Glossary

Terms

Acceptance test

A test run for a buyer on a delivery before the buyer accepts it and pays. On Aarloven, buyer and vendor agree the tests first, the room runs them, and the buyer makes the acceptance decision.

Criteria

What each delivery must do, written down and agreed by both sides before the test runs, for example the addresses a device may send data to.

Sample

The material a test runs on: for example a firmware file, a traffic capture or a data export from the delivery.

Sealed sample

A sample encrypted on your side before it leaves you. Under the current key policy, only the sealed room can open it.

Sealed room

Our name for the place the tests run: an AWS Nitro Enclave in Stockholm running the published room code.

AWS Nitro Enclave

An isolated compute environment on AWS with its own memory, without disk or login. AWS describes it on its own site.

Attestation document

A document signed by AWS's hardware that states which code is running in the enclave. The /try and /trust pages check its signature against AWS's root certificate in your browser, and our offline verifier does the same check.

PCR0

The fingerprint of the room's code, as the attestation document reports it. Anyone can rebuild the room from the public code and compare the fingerprint.

AWS KMS

AWS's key service. The keys that open sealed samples live there, in Stockholm.

Key policy

The rule in AWS KMS that says who may use a key. Ours releases the key only to the room with the published PCR0. Administrators of our AWS account can change this rule, and AWS records such a change.

Case key

The KMS key that sealers encrypt to: a fresh AES-256 key encrypts the case, and the case key's public half wraps that AES key. Its public half is published at /room-key.json.

Room signing key

The key the room signs receipts with. The prototype room's key is published at /receipts/room-key.json.

Receipt

The signed result of one test run: the verdict for each criterion and fingerprints of the build, the data and the tests. Buyer and vendor hold the same signed file.

Private case

A run where the checks' names and reasons in the receipt are encrypted to the buyer's key. The vendor reads each check's outcome.

Fingerprint (hash)

A short value computed from a file (SHA-256). In practice any change to the file gives a different value. It identifies the file without showing its contents, and anyone holding a candidate file can check whether it matches.

Signature

Evidence that a file is exactly what the holder of a given key signed. Who holds that key is a separate question, answered by the attestation document or by a published key.

Self-signed

Signed with a key that only the file itself vouches for. It shows the file is unchanged; who made it is checked another way.

VOID

A reply in which the room refused to give a result, with the reason, for example because the sealed data was changed.

AWS CloudTrail

AWS's audit log. It records each use of our KMS keys, including refused attempts. Our current export of it is on /trust.

Public daily log

A signed entry every day in a public git repository. Anyone can mirror it and see if a past entry was changed or removed.

SBOM

Software bill of materials: the list of components inside a firmware or app, used to look up known vulnerabilities.

Known vulnerability (CVE)

A security flaw with a public CVE identifier. A criterion names which database and which severity count.

Open-weights model

An AI model whose weights are published, so it can run offline inside the room. Next, with design partners: on Aarloven it will only flag items for a person to review.

EN 303 645

A European standard for the security of consumer connected devices.

EN 18031

A set of harmonised European standards (parts 1 to 3) that give manufacturers one route to meet the Radio Equipment Directive's cybersecurity requirements. Those requirements apply to covered radio devices in the EU from 1 August 2025.

CRA

The EU Cyber Resilience Act (Regulation 2024/2847). Manufacturers' vulnerability and incident reporting (Article 14) applies in the EU from 11 September 2026, and most other duties, including importers' duties, from 11 December 2027.

GDPR Chapter V

The part of the EU data protection regulation on sending personal data to countries outside the EEA.

Design partner

A buyer who builds the device checks with us over six weeks, before launch.

What each part does today and what comes next: the security brief.