Confidentiality measured

Deploy anything. Prove everything.

Secret.Zone: a computer in a sealed room

Site

A website, on a confidential computer, with a name. You can prove what’s being served.

App

Your software, on a confidential computer, with a link. Secrets stay sealed to that machine.

Agent

Confidential AI with its own computer. You message it. You can watch the screen, or sit down at the desk.

Storage

A confidential bucket with its own name. Seal it or leave the lid off. Hook it to one computer, or many, or none.

An agent with a computer.
Provable confidential compute.

Chat with it. Watch the screen. Sit down at the desk.
Keep the files in a bucket you can share, seal, or leave open.

Home
Trash
Firefox ESR: Drafts_□×
DraftsInbox
← →
mail.internal/drafts
Drafts · 3 unsent
AcmeRe: invoice 1842not sent
NorthwindRe: invoice 1901not sent
HeliosRe: invoice 1914not sent
Thunar: /home/cowboy_□×
Home
Desktop
Documents
Trash
NameSizeType
brief.pdf240 KBPDF
inbox-draftsFolder
calendar.ics12 KBCalendar
compose.yml1 KBText
Terminal: cowboy@cvm: ~_□×
cowboy@cvm:~$ ls
brief.pdf  inbox-drafts  calendar.ics  compose.yml
cowboy@cvm:~$ zone-agent prove
tdx  compose  ok
cowboy@cvm:~$ █
Applications Firefox ESR Thunar Terminal
en17:27
cowboy Drafts are ready. Nothing sent. Open the computer if you want the seat.

Provable confidential compute

You can prove the code, and the host it runs on.

Files in confidential buckets

Hook it to one computer, or many, or none.

Sit in the seat

Take over and you are on the same desktop.

TradAI vs Secret.Zone

A computer you cannot prove. Or one you can.

TradAI

One cloud PC, many botsshared logins
Desktopyou don’t own
Filesstuck in the bot
Prove what’s runningno

Zone

cowboy.secret.express is the computer. aging.s3.secret.express is a bucket. Grant aging to cowboy if you want them to see the files.

cowboycowboy.secret.express
agingaging.s3.secret.express

Confidential compute & storage

A site, an app, an agent, or a bucket. Confidentiality you can measure.

Computers

Site · App · Agent

Git or a folder. A compose. An agent with a desktop. Chat drives. Take over and you are in the same seat.

Deployments
main 02ec796live · secret3.dev
cowboycowboy.secret.express

Lives on

name.secret.express

That URL is the computer. Bring your own domain if you want. secret.zone is the product.

A bucket, if you want one, is a second name on s3.secret.express.

Computerconfidential virtual machine
GPUconfidential, same isolation

Storage

A bucket with a name

You name it. It lives on aging.s3.secret.express. That is not the computer’s URL. Seal it or leave it readable. Grant it to cowboy, or to nobody.

aging.s3.secret.express
scans/1842.dcmbafy…c8e
aging.csvbafy…11d

Grant

The bucket stands alone until you grant it. One computer, or many, or none.

Sealedkeys only to who you grant
Openyou can see what’s inside

Open your work.

Click a site, an agent, or a bucket. You’re in.

Home
secret3.devsite
cowboycowboy.secret.express
agingaging.s3.secret.express

Home

Name the computer. Name the bucket, if you want one. They do not have to match.

The room

Sit in the seat

Take over cowboy and you are on the same desktop. Leave, and chat is driving again.

aging

aging.s3.secret.express
scans/1842.dcmsealed
granted tocowboy
$ zone verify cowboy
image host ok
$ zone grant aging --to cowboy
cowboy can read aging