Security · for your procurement and security team

Where your data goes, and who can open it.

One page with the answers a security review asks for first. Every claim says how it was checked, and the parts still to come are marked Next. Terms are explained in the glossary.

First checked 4 October 2026; later checks carry their own dates

1 of 8

Where your data goes

Your samples are locked by a sealer you run on your own machine, and they can only be opened inside a sealed room in Stockholm. Everything in between handles them locked.

Cloudflare and our host only ever handle the locked package and the receipt.
While the room works (about 10 seconds), the host keeps the locked package in a temporary file only its own account can read, and deletes it when the request ends.
The room is diskless. Its files live in its own memory and are deleted as each clause is checked, so the room is empty after the request. The room's code does this; a third-party check of it is still open.

2 of 8

Who can open it

Under the current key policy, only the sealed room's own code. The key that opens your package lives in AWS KMS in Stockholm, and its policy refuses every other caller, our own administrator role included. Who can change that policy, and how that is being closed, is at the end of this section.

The policy names the room by its code measurement (PCR0). AWS checks that measurement on every request, against a document signed by the room's hardware. The part that refuses everyone else:

"Sid": "NobodyDecryptsOutsideTheRoom",
"Effect": "Deny", "Principal": "*", "Action": "kms:Decrypt",
"Condition": { "StringNotEqualsIgnoreCase": {
  "kms:RecipientAttestation:PCR0": "3ea0a6f506beac36…246c2f89108cf276430233f7f16ac00de1162f5ac343" } }

✓ Checked 6 Oct 2026 An unlock attempt by our full-access administrator role was refused by AWS (AccessDeniedException), while the published case still passed through the room.

Anyone can rebuild the room from the public code and get the same fingerprint, PCR0 3ea0a6f5… (steps).

A case you seal yourself goes to a second key in AWS KMS, the case key. The sealer you run seals to its public half, published at /room-key.json (the case key; receipts are checked with a different key, the room's signing key on /evidence). Its private half was made inside KMS and stays inside it. Its policy has the same two parts, for the same room build, and has had them since the key was made. ✓ Checked 5 Oct 2026 Our administrator's unlock attempt with it was refused. Each receipt names the case key and the fingerprint of the sealed key the room opened, so you can tell if a site handed the sealer a different public key.

Our administrators can still change the policy. AWS records such a change, but in our own account. A signed public log now gets one entry a day, since 12 Oct 2026: public-log, signed with the key in PUBLIC_KEY.txt. Anyone can check offline that past entries are intact and in order. Two steps close this: every policy change written into that log, and the key held in your own AWS account. Next

3 of 8

Every unlock, as AWS recorded it

AWS CloudTrail writes down every use of the room key and the case key. Here is that log, exported with addresses and names removed.

Unlocks of the room key

Unlocks of the case key, for cases buyers sealed themselves

Unlock attempts AWS refused, in our account

Loading the log. The raw export is at /unlock-log.json.

Unlocked by the sealed room
Our setup tests, before the policy was final
Refused by AWS

Exported from AWS CloudTrail by us on … (raw export). AWS leaves the key unnamed when it refuses, so refusals are counted for our whole account. Log files signed by AWS that you can check yourself: Next

4 of 8

Where it runs

In AWS's Stockholm region (eu-north-1), Sweden, as an AWS Nitro Enclave: an isolated machine that is diskless and login-free, with the one channel from its host as its only network.

Part	Where	How it was checked
The sealed room	AWS eu-north-1a, Stockholm	The running enclave reports code measurement 3ea0a6f5…, the one the key policy requires and releases.json publishes. AWS's hardware confirms it on every receipt.
The room key	AWS KMS, eu-north-1, single-region	Key metadata, read on 4 Oct 2026.
The case key	AWS KMS, eu-north-1, single-region	RSA 4096, made inside KMS. Key metadata, read on 5 Oct 2026. Its public half: /room-key.json.
The website	Cloudflare's network	Serves pages and receives the form; sample data reaches it only locked.
Form entries (design-partner and case requests)	Cloudflare D1, EU jurisdiction	The database is created with EU jurisdiction, so it is stored and run inside the EU. Our email replies run on Google Workspace (privacy).

5 of 8

What is kept, and for how long

What	Kept	Details
Your sealed package	Only while the room works	A temporary file on the host, still locked, deleted when the request ends.
Your readable data	Only inside the room	Opened only inside the enclave, in memory.
The receipt	Sent to you	The verdict per point, each check and what happened, and fingerprints of the build, the data and the tests. Both sides hold the same signed file. In a private case the checks' names and reasons inside it are sealed to your key, so the vendor reads each check's outcome. Signed in the room, with AWS's hardware document.
A case you send us	90 days	Only your sentence and your email, to write back. Deleted after 90 days.
Page counts	A number per day	For example "sample runs: 12". Only the count is kept.

Your data is used only to run the tests you and the vendor agreed on, and the verdict is their result.

6 of 8

Who processes it

Company	What for	What it handles
Amazon Web Services	The room (EC2 with Nitro Enclaves), the key (KMS), the unlock log (CloudTrail); Stockholm	Locked data; it is readable only inside the diskless, login-free enclave, and the key opens only for the room's measured code.
Cloudflare	The website, the tunnel to Stockholm, the cases you send us (D1, EU)	The locked package, forwarded as it is.

7 of 8

How you can check for yourself

Rebuild the room yourself. Its code and build recipe are public. Every input is pinned, so a build gives the same code measurement as the running room (3ea0a6f5…), and AWS's hardware confirms that measurement on every receipt.
Seal a case yourself: node seal.mjs in the public repository seals it on your own machine, so only ciphertext ever leaves it, and only the room can open it.
See a finished sample run and a real test-room receipt side by side, with every file to download.
Read two signed receipts from the earlier prototype, with their signatures and chain.
Run the same tests on your own machine: node rerun.mjs v1.3 in the public repository prints the same checks and fingerprints as the room's receipt, and compares them with a receipt you saved.
Every receipt from the AWS room is signed inside the room and carries a document from AWS's hardware that vouches for it. After each run, our offline verifier checks both: AWS's own root certificate, the room's published build (releases.json), the one-time number your sealer sent, and the receipt itself. Each receipt also names the one before it.

Try that check now, on a receipt from our room

A receipt the room signed on 4 Oct 2026 (download it). Your browser checks it with this site's own code. Then change one word in it and check again.

aarloven receipt · room v2pass

aarloven.receipt.v2 · 4 oct 2026 · aws nitro enclave, stockholm

points: yes · yes · yes
input: c2109f6b50c9…a9454
result: 8f10267b1968…4fde1
before it: 5879ef191c01…a43e
signing key: dc1f56823aa0…15e5
signed: ed25519, inside the room · aws hardware document attached

8 of 8

Questions from your security team

Send them with the design-partner form, saying they are security questions. We answer in writing.