Proof of Data
App
Open the app
Seal, rent, verify, waitlist.
Seal a plate
Encrypt a file in this browser to the enclave key.
402
Rent a query
Quote an aggregate and pay it over x402 in USDG.
Verify the enclave
Check a TDX quote against the onchain registry.
The Armour
The model its uploaders own. Trains when the enclave is live.
Join the waitlist
Uploads open in waves, in sign-up order.
Read
Protocol
Documentation
Dev log
X
Docs · How it works

The enclave and attestation

Plates are opened and queried only inside an Intel TDX confidential VM on Phala Cloud. Its quote proves which image runs and which key it seals to.

Intel SGX Root CApinned in the verifierPCK certificatesigns the QE reportAttestation keysigns the quoteMRTD, RTMR0-2image hashreport_datasha256(key, signer)Enclaves.register stores the image hash, the quote hash, the signer and the sealing key
What a TDX quote proves, and where each part is checked.

Why TDX

A TDX virtual machine runs with memory the host cannot read. Phala Cloud runs these VMs with dstack, which measures the image at boot. A small CVM (one vCPU, 2 GB) is enough for the query runner and for training the Armour on CPU.

What the quote binds

  • The image: Proof of Data's image hash is keccak256(MRTD || RTMR0 || RTMR1 || RTMR2). The timelock keeps the list of allowed images.
  • The keys: the first 32 bytes of report_data are sha256(sealing key || signer address). The enclave makes both keys at boot and never exports them.
  • The chain: the operator registers the quote hash, the image hash, the signer and the sealing key in Enclaves, with its bond.

Checking it yourself

The verifier runs in your browser. It checks the quote's signature, the QE report, the PCK chain up to the pinned Intel SGX Root CA (SHA-256 44a0196b…74d3), the key binding, and the image and quote hashes against the registry. TCB status and revocation come from Intel's collateral and are checked by the operator's tooling at registration.

Status

No enclave is registered yet. The enclave code is written and runs in a local simulation that builds a TDX quote byte for byte under a simulation root; the verifier refuses that quote against Intel's root, as it must.