data inside a sealed nodememory is encrypted by the processor
- Log in to a nodeno SSH, no serial console, no rescue shell
- Get a storage key without proofkeys go only to nodes that match the release policy
- Read a sealed session in transitthe transport key never leaves the node
07 · Verify
Check a node yourself.
The attestation verifier is open source. It checks the quote, the measurements and the release they belong to.
Verify a node against the published release.
DocumentationShow less
08 · Questions
Asked by every security team.
Can Calimero see my data?
No. Nobody, including us, can read data inside a sealed node. We see what it takes to run machines, such as health and resource use, and you can verify which build has access to your data.
Where do nodes run?
Calimero Cloud nodes run in Intel TDX confidential VMs with hardware attestation.
What does attestation prove?
That the node booted the exact image named in a signed release, on genuine TDX hardware, and that the quote was made for your challenge. It can also bind the app's code hash, the node's key or its transport key.
What changes when a node image is updated?
A new node image has new measurements, published under the signed release policy. App upgrades are separate: they don't change node measurements or keys.
Do we have to trust your verifier?
No. The verifier and the runtime are open source, and quotes can be checked offline against Intel-signed collateral.
Your customers want control. You want to ship.
Start on Calimero Cloud, or build on the open-source runtime.