Hardware-bound data sovereignty.
A stolen file is cryptographic noise on any machine it wasn't sealed to — the key is derived from the hardware, never stored.
Seal model weights to attested silicon, so a stolen checkpoint is noise off the approved GPU.
Runs on attested confidential-computing hardware
TPM 2.0
Not just weights on the GPU. Data and workloads sealed to the CPU.
Intel TDX and AMD SEV-SNP seal data and workloads to the CPU's
measured boot state, so plaintext never reaches host RAM.
CPU confidential computing
TDXSEV-SNP
No single party can unseal. Not even the operator.
Custody of a model's key is split across parties by default — a threshold no one can meet alone, and that any one party can revoke. Trust rests on the math, not on whoever holds the machine.
$ scsa local prove running proofs directly on your gpu — nothing leaves your perimeter… FAIL-CLOSED attest PROVEN verify-replay PROVEN vram-proof PROVEN pq-migrate PROVEN threshold $ scsa handoff destroy <id> subject ✓ subject share wiped — permanently unrecoverable
The scsa CLI runs the full proof suite over SSH — control-plane or fully sovereign.
Read the CLI docs →Built for weights that stay sealed.
We bind attestation, sealing, and key release into one path, so a stolen file stays noise on every machine it was not made for.
The plaintext window, closed
Hardware-derived keys and in-VRAM decryption seal every point weights would otherwise sit in the clear, across the serving path.
Every property, a live proof
Attestation, anti-replay, CC enforcement, and in-VRAM inference each run as a proof on the GPU — every deployment shows its verdicts before a key is released.
Every decision bound to attested hardware.
We bind sealing, key derivation, and release to a live hardware measurement, so weights decrypt only inside the GPU they were made for. Attestation, image match, and policy stay visible before a single key is ever issued.
Weights decrypt only inside VRAM on the attested GPU under Confidential Computing. No plaintext copy ever lands in system memory.
The root secret splits across five independent nodes. No operator, including us, can derive a key alone; any three must cooperate to unlock it.
Every GPU is verified against NVIDIA's P-384 certificate chain. A mismatch between claimed and measured state aborts before a byte decrypts.
The data that cannot leak, in the fields that cannot afford it.
Defense secrets, patient records, sealed bids, evidence chains — the same guarantee, bound to the hardware you approve, with no administrator who can override it.
Seven composable layers, one guarantee.
Decryption becomes a property of measured hardware and elapsed time, not of key possession. Each layer stands on its own; stacked, they leave nothing portable to steal.
- L1GPU Silicon AttestationHardware-rooted trust anchor
- L2TPM2 Boot-Chain BindingKeys sealed to an unmodified boot state
- L3Threshold MPCNo single party holds the root secret
- L4Forward-Secure State RatchetTime-locks enforced by math, not policy
- L5Path ORAMAccess patterns indistinguishable from random
- L6STARK Zero-Knowledge ProofsProve correctness without revealing anything
- L7Fragment Dependency TopologyStructure that rewrites itself every epoch