hardware-verified workload security

Customers run your software but can't look inside.

Deploy your software and AI models into customer environments. They stay encrypted and run only in verified hardware. You grant each customer access, cap their instances, set an expiry, and revoke at any time.

get started see the platform
the problem

Customers won't put their data on your servers.

The customers you most want to win keep sensitive data inside their own environment. They won't send it to a vendor's servers, so a hosted service is a non-starter. The only way in is to run your software where their data already lives.

Their data can't leave their environment
A hosted service fails the security review
Running your software on-site means exposing it
with eCora

Now you can sell to the customers you couldn't reach.

eCora scans and seals your workload on our servers. It is delivered encrypted and opens only inside a verified encrypted enclave in the customer's environment, so their data stays with them and the host can't see inside your software. Hardware attestation lets both sides check what is running.

Delivered encrypted to the customer and opened only inside a verified encrypted enclave
Memory encrypted by the CPU at runtime, shielding it from the host
Hardware attestation lets customers verify what is running
the workflow

Two perspectives. One sealed container.

publisher
01
configure

Set up your customers and limits

Add your customer organisations and decide what each may run: how many instances, and until when.
02
publish & list

Publish and deliver to customers

Run ecora workload publish on your container image. eCora scans it, encrypts it and makes it available to your customers.
03
manage

Control access with grants

Grant a customer access to a workload, change its limits or expiry in place, or revoke it, all without redeploying.
subscriber
01
subscribe

Pull the sealed image to your registry

Receive the encrypted image from your publisher and pull it into your registry using standard container tools.
02
deploy

Launch in your cloud environment

Launch it in your AWS account. The decryption key is released only after the hardware is verified.
03
verify

Verify what is running

Check the hardware attestation evidence for the workload that is running.
use cases

One Platform. Four Use Cases.

Protect AI Models

Deploy models into customer environments with weights encrypted in memory during inference.
learn more

Process Regulated Data

Process PHI, PCI and PII with encryption in use, and give auditors hardware attestation evidence.
learn more

Secure Microservices

Give every workload a hardware-attested identity and encrypted memory, without changing how you build and deploy.
learn more

Legacy Apps to Cloud

Move decades-old systems to the cloud without rewrites, running in hardware-encrypted environments.
learn more
why eCora

What makes eCora different.

Hardware-Backed Security

Security enforced by TEE hardware, not software promises. The host can't read workload memory, even with root access.
technical details
AMD SEV-SNP for encrypted execution · Attestation gates key release

True Encryption In Use

Data and models stay encrypted in memory during active processing — closing the final security gap competitors miss.
technical details
Confidential computing with memory encryption and CPU-level isolation

Zero Code Changes

Publish applications as-is. No SDKs, no rewrites, no integration work.
technical details
Image-level encryption; your application is unchanged

Universal Workload Support

One platform wraps legacy monoliths, modern microservices, AI models, and batch jobs — no frankenstack required.
technical details
Language-agnostic, framework-agnostic protection layer

Audit Evidence

Hardware-signed attestation and append-only audit records give your auditors evidence to review.
technical details
Append-only audit records · Hardware attestation evidence

Deploy Into Customer Environments

Runs on AWS today, on AMD SEV-SNP hardware, with more environments to come.
technical details
AMD SEV-SNP · AWS NitroTPM attestation
the difference

eCora vs Traditional Security

Traditional Security
eCora
Encryption in Use
Data exposed during processing
Hardware-enforced memory encryption
Code Changes Required
Extensive SDK integration
None — publish existing images as-is
Hardware Root of Trust
Software-only attestation
TEE hardware attestation
Compliance Automation
Manual audits and reports
Hardware-signed attestation evidence
Workload Coverage
Limited to specific frameworks
Any language, any framework
Multi-Cloud Support
Limited to one cloud
Same approach across supported environments
the eCora platform

Workload protection is one part of eCora's hardware identity platform — currently covering people, software, access, and proof, with more to come. One platform. One control plane.

see the full platform

Ready to ship without exposure?

Deploy into customer environments. Your software stays encrypted in the customer's environment and opens only inside a verified encrypted enclave.

get started platform overview