A typical trust page hosts a promise: an auditor looked once, a PDF says so. This one is built the other way. Every claim below names the mechanism that enforces it and where to check — and every deployment governed through Ember can publish its own live trust page, where the verdict is recomputed from the enclave's attestation quote and the approval list on Base, not asserted.
Vendors: publish yours from the console or with ember trust enable — it lives at /trust/<your-slug>/, made for the security-review thread.
CLAIMS → MECHANISMS
We cannot see what your workload does.
Mechanism: opacity by construction. The workload runs as the vendor's own container inside an attested TEE, with no runtime logs by design. There is no Ember credential that reads its content — not a policy, an absence. Check: the measured compose on any deployment's trust page — no logging sidecar in it.
We cannot change what runs. Neither can the vendor, alone.
Mechanism: an on-chain approved-measurement list. The TEE only runs a compose whose hash the owner's smart account has allowlisted on Base, and only that account's security key can extend the list. Ember holds no signer for any deployment's contract. Check: the DstackApp contract on Basescan, linked from every trust page.
Our staff cannot approve a release.
Mechanism: origin-bound passkeys. Release approval is a WebAuthn signature from the owner org's security key. Passkeys cannot be exported or replayed by the server side; our pipeline can relay a proposal and can never produce a sign-off. Check: every ceremony's approval tx names the signing smart account.
The workload reaches only what was declared.
Mechanism: the egress manifest is inside the measurement. The allow-list (exact hostnames, 443 only) is inlined into the measured compose and enforced by a default-deny proxy in the enclave. Widening it is a new measurement — a new security-key-approved release. Check: the ENFORCED EGRESS section of any trust page reads the list out of the live quote.
Sealed secrets are never readable back.
Mechanism: enclave-sealed env. Secret values are encrypted to the deployment's enclave key at deploy time. There is no read-back path — for the vendor or for us.
WHAT A COMPROMISE OF EACH DEPENDENCY COULD AND COULD NOT DO
We run on named infrastructure. Honest accounting means saying what each piece could cost you if it were compromised — and what it structurally cannot.
| DEPENDENCY | ROLE | A COMPROMISE COULD | AND STILL COULD NOT |
|---|---|---|---|
| CVM platform (dstack-based) | hosts the enclaves | deny service; refuse attestation | run an unapproved measurement — the KMS releases keys only to allowlisted hashes |
| Railway | runs our pipeline + this site | deny service; propose junk releases; misrender pages | approve a release, alter a measurement, or read workload content |
| Base (+ gas sponsorship) | the approval record | censor/delay approvals | forge one — approvals are signatures only the owner's key produces |
| npm | distributes the CLI | ship a bad CLI build | bypass governance — the CLI can only propose; approvals live elsewhere |
| Silicon vendor root of trust | signs attestation quotes | this is the floor of the design — a TEE break breaks the guarantee, and we say so rather than pretending otherwise | |
CERTIFICATIONS
We do not currently hold SOC 2 or ISO 27001, and this page will say so until we do. What we offer in the meantime is stronger where it counts and weaker where it doesn't: certifications attest that controls were followed; the mechanisms above make the critical controls unfollowable incorrectly — and checkable by you, continuously, not by an auditor, annually. For questionnaire season, the CAIQ answers map this architecture to the questions your reviewers already ask.
SECURITY CONTACT
Found something? security@litprotocol.com. We commit to acknowledging reports within two business days. The full verification story — what attestation proves, what it doesn't, and the exact trust chain — is in the method.
SEE ONE LIVE
The proof is a deployment page, not this one. Ask your vendor for their trust link — or bring your security review to a briefing and we'll walk the loop end to end.
Request a briefing