# FAQ Short answers to the questions people ask first. Source: https://seal.zone/docs/faq ## Trust and security ### Can Seal read my keys? No. The CLI or SDK checks the enclave's hardware report, then [encrypts the key on your machine](https://seal.zone/docs/sealing) so only that enclave can open it. The console's browser sealing page sees what you type, so use the CLI for anything that matters. ### What if someone gets root on my server? They can make requests through the enclave as your app while they hold the server. They can't take the key, send it elsewhere, or use it once you [remove the grant](https://seal.zone/docs/threat-model). ### Why should I trust the enclave's code? The code is public, and your SDK checks the running build's fingerprint on every connection. A build gets keys only after two of three release keys sign it and it sits in the [public log](https://seal.zone/docs/releases) for a waiting period. During the preview that period is five minutes and the witnesses run from one seed, so they don't yet check Seal independently. ### What can Seal's own staff do? They can stop things working but can't [read your keys](https://seal.zone/docs/threat-model). They could withhold data, drop telemetry (which shows as gaps) or replay older settings within the freshness window. ## When things go wrong ### What happens if Seal is down? Your keys stop working; they don't leak. A running replica rides out a control plane or log outage for your [freshness window](https://seal.zone/docs/limits#freshness-and-failing-closed), but starts no new sessions after about 15 minutes without the key guardian. Seal-hosted replicas go down with Seal. ### What if Seal goes away for good? Your blobs stop opening, and nothing in them becomes [readable](https://seal.zone/docs/threat-model). You go back to provider keys in environment variables. ### What if I lose my admin key? If it was your only one, nobody can change the tenant again, though existing blobs keep working. Add a [second admin key](https://seal.zone/docs/changes) when you create the tenant. ## Using it ### Which languages and platforms work? Python 3.9+, Node 20+, Go (with cgo) and Rust, on [Linux and macOS](https://seal.zone/docs/quickstart), x64 and arm64. No Windows builds. ### Which APIs and databases can I use? Any HTTPS API that takes its key in a header, Postgres over TLS with SCRAM-SHA-256, and standalone Redis over TLS. [APIs and databases](https://seal.zone/docs/upstreams) lists what isn't supported yet. ### Does it add latency? One extra hop per request, shorter if the replica runs in your own network. A [Seal-hosted replica](https://seal.zone/docs/hosting) stops after 15 idle minutes, so the next call waits about a minute. ### Can I use it in local development? Use a free development tenant with an [app key](https://seal.zone/docs/apps) in `SEAL_APP_KEY`. Or build the simulator from the [seal repository](https://github.com/sealzone/seal) with `scripts/sim-demo.sh`. ### How do I rotate or revoke a key? Seal the new key, replace the blob, then revoke the old key at the provider. To [cut off a blob](https://seal.zone/docs/revoking), remove the app's grant or retire its tenant key version. ### Which clouds can run the enclave? Azure confidential containers on AMD SEV-SNP, with AWS and Google Cloud planned. `seal deploy azure` runs a [replica in your own subscription](https://seal.zone/docs/hosting); production use is part of the upcoming Business plan. ## The project ### What does it cost? The [Developer plan](https://seal.zone/#pricing) is free, with a Seal-hosted enclave, telemetry and the simulator. Other plans are coming soon; write to harvey@seal.zone. ### Is it open source? Yes, Apache 2.0 on [GitHub](https://github.com/sealzone/seal), except the console, which can't sign changes or read keys anyway. ### What's the challenge? Seal pays $5,000 to the first person who steals a key it protects, with ten minutes of root on the machine using it. Try it at [seal.zone/challenge](https://seal.zone/challenge).