Start on Cloud

Confidential computing platform

Use sensitive data without exposing it.

Sensitive data goes in, and only what a stated policy allows comes out. Your customers can check every piece of code that touches their data, and refuse a change, from hardware attestation and signed receipts instead of our word.

Book a walkthrough Start on Calimero Cloud
Same dataWhat we can see
The same customer records seen by an operator: readable on a usual cloud server, redacted on a sealed Calimero node On a usual cloud server, an admin can read every record: emails, amounts, files. On a sealed Calimero node the same records are unreadable to everyone, including Calimero; the operator sees only health, CPU and memory. USUAL CLOUD SERVER CALIMERO · SEALED NODE alice@acme.com $12,400 bob@acme.com $8,950 payroll-q3.csv 214 KB contract.pdf signed ✗ ADMINS CAN READ IT ALL ✓ NOBODY CAN, INCLUDING US what an operator sees health ✓ · cpu 23% · mem 41%

Backed by

  • Khosla Ventures
  • NEAR
  • GSR Ventures
  • FJ Labs
  • Eniac
  • Hypersphere
  • Lyrik
  • Daedalus
  • Warburg Serres
  • Metaweb Ventures

02 · The problem

Today, using data means trusting whoever holds it.

Analytics, AI, partners and vendors all need sensitive data. Handing it over means trusting whoever runs the servers, their admins and every change they ship, and all you can check is their promise and last year's audit report.

  • Nobody, including us, can read data inside a sealed node.
  • Only what a stated policy allows comes out.
  • Every result comes with a signed receipt.

03 · How it works

Verify. Enforce. Prove.

Every call to a Calimero app goes through the same three steps, so the proof doesn't depend on who runs the machines.

  • Verify before you send. Your client checks the node's hardware attestation and the signed code it runs before any data leaves your hands.
  • Policy runs inside the node. Data travels over a sealed channel and is processed only by the approved code, under the rules you set.
  • Get a signed receipt. Every result is signed by an attested key, so you, an auditor or a regulator can check it offline, at any time.
How we prove itHow it works
receipt · returned with every result
app         com.example.vault
index       18342
resultHash  9c41…e07a
node        2
signature   ed25519 · a7e3…0c12

✓ signed by an attested receipt key
✓ checkable offline, by anyone

05 · Why Calimero

Everything self-hosting asks of you, handled.

Each cost of running it yourself has a direct answer.

  • Sandbox

    Before: One bad dependency owns the box.

    With Calimero: Apps run as sandboxed WebAssembly and only reach their own state through the node.

  • Security

    Before: Harden, rotate, pen test, repeat.

    With Calimero: Read-only images with no SSH. Keys are released only to nodes that prove their image.

  • Maintenance

    Before: Patches, backups, on-call.

    With Calimero: Signed, versioned bundles. On Calimero Cloud we run the nodes and their upgrades.

  • Privacy

    Before: Admins and vendors can read it all.

    With Calimero: Nobody, including us, can read data inside a sealed node. Storage is encrypted at rest.

  • Serverless

    Before: Self-hosted means provisioning.

    With Calimero: Install a bundle, not a server.

06 · Where it runs

Write once. Run it sealed.

Calimero's shared clusters, or a dedicated cluster of the same attested nodes for your apps alone. One build runs on both.

  • Shared clusters of sealed Intel TDX nodes, run by Calimero. Pay per request.
  • A dedicated cluster of the same attested nodes, for your apps alone. A flat monthly fee.
  • Replicated across attested nodes, so an app keeps serving when a node is lost.
Compare the optionsShow less
Available

Calimero Cloud

Shared clusters of attested nodes on Intel TDX confidential VMs, run by Calimero. The fastest start: pay per request, with a free allowance every month.

Available

Dedicated clusters

Three nodes of the same attested image for your apps only, provisioned and run by Calimero, at $1,200 a month.

Replicated, strongly consistent

Each app instance is replicated by its own Raft log across three or more attested nodes in a cluster. Calls are applied in one order, reads can be strong, and the app keeps serving when a node is lost. The same build runs on shared and dedicated clusters.

Explore Calimero CloudRun a local dev cluster

07 · Products

Run it on Cloud. Build it with our SDKs.

The same signed app runs on sealed Cloud nodes or on a dedicated cluster of your own.

08 · Verify us

Don't trust us. Verify us.

Before a sealed node gets any keys, it proves which image it booted, and the key service checks that proof against the published release policy.

  • Read-only images with no SSH, no serial console and no rescue shell.
  • Keys only to nodes whose quote matches the signed release.
  • Open-source verifier so you can check a node yourself.
How we prove itVerify a node
The five checksShow less

  1. Signed release

    Measurements published

  2. Node boots

    Intel TDX, read-only image

  3. Node proves

    Hardware attestation quote

  4. Key service

    Checks it against release policy

  5. Keys released

    Data unlocked inside the node

09 · Platform

One attested node, every layer built in.

You write the logic; we bring the stack.

Why not just put your stack in a TEE?

Compare DIY in TEEs

10 · Use cases

Built for teams whose customers ask hard questions.

All use casesTalk to us

11 · Open source

The runtime is open source.

The node, the SDK and the protocol are on GitHub, with a full protocol reference you could reimplement a node from.

View on GitHubDevelopers
  • GitHub stars on core
  • latest core release

See your use case running on attested hardware.

Book a technical walkthrough and we'll map your data flow, or start building on Calimero Cloud.

Book a walkthrough Start on Calimero Cloud View on GitHub