Enclave · Confidential GPU Compute: If It Can Sign, It Can Compute

Sign in →

Trustless, attested enclaves · API v1<br>If it can sign,<br>it can compute.

The hardware that used to hide behind enterprise sales calls is now one click away: deploy a WebAssembly app onto a confidential enclave equipped with a flagship NVIDIA GPU , straight from your browser. Pay per second in ETH or USDC . Your wallet is your account. Then check the cryptographic attestation yourself before you send a single byte of data.

Deploy an app →<br>Read the API

flagship NVIDIA GPUs · confidential CPU + GPU<br>per-tenant Wasm sandbox + process isolation<br>VRAM zeroed before reuse<br>CORS-friendly

◆ enclave · sev-snp + nvidia-cc<br>sealed⏸︎

launch measurement · live<br>fetching …

If it can sign · it can compute · no sales calls, no gatekeepersHardware TEEs · CPU + GPU confidential computingPer-second metering, settled on-chainTLS terminates inside the enclaveFlagship NVIDIA GPUs · rent 1-100% of a cardWasm apps · wasi:http, sandboxed in the enclaveWallet-native · your wallet is your accountCORS-enabled · drive it from the browserPer-tenant Wasm sandbox + process isolation · VRAM zeroed before reuseVerify the report before you connectNo custody · payments forward straight through · top up to extend

⏸︎

The model<br>Don't trust the operator. Measure it.

Enclave runs your WebAssembly app inside a hardware-isolated, attested enclave with a confidential GPU wired into it, so the operator can't read your memory, your keys, or your traffic, and you don't have to take our word for it. Every claim on this page is something you can check on-chain or in a signed attestation. We're equally explicit about the part that isn't hardware-enforced: how tenants are kept apart from each other on a shared GPU. See exactly how isolation works ↓

verifiable<br>Trustless

Each enclave produces a CPU attestation report (AMD SEV-SNP on today's fleet) and an NVIDIA GPU attestation report. Verify them client-side against the measurements published on EnclaveHost/enclave releases, then connect.

wallet-native<br>Crypto-native

Your wallet is your account and nothing is custodied: every payment forwards straight to Enclave; the contract never holds funds. It buys prepaid runtime, burned per second while your deployment runs. Payments are final: unspent time survives a stop but can't be withdrawn, so fund small and top up as you go.

cors<br>Browser-native

The whole API is CORS-enabled. Spin up a server, stream logs, and pull attestation from front-end JavaScript. No backend required.

gpu<br>Real GPUs

Whole flagship NVIDIA GPUs in confidential-computing mode, wired into your Wasm app through a GPU interface. Deploying is two dials - a GPU share and a CPU share - floored at the minimums the app's declared specs imply. How tenants share a card →

Lifecycle<br>Five calls, start to finish.

The path from an empty wallet to a verified GPU endpoint. Click a step to see exactly what crosses the wire.

1Sign in with your wallet<br>Prove control of your address, with no email and no password.

2Create a deployment<br>One create() tx on EnclaveDeployments from your wallet: the app's catalog reference + two shares in 1/1000ths (the app's specs set the minimums). You own the on-chain record; it survives enclave updates.

3Fund runtime<br>fundWithAuthorization (EIP-3009 USDC) or fundEth on EnclaveDeployments credits the deployment's runtime balance - the funds themselves forward straight to Enclave in the same tx, and payments are final. Enclaves claim funded work and serve it under leases; fund small, top up any time.

4Verify the enclave<br>Pull the CPU attestation + GPU report and check them yourself.

5Stop (or let it expire)<br>Tear down and release the share. Unspent runtime stays on the on-chain record - reactivate to use it - but is never withdrawable, which is why you fund in small top-ups.

Root of trust<br>What "trustless" actually means here.

"Trustless" isn't a slogan. It's a chain of measurements that ends in your browser. Walk each link to see what gets verified and why the operator can't fake it.

01Hardware root of trust<br>The CPU (AMD SEV-SNP on today's fleet) and the NVIDIA GPU hold keys fused at manufacture. Enclave can't extract or forge them. The silicon vendor (AMD or NVIDIA, Intel on a TDX host) is the root of trust, not the operator.

02The VM measures itself<br>On boot the AMD secure processor signs a report over the launch measurement: a SHA-384 digest binding the firmware, the kernel, and the exact runtime image. Change one byte and it changes. Your app is deliberately not in this boot measurement: it arrives later by CID, and the measured runtime refuses bytes that don't hash to the CID in your on-chain deployment record. The attestation reports the app's CID and states exactly what covers it; it never pretends the boot quote does. (An Intel TDX host tells the same story via a DCAP quote over MRTD + RTMRs.)

03The GPU attests too<br>With confidential computing on, the GPU signs an attestation report...