seal

Using Seal

Markdown

Where the enclave runs

Seal can run your enclave for you, or you can run your own in your Azure network. What changes between the two.

Blobs open only in an enclave replica, a copy of the enclave in a hardware TEE. Seal runs it, or you run your own in Azure.

AnywhereYour app

Seal's Azure

SealFront door
TEEEnclave
Public API
Private DBOut of reach
Address
<tenant>.enclave.seal.zone:8443
Runs in
Seal's Azure account, one enclave per tenant
When idle
Stops after 15 minutes; the next call starts it in about a minute
Reaches
Public APIs and databases with a public address
Can stop it
Seal, and your console's owners and managers
Plan
Developer, free, today
FigureSame enclave code, same checks by your SDK, either way. What changes is whose cloud it runs in and what it can reach.

The replica Seal runs for you#

.env
SEAL_ENDPOINT=https://<tenant>.enclave.seal.zone:8443

Each tenant gets its own replica, an AMD SEV-SNP confidential container in Azure East US. Seal's front door reads only the TLS server name and passes the encrypted connection through. An open session keeps the replica from idling.

It gets keys only because your tenant's signed state lists it, which is your consent. Withdraw it under Deployments, "Run by Seal".

Running your own#

Sign in with az and seal login, then:

Terminal
$seal deploy azure --vnet my-apps-vnet

The CLI verifies the newest release first, then creates what's missing:

  • a /27 subnet named seal,
  • a NAT gateway, if the VNet has none,
  • a managed identity and Entra app, both named seal-<tenant>,
  • the deployment grant, signed with your passkey,
  • the confidential container.

It prints the private SEAL_ENDPOINT. --dry-run shows every step first. Allow traffic from the seal subnet to your database's port.

Terminal
$seal deploy upgrade -g my-resource-group

It keeps the identity and refuses older releases. Update SEAL_ENDPOINT if the address changes.

More than one replica#

Replicas share your tenant's keys, so a blob opens on any of them:

.env
SEAL_ENDPOINT=https://10.0.1.4:8443,https://acme.enclave.seal.zone:8443

The SDK fails over between them, retrying for up to 120 seconds before Unavailable. Database drivers reopen dropped connections.

Plans#

Developer
Where the enclave runsSeal runs it
AvailabilityAvailable now, free
Hosted
Where the enclave runsSeal runs it, sized for production traffic
AvailabilityComing soon
Business
Where the enclave runsYour own replica in your network, for private databases
AvailabilityComing soon
Enterprise
Where the enclave runsBusiness, plus your own locked key vault and an SLA
AvailabilityComing soon

For the rest, write to [email protected].

What the host can and can't do#

The host runs the machine: Seal on Azure, or your subscription's admins.

The host can

  • Stop or delete the replica.
  • See which upstreams it reaches, when, and how much data.
  • Control the network, so network rules don't stop the host.

The host can't

  • Read its memory, where your keys are open.
  • Open a shell or attach a debugger.
  • Make it serve a tenant that didn't list it.

See What an attacker gets.