Enclave

Frequently looked up

Q1How do I verify a host before sending my data?

Enclave provides a source-available verifier that runs in your browser. It checks the host's hardware attestation by sending a fresh nonce, then verifying the signed report up to the hardware manufacturer's root (AMD for SEV-SNP). By default it uses Enclave's measurement allowlist for a limited verdict; for stronger verification, you can independently pin an expected measurement using the enclave CLI.

Q2What billing commitment or subscription is required?

Enclave has no subscriptions and no upfront commitments. Payments are prepaid: you fund runtime in small top-ups as you need it. Per-second rates are rounded up to whole millionths of a dollar, and unused time stays on the deployment's record so you can stop and resume later. Cancelling returns the unspent part held for the host.

Q3Can I run any application, or only WebAssembly?

Applications must be WebAssembly components targeting wasi:http. Enclave provides tooling to build components in Rust and other languages that compile to WebAssembly. The same component runs identically on every backend supported by the platform.

Q4What protection does Enclave Shield provide on Windows hosts?

Enclave Shield on Windows hosts uses CPU isolation to prevent the host operating system from accessing guest memory, demonstrated locally on 2026-10-23. It also masks GPU inputs and checks GPU results before use. The hypervisor and physical operator remain trusted, and the per-app signed report records host_excluded: no, meaning the attestation does not guarantee the exclusion per-app.

Q5How does billing work with multiple resources?

Your deployment rate is calculated as the sum of: your CPU and GPU shares at the host's posted rates, plus any publisher fee for paid apps. All charges are metered by the second and rounded up to whole millionths of a dollar. Rates come from individual hosts, so you see your exact cost before you fund.