Skip to main content

​
TEEs don’t matter if they aren’t run correctly

Anyone can rent a TEE. Almost no one runs them correctly. The security of a trusted execution environment is only as strong as everything around it: how code gets approved, how secrets get provisioned, how builds get reproduced, and how upgrades happen. TVC is the only enclave platform where the process itself rolls up to the hardware root of trust.

​
Trust minimization, not trust relocation

Most TEE platforms remove trust in the cloud provider and hand it to whoever operates the enclave. TVC removes trust in the operator too.
  • Quorum-approved code upgrades. No single admin, insider, or compromised account can ship code to an enclave. Every change requires m-of-n cryptographic approval.
  • Quorum-based provisioning for core secrets. Core secrets only reconstruct inside enclaves running quorum-approved code. Each share holder independently verifies the attestation before posting their share.
  • Fully reproducible everything. The operating system (QuorumOS), the application, and the build system itself (StageX) are deterministically reproducible. Anyone can rebuild from source and confirm the running enclave matches, bit for bit.
  • Verify the whole machine, not just the binary. Attestation covers the OS and application plus every aspect of configuration: environment variables, CLI arguments, firewall rules, and the set of people who approved the code. The hardware root of trust (the Nitro Secure Module) accounts for all of it.

​
A stable identity that survives upgrades

The Quorum Key gives your application a core secret that persists across software upgrades with zero downtime. Upgrades stay gated by quorum approval, but enclave-to-enclave attestation carries the key forward automatically, so fleets scale with no human in the loop.
  • Operators provably have no access to encrypted user data. The guarantee comes from cryptography, not from policy.
  • Prove that no one else does either. Your customers, auditors, and regulators can check the proof themselves.

​
Fully verified TLS

On TVC, all of the code that verifies TLS rolls up into the Nitro Secure Module measurements, so even your connections to the outside world are part of the proof.

​
Secure by default, open by choice

Most confidential VM offerings start as a general-purpose machine you must lock down. TVC starts from the most locked down possible configuration, built for processing targets holding billions of dollars. You selectively enable functionality like egress as you need it. Subtractive security fails quietly. Additive security fails safe.

​
Part of the Turnkey stack

TVC interoperates natively with Turnkey’s secret and key management system: policy gated key release, arbitrary consensus thresholds, and policies that can bind key access to exact application hashes and attestation contents.

​
Get started

Make a Turnkey account and get everything above running with one prompt. See the quickstart to deploy your first app.