hardware-enforced container encryption

Deploy everywhere.

Expose nothing.

Ship your workloads. Keep your secrets. IP protection

Encrypted from source to server. end-to-end encryption

Tamper-proof. Cryptographically verified. attestation

Any cloud. Any customer. Zero visibility. universal deployment

start deploying watch demo

eCora — deployments

sealed images

inference-v3.2

sealed

deployed to 2 customers

updated 2h ago

attestation valid · SEV enclave

deploy to customer

classifier-v1.8

sealing…

target: Acme Corp

started 4m ago

encrypting workload73%

100%

IP retained

live enclaves

inspection attempts

how it works

From your build pipeline to a running enclave.

publisher

configure

Set up your marketplaces and billing

Connect your AWS, Azure, or GCP Marketplace accounts and configure your billing profile. eCora handles metering and entitlement automatically — set your pricing model once and it applies across every marketplace you list on.

seal & list

Locally encrypt and upload to marketplaces

Run the eCora CLI to seal your container image on your own machine. Every layer is encrypted with hardware-bound keys before anything leaves your environment. eCora then ships the sealed image to the marketplaces you configured — customers download it just like any other container.

manage

Control access from your dashboard

See which customers run which versions. Update, rotate, or revoke access instantly — without redeployment or support tickets.

subscriber

Find and subscribe on the marketplace

Browse and subscribe to the product as normal. The sealed container downloads just like any other marketplace image — no special tooling required.

deploy

Launch in your cloud environment

The container starts inside a CPU-verified enclave on your infrastructure. Standard runtime — no agents, no kernel modules, no configuration overhead.

verify

Get cryptographic proof of integrity

Receive hardware-signed attestation that the software is genuine and unmodified. A trust signal for your security team, auditors, and compliance requirements.

platform capabilities

Local sealing

Encrypt on your own machine using your local TPM. Keys are hardware-bound to your device — your plaintext never leaves your environment.

Confidential computing

Hardware-verified TEEs such as AMD SEV and Intel TDX. Host OS is blind to the workload.

Live attestation

See cryptographic proof your code is running unmodified, in real time.

Customer management

Manage which customers run which versions. Revoke access instantly.