Security
Don't trust us.
Verify us.
Keys are created and used only inside hardware enclaves, from a release anyone can rebuild. The hardware signs what's running, and you can check it against our published measurements any time, without an account.
Layers
Five layers between a request and a signature.
Seeds are generated and used only inside hardware enclaves: no disk, no network, no operator shell. Secrets are released only to the published image.
Everything that affects the image measurement is pinned. Anyone with the source at the release commit gets the same PCR0.
Production keys were made on 13 October 2026 on a machine never connected to a network. A backup is split with Shamir secret sharing and held offline.
The enclave checks every payout against your workspace's rules. With team signing, it verifies your team's passkey approvals itself. Valtu never co-signs.
API requests are signed with your key; webhooks are signed with Ed25519 and HMAC-SHA256; organization state is notarized every 12 hours.
Two enclave hosts in two availability zones take over from each other. A public status page checks the service every minute.
Status
Where we are, plainly.
What's in place today and what isn't yet. This list changes as work is done; the security docs carry the detail.
| Control | Status |
|---|---|
| Enclave attestation | Available Verify the running image with the hardware's signature. |
| Reproducible builds and measurements | Available Built twice with identical results; a second build by an independent person is still owed. |
| Production keys | Done Offline key ceremony, 13 October 2026; public keys published. |
| Internal security review | Done October 2026, by the team with automated review tools; every finding fixed. |
| External security audit | Not done yet Required before the service holds significant customer funds. |
| Availability | Two zones Public status page; no uptime commitment yet. |
| Recovery procedures | Documented Restart, rollback and host failover drilled; full disaster recovery not yet drilled. |
| Webhook delivery | Available At least once, signed, retried for about 4 hours. |
Published measurements
The release in production.
Compare these with the PCR0 in any attestation document. The full values, the keys and how to check them are in the security docs.
Found something?
Report vulnerabilities to security@valtu.io. Our policy and scope are in the docs.