- Sovereignty is enforced in hardware. Trusted Execution Environments isolate every workload,
- remote attestation makes that isolation verifiable, and a complete audit trail makes it
- provable to a regulator. Validated through three EU Horizon Europe research projects and built
- as a member of the Linux Foundation and Confidential Computing Consortium.
+ Sovereignty is enforced in hardware. Trusted Execution Environments
+ isolate every workload, remote attestation makes that isolation
+ verifiable, and a complete audit trail makes it provable to a
+ regulator. Validated through three EU Horizon Europe research projects
+ and built as a member of the Linux Foundation and Confidential
+ Computing Consortium.
diff --git a/src/components/CubeSpotlight.astro b/src/components/CubeSpotlight.astro
index 0f5d288..abe0050 100644
--- a/src/components/CubeSpotlight.astro
+++ b/src/components/CubeSpotlight.astro
@@ -1,5 +1,5 @@
---
-import { Server, Layers, Shield, Eye, Lock } from "lucide-astro";
+import { Server, Layers, Shield, Eye, Lock } from "@lucide/astro";
const caps = [
{
diff --git a/src/components/Deployment.astro b/src/components/Deployment.astro
index e8d4d28..ab775d9 100644
--- a/src/components/Deployment.astro
+++ b/src/components/Deployment.astro
@@ -1,38 +1,72 @@
---
-import { Server, Lock, Globe, Layers, Plug, Check } from 'lucide-astro';
+import { Server, Lock, Globe, Layers, Plug, Check } from "@lucide/astro";
const models = [
- { Icon: Server, label: 'On-premises', desc: 'Run on your own servers and GPUs, behind your firewall, under your change control.' },
- { Icon: Lock, label: 'Air-gapped', desc: 'Fully disconnected deployment for the most sensitive classified and regulated environments.' },
- { Icon: Globe, label: 'Sovereign cloud', desc: 'Deploy in an EU or national cloud region that meets your data-residency mandate.' },
- { Icon: Layers, label: 'Private cloud', desc: 'Bring your own VPC. Hardware-isolated TEEs keep workloads confidential from the host.' },
- { Icon: Plug, label: 'Edge', desc: 'Push inference to the edge — factories, vehicles, field sites — with the same governance.' },
+ {
+ Icon: Server,
+ label: "On-premises",
+ desc: "Run on your own servers and GPUs, behind your firewall, under your change control.",
+ },
+ {
+ Icon: Lock,
+ label: "Air-gapped",
+ desc: "Fully disconnected deployment for the most sensitive classified and regulated environments.",
+ },
+ {
+ Icon: Globe,
+ label: "Sovereign cloud",
+ desc: "Deploy in an EU or national cloud region that meets your data-residency mandate.",
+ },
+ {
+ Icon: Layers,
+ label: "Private cloud",
+ desc: "Bring your own VPC. Hardware-isolated TEEs keep workloads confidential from the host.",
+ },
+ {
+ Icon: Plug,
+ label: "Edge",
+ desc: "Push inference to the edge — factories, vehicles, field sites — with the same governance.",
+ },
];
---
- Deploy anywhere
-
Wherever your data has to live, your AI can run.
+ Deploy anywhere
+
+ Wherever your data has to live, your AI can run.
+
Ultraviolet is a sovereign AI infrastructure company. Our products let you build, deploy, govern, and operate AI entirely inside your own perimeter — on hardware you control, with nothing leaving your network.
+ Sovereign AI
+ Infrastructure
+
+ AI you own. Infrastructure you control.
+
+
+ Ultraviolet is a sovereign AI infrastructure company. Our products let
+ you build, deploy, govern, and operate AI entirely inside your own
+ perimeter — on hardware you control, with nothing leaving your
+ network.
+
-
-)}
+
+ )
+}
diff --git a/src/components/Principles.astro b/src/components/Principles.astro
index fff4f6e..697bd81 100644
--- a/src/components/Principles.astro
+++ b/src/components/Principles.astro
@@ -1,25 +1,41 @@
---
const items = [
- ['01', 'Private', 'Every prompt, embedding, and response stays inside your perimeter. Zero outbound by default. No hidden telemetry, no training on your data.'],
- ['02', 'Sovereign', 'Data residency, compliance, and operational control governed by your policies and your jurisdiction — never a vendor\'s terms of service.'],
- ['03', 'Open', 'Open core. Cube AI and Cocos AI are Apache 2.0 — inspect the source, fork the platform, extend it for your environment. No black boxes, no lock-in.'],
+ [
+ "01",
+ "Private",
+ "Every prompt, embedding, and response stays inside your perimeter. Zero outbound by default. No hidden telemetry, no training on your data.",
+ ],
+ [
+ "02",
+ "Sovereign",
+ "Data residency, compliance, and operational control governed by your policies and your jurisdiction — never a vendor's terms of service.",
+ ],
+ [
+ "03",
+ "Open",
+ "Open core. Cube AI and Cocos AI are Apache 2.0 — inspect the source, fork the platform, extend it for your environment. No black boxes, no lock-in.",
+ ],
];
---
- Prism AI runs joint AI workloads across organizational boundaries inside Trusted Execution
- Environments. Each party keeps its data private while sharing only the result. A commercial
- platform with free and enterprise tiers.
+ Prism AI runs joint AI workloads across organizational boundaries
+ inside Trusted Execution Environments. Each party keeps its data
+ private while sharing only the result. A commercial platform with free
+ and enterprise tiers.
- Cocos AI is the open-source hardware abstraction layer for Trusted Execution Environments —
- the transparent, auditable substrate beneath Cube and Prism. Inspect it, fork it, extend it.
+ Cocos AI is the open-source hardware abstraction layer for Trusted
+ Execution Environments — the transparent, auditable substrate beneath
+ Cube and Prism. Inspect it, fork it, extend it.
diff --git a/src/components/Problem.astro b/src/components/Problem.astro
index 21c8d60..d82ad08 100644
--- a/src/components/Problem.astro
+++ b/src/components/Problem.astro
@@ -1,35 +1,65 @@
---
-import { Check } from 'lucide-astro';
+import { Check } from "@lucide/astro";
const rows = [
- ['Where do prompts go?', 'To a third-party cloud, logged and retained on someone else\'s terms.', 'Never leave your perimeter. Zero outbound by default.'],
- ['Who can see your data?', 'The provider, their subprocessors, and a foreign jurisdiction.', 'Only you. Hardware-isolated inside Trusted Execution Environments.'],
- ['Can you prove compliance?', 'You inherit a vendor\'s policies and hope for the best.', 'Compliance by architecture — GDPR, HIPAA, the EU AI Act.'],
- ['What happens at renewal?', 'Prices rise, models change, lock-in deepens.', 'Apache 2.0. Own it, fork it, run it forever.'],
+ [
+ "Where do prompts go?",
+ "To a third-party cloud, logged and retained on someone else's terms.",
+ "Never leave your perimeter. Zero outbound by default.",
+ ],
+ [
+ "Who can see your data?",
+ "The provider, their subprocessors, and a foreign jurisdiction.",
+ "Only you. Hardware-isolated inside Trusted Execution Environments.",
+ ],
+ [
+ "Can you prove compliance?",
+ "You inherit a vendor's policies and hope for the best.",
+ "Compliance by architecture — GDPR, HIPAA, the EU AI Act.",
+ ],
+ [
+ "What happens at renewal?",
+ "Prices rise, models change, lock-in deepens.",
+ "Apache 2.0. Own it, fork it, run it forever.",
+ ],
];
---
- The status quo is a liability
-
Frontier AI shouldn’t mean surrendering your data.
+ The status quo is a
+ liability
+
+ Frontier AI shouldn’t mean surrendering your data.
+
- Every prompt sent to a hosted model is data leaving your control. For regulated
- and sovereign organizations, that’s not a feature trade-off — it’s an unacceptable risk.
+ Every prompt sent to a hosted model is data leaving your control. For
+ regulated and sovereign organizations, that’s not a feature
+ trade-off — it’s an unacceptable risk.
diff --git a/src/content/blog/amd-sev-snp-vs-intel-tdx.md b/src/content/blog/amd-sev-snp-vs-intel-tdx.md
index a5e94dc..be1a4aa 100644
--- a/src/content/blog/amd-sev-snp-vs-intel-tdx.md
+++ b/src/content/blog/amd-sev-snp-vs-intel-tdx.md
@@ -6,17 +6,17 @@ excerpt: "A technical comparison of AMD SEV-SNP and Intel TDX confidential compu
author:
name: "sammy oina"
picture: "https://avatars.githubusercontent.com/u/44265300?v=4"
-tags: [security, confidential-computing, amd, intel, technical-deep-dive, "cube ai"]
+tags:
+ [security, confidential-computing, amd, intel, technical-deep-dive, "cube ai"]
image: /img/amd-sev-snp-vs-intel-tdx/amd_sev_snp_vs_intel_tdx_cover.png
coverImage: /img/amd-sev-snp-vs-intel-tdx/amd_sev_snp_vs_intel_tdx_cover.png
ogImage: /img/amd-sev-snp-vs-intel-tdx/amd_sev_snp_vs_intel_tdx_cover.png
date: 2026-02-24
---
-
In the rapidly evolving landscape of [Confidential Computing](/blog/confidential-computing-meets-ai), hardware-based isolation is the foundation of trust. For security engineers and infrastructure teams, understanding the underlying Trusted Execution Environment (TEE) technologies is crucial for deploying secure AI workloads.
-Cube AI is designed to run seamlessly on the two leading hardware-based TEE platforms: **AMD SEV-SNP** and **Intel TDX**.
+Cube AI is designed to run seamlessly on the two leading hardware-based TEE platforms: **AMD SEV-SNP** and **Intel TDX**.
This post provides a technical comparison of these technologies and explains how Cube AI abstracts their complexities to provide a unified, secure platform for your AI models.
@@ -30,9 +30,9 @@ Both AMD and Intel have developed robust technologies to solve the same problem:
AMD SEV-SNP is the third generation of AMD's confidential computing technology. It builds upon the memory encryption of the original SEV and the register protection of SEV-ES.
-* **Key Mechanism**: Memory Encryption Key (MEK) management is handled by the **AMD Secure Processor (ASP)**, a dedicated ARM core on the die.
-* **Integrity Protection**: "Secure Nested Paging" (SNP) adds strong integrity protection to prevent hypervisors from remapping memory (e.g., integrity checks on page table lookups).
-* **VMPL (Virtual Machine Privilege Levels)**: SEV-SNP introduces VMPL rings (0-3), allowing a guest VM to run a "paravisor" or other privileged components within the CVM that are more privileged than the guest OS but less privileged than the hardware root of trust.
+- **Key Mechanism**: Memory Encryption Key (MEK) management is handled by the **AMD Secure Processor (ASP)**, a dedicated ARM core on the die.
+- **Integrity Protection**: "Secure Nested Paging" (SNP) adds strong integrity protection to prevent hypervisors from remapping memory (e.g., integrity checks on page table lookups).
+- **VMPL (Virtual Machine Privilege Levels)**: SEV-SNP introduces VMPL rings (0-3), allowing a guest VM to run a "paravisor" or other privileged components within the CVM that are more privileged than the guest OS but less privileged than the hardware root of trust.
**Further Reading**: [AMD SEV-SNP Specification](https://www.amd.com/en/technologies/se/secure-encrypted-virtualization) | [AMD Secure Processor Technical Reference](https://developer.amd.com/sev/)
@@ -40,34 +40,36 @@ AMD SEV-SNP is the third generation of AMD's confidential computing technology.
Intel TDX creates an architectural isolation boundary known as a **Trust Domain (TD)**.
-* **Key Mechanism**: The **Intel TDX Module** is a software module that runs in a special CPU mode (SEAM - Secure Arbitration Mode) to manage valid transitions between the host and the guest (TD).
-* **MKTME (Multi-Key Total Memory Encryption)**: Uses AES-128-XTS encryption engines in the memory controller.
-* **Measurement**: TDX provides a comprehensive measurement of the initial VM state, including the firmware (TDVF) and the kernel.
+- **Key Mechanism**: The **Intel TDX Module** is a software module that runs in a special CPU mode (SEAM - Secure Arbitration Mode) to manage valid transitions between the host and the guest (TD).
+- **MKTME (Multi-Key Total Memory Encryption)**: Uses AES-128-XTS encryption engines in the memory controller.
+- **Measurement**: TDX provides a comprehensive measurement of the initial VM state, including the firmware (TDVF) and the kernel.
**Further Reading**: [Intel TDX Overview](https://www.intel.com/content/www/us/en/architecture-and-technology/trust-domain-extensions.html) | [Intel TDX Module Documentation](https://software.intel.com/content/www/us/en/develop/download/intel-trust-domain-extension-module-documentation.html)
## Feature Comparison
-| Feature | AMD SEV-SNP | Intel TDX |
-| :--- | :--- | :--- |
-| **Isolation Boundary** | VM (with VMPLs) | Trust Domain (TD) |
-| **Memory Encryption** | AES-128 / AES-256 XTS (Engine in Memory Controller) | AES-128-XTS (MKTME) |
-| **Attestation Root** | AMD Secure Processor (ASP) | SGX Quoting Enclave (QE) |
-| **Register State** | Encrypted (SEV-ES) | Managed by hardware/TDX Module |
-| **Key Management** | Cloud Provider independent (mostly) | Cloud Provider independent |
+| Feature | AMD SEV-SNP | Intel TDX |
+| :--------------------- | :-------------------------------------------------- | :----------------------------- |
+| **Isolation Boundary** | VM (with VMPLs) | Trust Domain (TD) |
+| **Memory Encryption** | AES-128 / AES-256 XTS (Engine in Memory Controller) | AES-128-XTS (MKTME) |
+| **Attestation Root** | AMD Secure Processor (ASP) | SGX Quoting Enclave (QE) |
+| **Register State** | Encrypted (SEV-ES) | Managed by hardware/TDX Module |
+| **Key Management** | Cloud Provider independent (mostly) | Cloud Provider independent |
## Security Guarantees & Threat Model
Both technologies operate under a similar threat model, designed to protect against powerful adversaries.
### What is Protected?
-* **Hypervisor Access**: The cloud provider's hypervisor (KVM, Hyper-V) cannot read guest memory. Attempts to read encrypted pages result in ciphertext or exceptions.
-* **Host Admin**: Root access on the physical host does not grant access to the guest VM's memory.
-* **Physical Attacks**: Basic cold-boot attacks are mitigated, though sophisticated physical access to the die itself is often out of scope for standard cloud threat models.
+
+- **Hypervisor Access**: The cloud provider's hypervisor (KVM, Hyper-V) cannot read guest memory. Attempts to read encrypted pages result in ciphertext or exceptions.
+- **Host Admin**: Root access on the physical host does not grant access to the guest VM's memory.
+- **Physical Attacks**: Basic cold-boot attacks are mitigated, though sophisticated physical access to the die itself is often out of scope for standard cloud threat models.
### What is Out of Scope?
-* **Guest OS Vulnerabilities**: If the software *inside* the TEE is compromised (e.g., a vulnerability in the Linux kernel running in the VM), the TEE protects the *execution*, but the attacker is "inside the house." **This is why Cube AI uses a minimal, hardened OS image.**
-* **Denial of Service**: The host can always turn off the VM.
+
+- **Guest OS Vulnerabilities**: If the software _inside_ the TEE is compromised (e.g., a vulnerability in the Linux kernel running in the VM), the TEE protects the _execution_, but the attacker is "inside the house." **This is why Cube AI uses a minimal, hardened OS image.**
+- **Denial of Service**: The host can always turn off the VM.
## Cube AI Architecture: The Unified Layer
@@ -76,33 +78,34 @@ Cube AI abstracts the differences between SEV-SNP and Intel TDX, allowing you to
```mermaid
graph TD
User["User / Client App"] --> Proxy["Cube AI Proxy"]
-
+
subgraph CVM ["Confidential VM (CVM)"]
Agent["Cube Agent"]
LLM["vLLM / Ollama"]
end
-
+
subgraph HAL ["Hardware Abstraction Layer"]
Detect["TEE Detection"]
Attest["Attestation Report Gen"]
end
-
+
subgraph HW ["Hardware"]
AMD["AMD EPYC (SEV-SNP)"]
Intel["Intel Xeon (TDX)"]
end
-
+
Proxy -->|Attested TLS| Agent
Agent --> LLM
Agent --> Detect
Detect -.->|Calls| AMD
Detect -.->|Calls| Intel
-
+
style CVM fill:#ecfdf5,stroke:#22c55e
style HW fill:#1e293b,stroke:#94a3b8,color:#fff
```
When Cube AI starts:
+
1. It **automatically detects** the platform (AMD or Intel).
2. It loads the appropriate kernel modules (e.g., `sev-guest` or `tdx-guest`). Supported by Cube's Hardware Abstraction Layer built on buildroot.
3. It fetches the **Attestation Report** using a unified internal interface.
@@ -117,10 +120,11 @@ While the hardware is standard, cloud providers expose these features differentl
## Key Takeaway
You don't need to be a CPU architect to use Confidential Computing. Whether your infrastructure runs on the red team (AMD) or the blue team (Intel), **Cube AI** provides the same high-level security guarantees:
-* Your model weights are protected.
-* Your user prompts are encrypted in memory.
-* The cloud provider is locked out.
+
+- Your model weights are protected.
+- Your user prompts are encrypted in memory.
+- The cloud provider is locked out.
---
-*Ready to secure your AI infrastructure? Read our guide on [Architecture](https://cube.ultraviolet.rs/docs/architecture) or dive into the [Attestation specs](https://cube.ultraviolet.rs/docs/attestation).*
+_Ready to secure your AI infrastructure? Read our guide on [Architecture](https://cube.ultraviolet.rs/docs/architecture) or dive into the [Attestation specs](https://cube.ultraviolet.rs/docs/attestation)._
diff --git a/src/content/blog/atls-binding-milestone.md b/src/content/blog/atls-binding-milestone.md
index c74d7c1..145e2ad 100644
--- a/src/content/blog/atls-binding-milestone.md
+++ b/src/content/blog/atls-binding-milestone.md
@@ -8,7 +8,15 @@ authors:
picture: "https://avatars.githubusercontent.com/u/44265300?v=4"
- name: "Danko Miladinovic"
picture: "https://avatars.githubusercontent.com/u/72250944?v=4"
-tags: [confidential-computing, attestation, aTLS, security, TLS-Exporters, IETF-SEAT]
+tags:
+ [
+ confidential-computing,
+ attestation,
+ aTLS,
+ security,
+ TLS-Exporters,
+ IETF-SEAT,
+ ]
date: 2026-03-27
image: "/img/atls-milestone/cover.png"
---
@@ -24,6 +32,7 @@ Today, we are thrilled to announce that we have fulfilled our roadmap. With [PR
The previous vulnerability (and the class of attacks identified by Sardar et al. using ProVerif) stemmed from the fact that an attacker who could extract a TEE's ephemeral private key — even momentarily — could relay that TEE's attestation report to a different connection.
In the old design:
+
1. Evidence tied to `Hash(ServerPubKey ‖ Nonce)`.
2. Nonce delivered via SNI (a non-standard hack).
3. Verification happened in a custom callback that "bolted on" trust.
@@ -37,9 +46,11 @@ The gold standard for aTLS, as defined by the IETF SEAT (Secure Evidence ATtesta
Cocos AI now achieves this through three major architectural shifts:
### 1. Exclusive TLS 1.3
+
We have dropped support for older TLS versions in our aTLS paths. TLS 1.3 provides a cleaner handshake and superior key derivation functions (HKDF) which are essential for robust session export.
### 2. TLS Exporters & Nonce Freshness (RFC 5705)
+
A common misconception is that session binding replaces the need for a nonce. In the new Cocos aTLS flow (based on the [IETF EXPAT draft](https://datatracker.ietf.org/doc/draft-fossati-seat-expat/)), the nonce provided by the CLI is now carried within the `certificate_request_context`.
This context is then used as the `context_value` for the TLS Exporter, ensuring that the derived value is both fresh (non-repeating) and cryptographically bound to the session:
@@ -60,30 +71,31 @@ The binding value, which serves as the final attestation challenge, is defined a
$$\text{Binding} = \text{Hash}(\text{PublicKey} \parallel \text{TLS-Exporter}(\text{Label, Nonce}))$$
### 3. Level 2 Binding Logic
-By including this TLS-exported binder in the attestation's `report_data`, we achieve **Level 2 Binding** (Correlation to Handshake Traffic Keys). This ensures that the evidence is fundamentally bound to the cryptographic state of the *specific* TLS session.
+
+By including this TLS-exported binder in the attestation's `report_data`, we achieve **Level 2 Binding** (Correlation to Handshake Traffic Keys). This ensures that the evidence is fundamentally bound to the cryptographic state of the _specific_ TLS session.
```mermaid
sequenceDiagram
participant Client
participant Server
-
+
Note over Client,Server: 1. Standard TLS 1.3 Handshake
Client->>Server: ClientHello
Server-->>Client: ServerHello... Finished
Client-->>Server: [Certificate]... Finished
-
+
Note over Client,Server: 2. Secure Channel Established
-
+
Client->>Server: AuthenticatorRequest (Nonce, Extensions)
-
+
Note over Server: 3. Compute Binding
Note over Server: ExportedValue = TLS-Exporter("Attestation", Nonce)
Note over Server: Binding = Hash(PubKey || ExportedValue)
-
+
Server->>Server: Request TEE Report (report_data = Binding)
-
+
Server-->>Client: Authenticator (Certificate + Attestation Payload + Finished)
-
+
Note over Client: 4. Formal Verification
Note over Client: Verify report_data == Hash(PubKey || Client-Side Exporter)
```
@@ -95,6 +107,7 @@ Even if an adversary manages to extract the ephemeral private key, they **cannot
Standardization and protocol hygiene were also key goals. The previous use of the SNI (Server Name Indication) field to transport nonces was a pragmatic but fragile hack.
The new implementation moves away from SNI abuse. Instead, it utilizes a sophisticated frame-based protocol over the TLS connection or **Exported Authenticators** (RFC 9162). This allows for a clean separation of concerns:
+
- **TLS** handles the secure channel.
- **Exported Authenticators** handle the platform identity and evidence exchange.
@@ -106,7 +119,7 @@ As detailed in the advisory, the flaw was architectural: by binding attestation
By implementing **Level 2 binding** with TLS 1.3 Exporters, we have fundamentally closed this vector. The attestation evidence is now cryptographically tied to the unique handshake transcript and session keys of the specific connection. Even in a hypothetical scenario where a private key leaks, the stolen evidence cannot be relayed to a different session; it is mathematically anchored to the secure channel it was generated for.
-## Cocos v0.9.0: A New Era of Modularity
+## Cocos v0.9.0: A New Era of Modularity
While Level 2 session binding is a pivotal security milestone, it is just one part of the broader **Cocos v0.9.0** release. This version marks a significant architectural shift towards modularity and production-readiness:
@@ -130,4 +143,5 @@ Cocos AI is now more than just "attested." It is **formally bound**. By migratin
Upgrade your CLI and Agent to the latest version (v0.9.0+) to take advantage of these security enhancements.
---
-*For more technical details, check out the [Cocos repository](https://github.com/ultravioletrs/cocos) and the [new aTLS implementation](https://github.com/ultravioletrs/cocos/tree/main/pkg/atls).*
+
+_For more technical details, check out the [Cocos repository](https://github.com/ultravioletrs/cocos) and the [new aTLS implementation](https://github.com/ultravioletrs/cocos/tree/main/pkg/atls)._
diff --git a/src/content/blog/cocos-prism-release.md b/src/content/blog/cocos-prism-release.md
index dfab937..49e9ea1 100644
--- a/src/content/blog/cocos-prism-release.md
+++ b/src/content/blog/cocos-prism-release.md
@@ -27,6 +27,7 @@ Cocos AI (Confidential Computing System for AI) is a comprehensive software plat

The platform enables:
+
- **Model training and inference on sensitive data** without ever exposing that data
- **Secure Multi-Party Computation (SMPC)** for collaborative analysis across different data sources
- **Hardware attestation** to verify the integrity and trustworthiness of computations
@@ -43,16 +44,19 @@ While Cocos AI provides the core confidential computing infrastructure, **Prism*
### What Prism Brings to the Table
**1. User & Workspace Management**
+
- Create and manage users across workspaces (consortiums)
- Fine-grained role-based access control (RBAC)
- Multi-tenant isolation for collaborative environments
**2. Policy Management**
+
- Define access control policies between users, workspaces, and computations
- Manage asset access and computational workflows
- Enforce data governance rules seamlessly
**3. Asset Management**
+
- Organize and search datasets and algorithms
- Track asset usage across computations
- Maintain metadata and audit trails
@@ -60,16 +64,19 @@ While Cocos AI provides the core confidential computing infrastructure, **Prism*

**4. Computation Orchestration**
+
- Submit and monitor confidential computations
- View computation results with audit logs
- Track computation policies and resource allocation
**5. Billing & Subscription Management**
+
- Manage subscription tiers and payment information
- Track resource usage and costs
- Email notifications for important events
**6. Secure Infrastructure**
+
- Leverage TEE-based secure VM provisioning
- End-to-end encryption throughout the workflow
- Comprehensive logging and monitoring
@@ -83,6 +90,7 @@ Cocos v0.8.0 brings significant improvements focused on attestation, security, a
### Key Highlights
**Enhanced Attestation Policy**
+
- Improved CLI attestation policy tools for better developer experience
- Updated configurations for AMD SEV-SNP and Intel TDX platforms
- Added reported TCB (Trusted Computing Base) support for more comprehensive security validation
@@ -91,22 +99,24 @@ Cocos v0.8.0 brings significant improvements focused on attestation, security, a

**Performance Innovations**
+
- **VCEK Caching on aTLS Verification**: Significantly improves performance by caching VCEK (Versioned Chip Endorsement Key) certificates during attestation TLS verification
- Optimized certificate handling and verification workflows
- Enhanced HTTP and gRPC client reusability
**Architecture Enhancements**
+
- Refactored attestation handling: `AttestationResult` renamed to `AzureAttestationToken` for clarity
- New `CertificateProvider` interface for flexible certificate handling
- Improved aTLS and gRPC server architecture
- Better code reusability across components
**Security Updates**
+
- Major dependency upgrades (gRPC 1.74.2 → 1.75.0, Docker SDK 28.3.2 → 28.5.0)
- Updated SMQ library to 0.18.1 with security patches
- Enhanced certificate library integration
-
### Patch Updates
Recent patch releases (**v0.8.1** and **v0.8.2**) have focused on platform stability, security patches for cryptography libraries, and adding advanced vTPM features to enhance SEV-SNP reporting.
@@ -120,11 +130,13 @@ Prism v0.6.0 focuses on user experience, asset discovery, and operational improv
### What's New
**Advanced Search & Discovery**
+
- **Comprehensive Asset Search**: New asset search functionality with full UI and backend support
- Find and manage algorithms, datasets, and computational resources effortlessly
- Enhanced search performance and filtering options
**User Management Enhancements**
+
- **Subscription Management Button**: Dedicated UI for easier subscription control access
- **Email Notifications**: Introduced notifications for email events, keeping users informed of critical updates
- Better visibility into account and subscription status
@@ -141,14 +153,17 @@ We've polished the interface with cleaner styling for asset templates, improved
## Why These Releases Matter
### For Data Scientists & Researchers
+
- **Cocos**: Attestable proof that their sensitive algorithms and data are executed in protected enclaves
- **Prism**: Intuitive interface to run confidential computations without infrastructure complexity
### For Enterprises & Organizations
+
- **Cocos**: Hardware-validated security guarantees for regulatory compliance (HIPAA, GDPR, etc.)
- **Prism**: Enterprise features like billing, user management, and audit logs for governance
### For Security Teams
+
- **Cocos**: Advanced attestation validation, updated security policies, and dependency management
- **Prism**: Fine-grained access control, comprehensive logging, and policy enforcement
@@ -173,9 +188,11 @@ Together, Cocos and Prism enable a new paradigm for AI:
## Getting Started
### Explore Cocos AI
+
Visit the [Cocos GitHub repository](https://github.com/ultravioletrs/cocos) to deploy and integrate confidential computing into your infrastructure.
### Experience Prism
+
Access [Prism's web interface](https://prism.ultraviolet.rs/) to manage users, policies, and computations in a secure, user-friendly environment.
---
@@ -183,6 +200,7 @@ Access [Prism's web interface](https://prism.ultraviolet.rs/) to manage users, p
## What's Next?
Both projects continue to evolve. The roadmap includes:
+
- Enhanced multi-party computation capabilities
- Support for additional TEE technologies
- Expanded analytics and reporting features
@@ -193,6 +211,7 @@ Stay tuned for more innovations in the confidential computing space!
---
**Learn More:**
+
- [Cocos AI Documentation](https://cocos.ultraviolet.rs/docs/)
- [Prism Documentation](https://prism.ultraviolet.rs/docs/)
- [Ultraviolet RS](https://ultraviolet.rs)
diff --git a/src/content/blog/confidential-computing-meets-ai.md b/src/content/blog/confidential-computing-meets-ai.md
index bba7c6e..57eef6c 100644
--- a/src/content/blog/confidential-computing-meets-ai.md
+++ b/src/content/blog/confidential-computing-meets-ai.md
@@ -27,7 +27,7 @@ In this deep dive, we'll explore how Cube AI leverages Trusted Execution Environ
At the heart of Cube AI's security model are **Trusted Execution Environments (TEEs)**, specifically utilizing **AMD SEV-SNP** and **Intel TDX**.
-Traditionally, if you run a VM in the cloud, the cloud provider (the hypervisor context) has technical access to your memory. They *could*, in theory, dump the RAM and see your unencrypted data.
+Traditionally, if you run a VM in the cloud, the cloud provider (the hypervisor context) has technical access to your memory. They _could_, in theory, dump the RAM and see your unencrypted data.
TEEs change this equation by encrypting the virtual machine's memory **at the hardware level**.
@@ -39,30 +39,30 @@ TEEs change this equation by encrypting the virtual machine's memory **at the ha
Core["CPU Core (Data is Plaintext)"]
ME["Memory Encryption Engine (AES-128/256)"]
end
-
+
subgraph RAM ["System Memory (Untrusted)"]
EncData["Encrypted Data (Ciphertext)"]
end
-
+
subgraph Host ["Hypervisor / Host OS"]
Admin["Cloud Admin / Root"]
end
Core <--> ME
ME <-->|Encrypted Read/Write| EncData
-
+
Admin -.->|Attempts to Read| EncData
Admin -- "Sees Garbage" --> EncData
-
+
style CPU fill:#ecfdf5,stroke:#22c55e,stroke-width:2px,color:#000
style RAM fill:#f8fafc,stroke:#eab308,stroke-width:2px,color:#000
style Host fill:#fef2f2,stroke:#ef4444,stroke-width:2px,color:#000
```
2. **Remote Attestation**: This is the "proof" part. The hardware generates a cryptographic "quote"—a digital signature signed by the processor's manufacturer key. This quote serves as proof that:
- * The software running is exactly what you expect (measured by a hash).
- * The hardware protections (SEV-SNP/TDX) are active.
- * The environment hasn't been tampered with.
+ - The software running is exactly what you expect (measured by a hash).
+ - The hardware protections (SEV-SNP/TDX) are active.
+ - The environment hasn't been tampered with.
## Why Traditional LLM APIs Expose Privacy Risks
@@ -71,31 +71,30 @@ When you use a standard API (like OpenAI or Anthropic), the flow usually looks l
1. TLS encrypts data in transit (good).
2. Provider decrypts data on their server to process it (necessary).
3. **Risk Zone**: While the data is processed, it is visible in plain text in the server's memory.
- * **Insider Threats**: Rogue admins with root access could potentially inspect memory.
- * **Side-Channel Attacks**: Exploits like Spectre/Meltdown or purely software-based memory scrapers could exfiltrate data.
- * **Data Retention**: Mistakes in logging configurations could accidentally save sensitive prompts to persistent storage.
+ - **Insider Threats**: Rogue admins with root access could potentially inspect memory.
+ - **Side-Channel Attacks**: Exploits like Spectre/Meltdown or purely software-based memory scrapers could exfiltrate data.
+ - **Data Retention**: Mistakes in logging configurations could accidentally save sensitive prompts to persistent storage.
```mermaid
graph LR
User([User]) -->|TLS Encrypted| Gateway[API Gateway]
Gateway -->|Plaintext| Server[Model Server]
-
+
subgraph RAM ["Server Memory (RAM)"]
Prompt["User Prompt (Plaintext)"]
end
-
+
Server -- Processing --> Prompt
-
+
Hacker[Attacker / Malware] -.->|Side Channel| Prompt
Admin[Rogue Employee] -.->|Direct Memory Dump| Prompt
Logs[Log Collector] -.->|Misconfiguration| Prompt
-
+
style Prompt fill:#ef4444,stroke:#7f1d1d,color:#fff,stroke-width:2px
style RAM fill:#e2e8f0,stroke:#94a3b8,color:#333
style Hacker stroke:#ef4444,stroke-dasharray: 5 5
```
-
For regulated industries, this "Processing in the Clear" is a major compliance hurdle.
## Cube AI Architecture: Isolation by Design
@@ -110,9 +109,8 @@ Here is how Cube AI isolates your data:

-
1. **Attestation Handshake**: The connection negotiation starts with an **Attested TLS (aTLS)** handshake. The Attestation Agent sends its certificate along with a hardware-signed quote.
-2. **Proxy Verification**: The Cube Proxy verifies this quote against a strict attestation policy. Unlike standard TLS which blindly trusts a Certificate Authority, the Proxy validates the *hardware identity* and *software integrity* of the Agent.
+2. **Proxy Verification**: The Cube Proxy verifies this quote against a strict attestation policy. Unlike standard TLS which blindly trusts a Certificate Authority, the Proxy validates the _hardware identity_ and _software integrity_ of the Agent.
3. **Secure Tunnel**: Once verified, an encrypted aTLS tunnel is established between the Proxy and the Agent.
4. **Inference Proxying**: The User sends an encrypted prompt to the Proxy, which forwards it through the aTLS tunnel. The Agent then proxies this request to the local LLM backend (vLLM/Ollama) running inside the enclave. Use the same key.
@@ -120,15 +118,15 @@ Here is how Cube AI isolates your data:
Imagine a healthcare provider building an AI assistant to analyze patient records for rare disease patterns.
-* **The Data**: Highly sensitive patient history, genetic markers, and lab results.
-* **The Risk**: Uploading this to a public LLM violates HIPAA and GDPR.
-* **The Cube AI Solution**:
- 1. The hospital's application connects to their private Cube AI instance.
- 2. It verifies the instance acts as a "black box" via Remote Attestation.
- 3. It sends the patient data.
- 4. **Insight**: The model analyzes the data *in memory* (which is encrypted at the hardware level).
- 5. **Result**: The diagnosis is returned encrypted.
- 6. **Aftermath**: Once the request is done, the data in memory is wiped. No logs, no training, no eyes on the data.
+- **The Data**: Highly sensitive patient history, genetic markers, and lab results.
+- **The Risk**: Uploading this to a public LLM violates HIPAA and GDPR.
+- **The Cube AI Solution**:
+ 1. The hospital's application connects to their private Cube AI instance.
+ 2. It verifies the instance acts as a "black box" via Remote Attestation.
+ 3. It sends the patient data.
+ 4. **Insight**: The model analyzes the data _in memory_ (which is encrypted at the hardware level).
+ 5. **Result**: The diagnosis is returned encrypted.
+ 6. **Aftermath**: Once the request is done, the data in memory is wiped. No logs, no training, no eyes on the data.
## Key Takeaway
@@ -138,4 +136,4 @@ By combining the power of open-weights models (like Llama 3, Mistral) with the h
---
-*Ready to secure your AI workloads? Check out our [Getting Started](https://cube.ultraviolet.rs/docs/getting-started) guide or explore the [Attestation Documentation](https://cube.ultraviolet.rs/docs/attestation).*
+_Ready to secure your AI workloads? Check out our [Getting Started](https://cube.ultraviolet.rs/docs/getting-started) guide or explore the [Attestation Documentation](https://cube.ultraviolet.rs/docs/attestation)._
diff --git a/src/content/blog/cube-ai-public-beta-launch.md b/src/content/blog/cube-ai-public-beta-launch.md
index 8d021c9..1e0ed4f 100644
--- a/src/content/blog/cube-ai-public-beta-launch.md
+++ b/src/content/blog/cube-ai-public-beta-launch.md
@@ -40,19 +40,23 @@ To achieve this deep hardware integration, Cube AI relies on the open-source **[
Cube AI is not merely a wrapper around existing LLM backends; it is a multi-tenant, microservices-based framework designed for scalability and secure governance.
### Multi-Tenancy and Domain Isolation
+
At the heart of the platform's scalability is the **SuperMQ** microservices architecture. It handles identity management natively and ensures that each domain acts as a strictly isolated workspace, preventing data leakage between different departments or organizations.


### High-Performance Inference Backends
+
We support two primary [inference backends](/blog/vllm-vs-ollama-in-cube-ai) to suit varying computational needs:
-* **Ollama**: Ideal for lightweight model management, local deployments, and rapid prototyping.
-* **vLLM**: Built for production environments requiring high throughput. Utilizing PagedAttention and continuous batching, vLLM maximizes memory efficiency and inference speed. When deployed within a Cube AI TEE, model weights and intermediate tensors remain encrypted throughout the execution cycle.
+
+- **Ollama**: Ideal for lightweight model management, local deployments, and rapid prototyping.
+- **vLLM**: Built for production environments requiring high throughput. Utilizing PagedAttention and continuous batching, vLLM maximizes memory efficiency and inference speed. When deployed within a Cube AI TEE, model weights and intermediate tensors remain encrypted throughout the execution cycle.

### The Cube Proxy & Security Guardrails
+
The Cube Proxy serves as the hardened gateway, providing an **OpenAI-compatible API**. This allows organizations to leverage existing Python or JavaScript SDKs effortlessly.
Beyond hardware isolation, our integrated Guardrails Service enforces proactive defense against prompt injection, output sanitization, and automatic **PII (Personally Identifiable Information) redaction** through Microsoft Presidio. Hot-reload capabilities ensure administrators can update safety rules with zero downtime.
@@ -73,9 +77,10 @@ Where `L_attestation` represents the time taken for remote verification and `L_e
## Tooling Ecosystem: IDEs and Secure RAG
We prioritize a "developer-first" approach to ensure seamless integration:
-* **IDE Support**: Native integration with "Continue" and OpenCode IDE ensures safe AI-assisted development without intellectual property leakage.
-* **Secure Embeddings (RAG)**: Generate embeddings entirely within the TEE. This ensures that sensitive documents are properly vectorized for Retrieval-Augmented Generation architectures without ever exposing raw text to an external provider.
-* **Secure Chat**: Provide users with an end-to-end encrypted chat interface powered by verifiable hardware attestation for maximum privacy.
+
+- **IDE Support**: Native integration with "Continue" and OpenCode IDE ensures safe AI-assisted development without intellectual property leakage.
+- **Secure Embeddings (RAG)**: Generate embeddings entirely within the TEE. This ensures that sensitive documents are properly vectorized for Retrieval-Augmented Generation architectures without ever exposing raw text to an external provider.
+- **Secure Chat**: Provide users with an end-to-end encrypted chat interface powered by verifiable hardware attestation for maximum privacy.

@@ -87,5 +92,5 @@ Cube AI represents a fundamental shift in how Large Language Models are deployed
The future of AI is confidential. Welcome to the Cube AI Beta!
-* **Get Started**: Visit [cube.ultraviolet.rs](https://cube.ultraviolet.rs) to launch your first confidential AI stack.
-* **Read the Docs**: Dive deep into the [Cube AI Documentation](https://cube.ultraviolet.rs/docs/) and [Getting Started Guide](https://cube.ultraviolet.rs/docs/user/getting-started/).
\ No newline at end of file
+- **Get Started**: Visit [cube.ultraviolet.rs](https://cube.ultraviolet.rs) to launch your first confidential AI stack.
+- **Read the Docs**: Dive deep into the [Cube AI Documentation](https://cube.ultraviolet.rs/docs/) and [Getting Started Guide](https://cube.ultraviolet.rs/docs/user/getting-started/).
diff --git a/src/content/blog/prism-public-beta-launch.md b/src/content/blog/prism-public-beta-launch.md
index c9e4bb7..17cf973 100644
--- a/src/content/blog/prism-public-beta-launch.md
+++ b/src/content/blog/prism-public-beta-launch.md
@@ -15,14 +15,13 @@ featured: false
category: announcement
---
-
-In an era where AI is transforming industries, the challenge of **data privacy** remains a significant hurdle. Organizations often find themselves choosing between the power of state-of-the-art AI and the security of their most sensitive data.
+In an era where AI is transforming industries, the challenge of **data privacy** remains a significant hurdle. Organizations often find themselves choosing between the power of state-of-the-art AI and the security of their most sensitive data.
Today, we are thrilled to bridge that gap with the launch of the [**Prism AI Public Beta**](https://cloud.prism.ultraviolet.rs/).
-[Prism AI](https://prism.ultraviolet.rs) is a web-based SaaS platform designed to make **Confidential Computing** accessible, powerful, and truly collaborative. It provides an enterprise-ready interface for orchestrating **zero-trust collaboration** via **Secure Multiparty Computation (SMPC)**, powered by Trusted Execution Environments (TEEs).
+[Prism AI](https://prism.ultraviolet.rs) is a web-based SaaS platform designed to make **Confidential Computing** accessible, powerful, and truly collaborative. It provides an enterprise-ready interface for orchestrating **zero-trust collaboration** via **Secure Multiparty Computation (SMPC)**, powered by Trusted Execution Environments (TEEs).
-Through the technical guarantees of hardware-level isolation, Prism AI allows multiple organizations to jointly train models or run private inferences in a shared TEE. Critically, raw datasets and proprietary algorithms are technically shielded from *every* other party in the computation—including collaborators and the cloud provider itself—ensuring absolute privacy throughout the entire lifecycle. Built on the open-source **Cocos AI** foundation, Prism AI turns trust from a policy into a physical law.
+Through the technical guarantees of hardware-level isolation, Prism AI allows multiple organizations to jointly train models or run private inferences in a shared TEE. Critically, raw datasets and proprietary algorithms are technically shielded from _every_ other party in the computation—including collaborators and the cloud provider itself—ensuring absolute privacy throughout the entire lifecycle. Built on the open-source **Cocos AI** foundation, Prism AI turns trust from a policy into a physical law.
@@ -50,23 +49,24 @@ Transparency is fundamental to trust. That's why the core components of Prism AI
Prism AI is already being used to solve critical privacy challenges in high-stakes industries:
-* **Healthcare**: Training diagnostic models on patient records across multiple hospitals without violating GDPR or HIPAA.
-* **Finance**: Collaborative fraud detection and risk assessment across institutions without sharing proprietary data.
-* **Governments**: Enabling secure data sharing between agencies for public safety and research while maintaining strict data sovereignty.
+- **Healthcare**: Training diagnostic models on patient records across multiple hospitals without violating GDPR or HIPAA.
+- **Finance**: Collaborative fraud detection and risk assessment across institutions without sharing proprietary data.
+- **Governments**: Enabling secure data sharing between agencies for public safety and research while maintaining strict data sovereignty.
## Join the Mission for Secure AI
We’re on a mission to make privacy the default for artificial intelligence, and we’d love for you to be a part of it. The Prism AI Public Beta is officially live, and we can’t wait to see what you build.
-* 🚀 **Get Started for Free**: Sign up at [cloud.prism.ultraviolet.rs](https://cloud.prism.ultraviolet.rs/) and start running your first confidential computations.
-* 📚 **Explore the Docs**: Dive into the technical details at [docs.prism.ultraviolet.rs](https://prism.ultraviolet.rs/docs/).
-* 🤝 **Join the Community**: Follow our progress on [GitHub](https://github.com/ultravioletrs/cocos) and help us shape the next generation of privacy-preserving AI.
+- 🚀 **Get Started for Free**: Sign up at [cloud.prism.ultraviolet.rs](https://cloud.prism.ultraviolet.rs/) and start running your first confidential computations.
+- 📚 **Explore the Docs**: Dive into the technical details at [docs.prism.ultraviolet.rs](https://prism.ultraviolet.rs/docs/).
+- 🤝 **Join the Community**: Follow our progress on [GitHub](https://github.com/ultravioletrs/cocos) and help us shape the next generation of privacy-preserving AI.
The era of choosing between powerful AI and strict privacy is finally over. With Prism AI, you can have both—fearlessly.
---
**Learn More:**
+
- 🌐 [Prism AI Website](https://prism.ultraviolet.rs/)
- [Cocos AI Documentation](https://cocos.ai/docs/)
- [Ultraviolet RS](https://ultraviolet.rs/)
diff --git a/src/content/blog/privacy-paradox-confidential-computing.md b/src/content/blog/privacy-paradox-confidential-computing.md
index 4094f04..2d9efcf 100644
--- a/src/content/blog/privacy-paradox-confidential-computing.md
+++ b/src/content/blog/privacy-paradox-confidential-computing.md
@@ -6,7 +6,8 @@ description: "Discover why AI teams need Confidential Computing to protect sensi
author:
name: "Jilks Smith"
picture: "https://avatars.githubusercontent.com/u/41241359?v=4"
-tags: [confidential-computing, ai-security, privacy, tee, enterprise-ai, cube ai]
+tags:
+ [confidential-computing, ai-security, privacy, tee, enterprise-ai, cube ai]
image: /img/privacy-paradox/privacy-paradox.jpg
ogImage:
url: /img/privacy-paradox/privacy-paradox.jpg
@@ -14,7 +15,6 @@ category: blog
date: 2026-02-16
---
-
As organizations race to integrate Large Language Models into their operations, they're simultaneously exposing intellectual property, customer records, financial models and many more assets to unprecedented vulnerabilities. **The problem? Traditional software architectures are structurally inadequate for the AI era.**
@@ -137,8 +137,6 @@ Remote attestation proves a workload is running in a genuine TEE:
This ensures keys are never released unless the environment is proven secure and untampered. If malware is injected, the hash changes, verification fails, and keys remain locked.
-
-
## Industry Applications
### Healthcare: Clinical AI Development
@@ -170,19 +168,23 @@ This ensures keys are never released unless the environment is proven secure and
Organizations generally face two paths when adopting Confidential Computing:
### Option 1: The Hard Way (Raw Infrastructure)
+
You can build directly on top of raw Confidential VMs (CVMs) or Confidential Containers (CoCo).
**Confidential VMs (CVMs)**
-* **Approach**: "Lift and Shift"—run entire VMs inside TEEs (AMD SEV-SNP).
-* **Pros**: Works with legacy applications.
-* **Cons**: Large Trusted Computing Base (TCB); you are responsible for managing attestation and key exchanges.
+
+- **Approach**: "Lift and Shift"—run entire VMs inside TEEs (AMD SEV-SNP).
+- **Pros**: Works with legacy applications.
+- **Cons**: Large Trusted Computing Base (TCB); you are responsible for managing attestation and key exchanges.
**Confidential Containers (CoCo)**
-* **Approach**: Run Kubernetes Pods in lightweight microVM TEEs.
-* **Pros**: Smaller TCB and better isolation.
-* **Cons**: Requires complex Kubernetes setup and deep expertise in attestation flows.
+
+- **Approach**: Run Kubernetes Pods in lightweight microVM TEEs.
+- **Pros**: Smaller TCB and better isolation.
+- **Cons**: Requires complex Kubernetes setup and deep expertise in attestation flows.
### Option 2: The Smart Way (Cube AI Platform)
+
The alternative is to use a platform that abstracts this complexity. **Cube AI** bridges the gap, offering the security of Option 1 with the usability of a standard cloud service.
**1. Zero-Refactor Integration**
@@ -193,8 +195,9 @@ As detailed in our [comparison of vLLM and Ollama](/blogs/vllm-vs-ollama-in-cube
**3. Automated Security & Compliance**
Cube AI handles the heavy lifting of Confidential Computing:
-* **Attested TLS (aTLS)**: Automatically terminates connections inside the enclave.
-* **Built-in Guardrails**: Enforces data policies before requests reach the model, preventing PII leakage.
+
+- **Attested TLS (aTLS)**: Automatically terminates connections inside the enclave.
+- **Built-in Guardrails**: Enforces data policies before requests reach the model, preventing PII leakage.
By solving the "usability paradox," Cube AI allows organizations to protect their data immediately, rather than spending months building custom security infrastructure.
@@ -215,8 +218,8 @@ Confidential Computing is the "HTTPS for AI"—the protocol that builds the trus
1. **Traditional security fails AI**: The "two-state" model (at rest, in transit) leaves data-in-use vulnerable—the exact state AI requires
2. **Hardware-based isolation is essential**: TEEs provide mathematical guarantees that software-based security cannot
3. **Regulatory pressure is accelerating**: The EU AI Act and US legislation increasingly demand "privacy by design"
-4**The question has changed**: From "Can we afford to implement this?" to "Can we survive ignoring it?"
+ 4**The question has changed**: From "Can we afford to implement this?" to "Can we survive ignoring it?"
---
-*Ready to secure your AI workloads? Learn more about [Cube AI's confidential computing architecture](https://cube.ultraviolet.rs/docs/architecture) or explore our [developer guides](https://cube.ultraviolet.rs/docs/developer-guide) to get started.*
\ No newline at end of file
+_Ready to secure your AI workloads? Learn more about [Cube AI's confidential computing architecture](https://cube.ultraviolet.rs/docs/architecture) or explore our [developer guides](https://cube.ultraviolet.rs/docs/developer-guide) to get started._
diff --git a/src/content/blog/securing-trust-rats-and-attested-tls.md b/src/content/blog/securing-trust-rats-and-attested-tls.md
index c34dcc5..1839563 100644
--- a/src/content/blog/securing-trust-rats-and-attested-tls.md
+++ b/src/content/blog/securing-trust-rats-and-attested-tls.md
@@ -10,7 +10,7 @@ tags: [confidential-computing, attestation, aTLS, cocos ai]
date: 2026-02-19
image: "/img/securing-trust-rats-and-attested-tls/overview.png"
ogImage:
- url: "/img/securing-trust-rats-and-attested-tls/overview.png"
+ url: "/img/securing-trust-rats-and-attested-tls/overview.png"
---
In this article, we'll explore **Remote ATtestation procedureS (RATS)**,
@@ -42,61 +42,61 @@ RATS define several key **roles** in this process:
1\. The **Attester** is the entity that generates **Evidence** about its
own operational state.
-- Runs in a TEE, device, confidential VM, or enclave.
-- Produces measurements like firmware hashes, kernel versions, or PCR
- values from a TPM.
-- Uses **Attestation Keys** bound to hardware or firmware to sign
- this evidence.
+- Runs in a TEE, device, confidential VM, or enclave.
+- Produces measurements like firmware hashes, kernel versions, or PCR
+ values from a TPM.
+- Uses **Attestation Keys** bound to hardware or firmware to sign
+ this evidence.
2\. The **Verifier** evaluates the **Evidence** received from the
Attester.
-- Uses **Endorsements** (e.g., TPM vendor certificates) and
- **Reference Values** (known-good measurements) to check
- validity.
-- Produces an **Attestation Result** - a signed statement about the
- Attester's trustworthiness.
-- Often operated by a trusted authority, like a cloud provider or
- security service.
+- Uses **Endorsements** (e.g., TPM vendor certificates) and
+ **Reference Values** (known-good measurements) to check
+ validity.
+- Produces an **Attestation Result** - a signed statement about the
+ Attester's trustworthiness.
+- Often operated by a trusted authority, like a cloud provider or
+ security service.
3\. The **Relying Party** consumes the **Attestation Result** from the
Verifier and **makes trust decisions**. Examples:
-- A cloud orchestration platform deciding whether to schedule
- workloads on a VM.
-- A client deciding whether to connect to a server running inside a
- TEE.
-- Does **not** need to understand raw evidence, only the Verifier's
- signed results.
+- A cloud orchestration platform deciding whether to schedule
+ workloads on a VM.
+- A client deciding whether to connect to a server running inside a
+ TEE.
+- Does **not** need to understand raw evidence, only the Verifier's
+ signed results.
4\. The **Endorser** vouches for the trustworthiness of an **Attesting
Environment** by providing **Endorsements**. Typically the hardware or
firmware vendor. Examples:
-- Intel SGX/TDX provisioning services signing enclave keys.
-- AMD providing ARK and ASK certificates for SEV-SNP.
+- Intel SGX/TDX provisioning services signing enclave keys.
+- AMD providing ARK and ASK certificates for SEV-SNP.
5\. The **Reference Value Provider** supplies **Reference
Values** - known-good measurements used by the Verifier. Ensures the
Verifier knows what a "trusted state" looks like. Examples:
-- BIOS vendors providing approved firmware hashes.
-- Container registries providing signed digests of container
- images.
+- BIOS vendors providing approved firmware hashes.
+- Container registries providing signed digests of container
+ images.
6\. The **Verifier Owner** defines **appraisal policies** for a device
or environment. Determines **what evidence matters** and **what
constitutes a trustworthy state**. Could be:
-- A cloud tenant defining which OS images are approved.
-- An IoT fleet operator defining minimum firmware
- requirements.
+- A cloud tenant defining which OS images are approved.
+- An IoT fleet operator defining minimum firmware
+ requirements.
7\. **Relying Party Owner** (optional, less explicit). Some deployments
separate the **Relying Party** from the **Relying Party Owner**:
-- The **Relying Party** executes policy decisions.
-- The **Owner** defines those policies.
+- The **Relying Party** executes policy decisions.
+- The **Owner** defines those policies.
This distinction matters in multi-tenant or cloud scenarios where
**service providers enforce policies defined by customers**.
@@ -139,9 +139,9 @@ it**. Whether you're securing IoT devices, protecting cloud workloads,
or enabling confidential computing, RATS provide the architectural
foundation for verifiable trust at scale.
-### From TLS to aTLS: Embedding Trust into Secure Channels
+### From TLS to aTLS: Embedding Trust into Secure Channels
-#### TLS Recap - The Foundation of Secure Communication
+#### TLS Recap - The Foundation of Secure Communication
Transport Layer Security (**TLS**) is the backbone of secure
communication on the internet. It establishes an encrypted channel
@@ -168,7 +168,7 @@ outdated firmware or malicious code, and the client has no way of
knowing. In highly sensitive environments - like confidential
computing, IoT, and secure AI workloads - this isn't enough.
-#### What Is aTLS? - Attested TLS
+#### What Is aTLS? - Attested TLS
**Attested TLS (aTLS)** extends TLS by embedding **remote attestation**
into the TLS handshake, enabling endpoints to prove not just **who**
@@ -179,17 +179,17 @@ extension - includes **attestation evidence** or **attestation
results**. This allows one party to verify not only the cryptographic
identity of the other, but also:
-- Whether it's running in a **Trusted Execution Environment
- (TEE)**.
-- Whether the **firmware and software stack** match known-good
- configurations.
-- Whether **security policies** are being enforced.
+- Whether it's running in a **Trusted Execution Environment
+ (TEE)**.
+- Whether the **firmware and software stack** match known-good
+ configurations.
+- Whether **security policies** are being enforced.
This builds on the **RATS architecture** defined in [RFC
9334](https://datatracker.ietf.org/doc/rfc9334/), which standardizes how evidence, endorsements, and
attestation results are produced and consumed.
-#### How aTLS Uses RATS
+#### How aTLS Uses RATS
aTLS doesn't invent a new attestation framework - it **integrates RATS
into TLS**. The flow depends on which RATS model is used. The Passport
@@ -219,22 +219,22 @@ This flexibility makes aTLS suitable for cloud workloads, IoT
deployments, and secure AI environments - each with different trust
relationships.
-#### The Bigger Picture
+#### The Bigger Picture
By combining **TLS** with **RATS**, aTLS transforms "secure
communication" into **"secure and verifiable communication."** It
ensures that:
-- **Who you're talking to** is verified.
-- **What they're running** is trustworthy.
-- **How your data is handled** respects your security
- policies.
+- **Who you're talking to** is verified.
+- **What they're running** is trustworthy.
+- **How your data is handled** respects your security
+ policies.
This is especially critical for **confidential computing**, where trust
must extend beyond identities to include the **state of the runtime
environment**.
-### Real-World Example - Confidential Computing & AI in COCOS AI
+### Real-World Example - Confidential Computing & AI in COCOS AI
**Cocos AI** is an advanced platform that leverages **Confidential
Computing** and **Trusted Execution Environments (TEEs)** to enable
@@ -291,6 +291,7 @@ tlsConfig := &tls.Config{
},
}
```
+
Note: setting `InsecureSkipVerify: true` disables Go's built‑in certificate
verification. In this aTLS setup, that is intentional because
`VerifyPeerCertificate` replaces the default verifier so it can both
@@ -302,12 +303,11 @@ implementing full certificate and hostname/SAN validation in your own
`VerifyPeerCertificate` callback, otherwise TLS certificate checks will
effectively be disabled.
-
The behavior of the `VerifyPeerCertificate` function, which verifies the attestation extension,
depends on the underlying platform, such as **AMD SEV-SNP** or
**Intel TDX**.
-### Conclusion
+### Conclusion
As workloads move to **untrusted environments** like public clouds and
edge platforms, securing communication is no longer just about
@@ -331,4 +331,4 @@ COCOS AI ensures that every connection is both **encrypted** and
As technologies like confidential computing and secure AI continue to
evolve, approaches like **RATS + aTLS** are set to become a cornerstone
of **next-generation security architectures** - enabling us to build
-systems where trust is **cryptographically enforced**, not just assumed.
\ No newline at end of file
+systems where trust is **cryptographically enforced**, not just assumed.
diff --git a/src/content/blog/tee-tls-privacy.md b/src/content/blog/tee-tls-privacy.md
index 35728a3..42ebb56 100644
--- a/src/content/blog/tee-tls-privacy.md
+++ b/src/content/blog/tee-tls-privacy.md
@@ -10,11 +10,12 @@ authors:
picture: "https://avatars.githubusercontent.com/u/7561155?v=4"
- name: "Sammy Oina"
picture: "https://avatars.githubusercontent.com/u/44265300?v=4"
-tags: [confidential-computing, attestation, aTLS, cocos ai, security analysis, RATS]
+tags:
+ [confidential-computing, attestation, aTLS, cocos ai, security analysis, RATS]
date: 2026-02-27
image: "/img/tls-tee-privacy/cover_minimal.png"
ogImage:
- url: "/img/tls-tee-privacy/cover_minimal.png"
+ url: "/img/tls-tee-privacy/cover_minimal.png"
---
## Introduction
@@ -175,11 +176,11 @@ For AMD SEV-SNP, the `Attestation()` call results in a hardware-signed report vi
The attestation report is embedded into the X.509 certificate as a custom extension identified by a platform-specific OID:
-| Platform | OID |
-|:---------------|:-----------------|
-| SEV-SNP + TPM | `2.99999.1.0` |
-| Azure CVM | `2.99999.1.1` |
-| Intel TDX | `2.99999.1.2` |
+| Platform | OID |
+| :------------ | :------------ |
+| SEV-SNP + TPM | `2.99999.1.0` |
+| Azure CVM | `2.99999.1.1` |
+| Intel TDX | `2.99999.1.2` |
```go
extension := pkix.Extension{
@@ -391,13 +392,13 @@ Beyond the fundamental binding gap, the IETF analysis flagged two implementation
The table below summarizes how Cocos AI compares to other implementations analyzed by Sardar et al.:
-| Implementation | Binding Mechanism | Platform | Nonce Delivery | Vulnerable to Relay? |
-|:---|:---|:---|:---|:---|
-| **Cocos AI** | `SHA3-512(pubKey ‖ attestation_nonce)` | SEV-SNP, TDX | SNI extension | Yes |
-| **Meta Private Processing** | Client's TLS nonce in report_data | SEV-SNP | TLS nonce (no separate attestation nonce) | Yes (also lacks freshness) |
-| **Edgeless Contrast** | `Hash(attestation_nonce ‖ pubKey)` | Intel TDX | ALPN extension | Yes |
-| **CCC PoC** | Per draft-fossati-seat-early-attestation | Various | TLS extension | Yes |
-| **Proposed Mitigation (Sardar et al.)** | Cryptographic binder in CertificateVerify | Any | TLS extension | Achieves Level 2 |
+| Implementation | Binding Mechanism | Platform | Nonce Delivery | Vulnerable to Relay? |
+| :-------------------------------------- | :---------------------------------------- | :----------- | :---------------------------------------- | :------------------------- |
+| **Cocos AI** | `SHA3-512(pubKey ‖ attestation_nonce)` | SEV-SNP, TDX | SNI extension | Yes |
+| **Meta Private Processing** | Client's TLS nonce in report_data | SEV-SNP | TLS nonce (no separate attestation nonce) | Yes (also lacks freshness) |
+| **Edgeless Contrast** | `Hash(attestation_nonce ‖ pubKey)` | Intel TDX | ALPN extension | Yes |
+| **CCC PoC** | Per draft-fossati-seat-early-attestation | Various | TLS extension | Yes |
+| **Proposed Mitigation (Sardar et al.)** | Cryptographic binder in CertificateVerify | Any | TLS extension | Achieves Level 2 |
Notable: Meta's implementation was audited by Trail of Bits, who did not find the relay attack. As Sardar et al. note, no formal methods were used in that review, underscoring the value of symbolic analysis tools like ProVerif.
@@ -464,4 +465,4 @@ In the meantime, we encourage all users of Confidential Computing platforms to:
3. Define strict attestation policies that validate all available report fields.
4. Monitor the IETF SEAT and UFMRG working groups for updates on standardized attested TLS protocols.
-The path forward is clear: stronger binding, formal verification, and community collaboration. We are committed to getting there.
\ No newline at end of file
+The path forward is clear: stronger binding, formal verification, and community collaboration. We are committed to getting there.
diff --git a/src/content/blog/vllm-vs-ollama-in-cube-ai.md b/src/content/blog/vllm-vs-ollama-in-cube-ai.md
index e510b9a..d449609 100644
--- a/src/content/blog/vllm-vs-ollama-in-cube-ai.md
+++ b/src/content/blog/vllm-vs-ollama-in-cube-ai.md
@@ -85,7 +85,7 @@ When measuring single-request latency in isolation, Ollama performs well for ind
vLLM shines under load due to its batching efficiency. Because it processes multiple requests simultaneously, the amortized latency per request can actually decrease as more requests arrive — the GPU processes a batch of requests in roughly the same time it would take to process a single one.
**Important Insight:**
-If your system experiences burst traffic patterns — where many requests arrive in a short window — vLLM's latency often *improves* relative to sequential engines. While a sequential engine queues requests and processes them one at a time (leading to linearly increasing wait times), vLLM absorbs the burst into a batch and processes it as a unit.
+If your system experiences burst traffic patterns — where many requests arrive in a short window — vLLM's latency often _improves_ relative to sequential engines. While a sequential engine queues requests and processes them one at a time (leading to linearly increasing wait times), vLLM absorbs the burst into a batch and processes it as a unit.
### Memory Usage
@@ -106,10 +106,10 @@ Ollama takes a different approach, handling memory management automatically base
**Trade-off:**
-| Goal | Better Choice |
-| :--- | :--- |
-| Deterministic GPU planning | vLLM |
-| Operational simplicity | Ollama |
+| Goal | Better Choice |
+| :------------------------- | :------------ |
+| Deterministic GPU planning | vLLM |
+| Operational simplicity | Ollama |
---
@@ -161,12 +161,12 @@ One of Ollama's most significant advantages over vLLM is its ability to manage m
Ollama is designed to run across a wide range of hardware configurations, which makes it far more versatile than vLLM in terms of deployment targets:
-| Capability | Ollama |
-| :--- | :--- |
-| CPU-only | Supported |
-| NVIDIA GPU | Supported |
+| Capability | Ollama |
+| :------------- | :-------- |
+| CPU-only | Supported |
+| NVIDIA GPU | Supported |
| AMD GPU (ROCm) | Supported |
-| Edge devices | Supported |
+| Edge devices | Supported |
This broad hardware compatibility makes Ollama extremely attractive for deployment scenarios where GPU availability cannot be guaranteed. Confidential Virtual Machines (CVMs) running in Trusted Execution Environments may not have GPU passthrough configured, edge inference nodes may be running on commodity ARM hardware, on-premises deployments may need to operate on whatever hardware is available, and secure or air-gapped environments may have strict procurement constraints that limit GPU options. In all of these cases, Ollama's ability to run on CPU-only nodes provides a viable path to deploying LLM inference without GPU dependencies.
@@ -206,14 +206,14 @@ When building a multi-tenant SaaS product where hundreds or thousands of concurr
Understanding the cost profile of each backend is essential for making financially sound infrastructure decisions, especially as LLM workloads grow from experimental to production scale.
-| Dimension | vLLM | Ollama |
-| :--- | :--- | :--- |
-| **Upfront Cost** | High (requires NVIDIA GPUs, GPU orchestration) | Low (runs on CPU, standard instances) |
-| **Cost per Token** | Lower at scale (continuous batching) | Higher under load (sequential processing) |
-| **Idle Cost** | Expensive (reserved GPU capacity) | Minimal (standard compute) |
-| **Best For** | Sustained high traffic, predictable workloads | Early-stage, sporadic traffic, PoC |
-| **Scaling Model** | Vertical (GPU utilization) | Horizontal (more instances) |
-| **Infrastructure** | Specialized (NVIDIA runtime, GPU drivers) | Standard (no specialized requirements) |
+| Dimension | vLLM | Ollama |
+| :----------------- | :--------------------------------------------- | :---------------------------------------- |
+| **Upfront Cost** | High (requires NVIDIA GPUs, GPU orchestration) | Low (runs on CPU, standard instances) |
+| **Cost per Token** | Lower at scale (continuous batching) | Higher under load (sequential processing) |
+| **Idle Cost** | Expensive (reserved GPU capacity) | Minimal (standard compute) |
+| **Best For** | Sustained high traffic, predictable workloads | Early-stage, sporadic traffic, PoC |
+| **Scaling Model** | Vertical (GPU utilization) | Horizontal (more instances) |
+| **Infrastructure** | Specialized (NVIDIA runtime, GPU drivers) | Standard (no specialized requirements) |
### vLLM Cost Profile
@@ -278,18 +278,18 @@ This HAL integration enables bare-metal CVM deployments where Docker is not avai
## Side-by-Side Comparison
-| Dimension | Ollama | vLLM |
-| :--- | :--- | :--- |
-| **Version** | 0.12.3 | 0.10.2 |
-| **API** | Native `/api/*` | OpenAI `/v1/*` |
-| **GPU** | Optional | Required (NVIDIA) |
-| **CPU Support** | Yes | No |
-| **Model Mgmt** | Runtime | Startup |
-| **Batching** | Sequential | Continuous |
-| **Default Model** | `llama3.2:3b` | `DialoGPT-medium` |
-| **Memory Config** | Automatic | Explicit |
-| **Guardrails** | Native adapter | Via OpenAI |
-| **Compose Profile** | default | vllm |
+| Dimension | Ollama | vLLM |
+| :------------------ | :-------------- | :---------------- |
+| **Version** | 0.12.3 | 0.10.2 |
+| **API** | Native `/api/*` | OpenAI `/v1/*` |
+| **GPU** | Optional | Required (NVIDIA) |
+| **CPU Support** | Yes | No |
+| **Model Mgmt** | Runtime | Startup |
+| **Batching** | Sequential | Continuous |
+| **Default Model** | `llama3.2:3b` | `DialoGPT-medium` |
+| **Memory Config** | Automatic | Explicit |
+| **Guardrails** | Native adapter | Via OpenAI |
+| **Compose Profile** | default | vllm |
---
@@ -333,4 +333,4 @@ That is the power of backend modularity, and it is built into the foundation of
---
-*Explore Cube AI's backend architecture in the [Deployment Guide](https://cube.ultraviolet.rs/docs/getting-started) or learn more about [Cube AI Architecture](https://cube.ultraviolet.rs/docs/architecture).*
+_Explore Cube AI's backend architecture in the [Deployment Guide](https://cube.ultraviolet.rs/docs/getting-started) or learn more about [Cube AI Architecture](https://cube.ultraviolet.rs/docs/architecture)._
diff --git a/src/content/config.ts b/src/content/config.ts
index d0809f1..04f8319 100644
--- a/src/content/config.ts
+++ b/src/content/config.ts
@@ -1,29 +1,35 @@
-import { defineCollection, z } from 'astro:content';
+import { defineCollection, z } from "astro:content";
const authorSchema = z.object({
- name: z.string(),
- picture: z.string().optional(),
+ name: z.string(),
+ picture: z.string().optional(),
});
const blog = defineCollection({
- type: 'content',
- schema: z.object({
- title: z.string(),
- description: z.string().optional(),
- excerpt: z.string().optional(),
- author: authorSchema.optional(),
- authors: z.array(authorSchema).optional(),
- date: z.coerce.date(),
- image: z.string().optional(),
- coverImage: z.string().optional(),
- ogImage: z.union([z.string(), z.object({ url: z.string() })]).optional(),
- tags: z.array(z.string()).optional(),
- featured: z.boolean().optional(),
- category: z.string().optional(),
- }),
+ type: "content",
+ schema: z.object({
+ title: z.string(),
+ description: z.string().optional(),
+ excerpt: z.string().optional(),
+ author: authorSchema.optional(),
+ authors: z.array(authorSchema).optional(),
+ date: z.coerce.date(),
+ image: z.string().optional(),
+ coverImage: z.string().optional(),
+ ogImage: z.union([z.string(), z.object({ url: z.string() })]).optional(),
+ tags: z.array(z.string()).optional(),
+ featured: z.boolean().optional(),
+ category: z.string().optional(),
+ }),
});
-const industries = defineCollection({ type: 'content', schema: z.object({ title: z.string() }) });
-const solutions = defineCollection({ type: 'content', schema: z.object({ title: z.string() }) });
+const industries = defineCollection({
+ type: "content",
+ schema: z.object({ title: z.string() }),
+});
+const solutions = defineCollection({
+ type: "content",
+ schema: z.object({ title: z.string() }),
+});
export const collections = { blog, industries, solutions };
diff --git a/src/pages/blog/[...slug].astro b/src/pages/blog/[...slug].astro
index 2fc4151..e99f8f3 100644
--- a/src/pages/blog/[...slug].astro
+++ b/src/pages/blog/[...slug].astro
@@ -1,13 +1,15 @@
---
-import { getCollection, render } from 'astro:content';
-import Layout from '../../layouts/Layout.astro';
-import Header from '../../components/Header.astro';
-import Footer from '../../components/Footer.astro';
-import ProductCTA from '../../components/ProductCTA.astro';
+import { getCollection, render } from "astro:content";
+import Layout from "../../layouts/Layout.astro";
+import Header from "../../components/Header.astro";
+import Footer from "../../components/Footer.astro";
+import ProductCTA from "../../components/ProductCTA.astro";
export async function getStaticPaths() {
- const allPosts = await getCollection('blog');
- const sorted = allPosts.sort((a, b) => new Date(b.data.date).getTime() - new Date(a.data.date).getTime());
+ const allPosts = await getCollection("blog");
+ const sorted = allPosts.sort(
+ (a, b) => new Date(b.data.date).getTime() - new Date(a.data.date).getTime(),
+ );
return sorted.map((post, idx) => {
const next: typeof sorted = [];
for (let i = 1; next.length < 3; i++) {
@@ -21,16 +23,28 @@ const { post, nextPosts } = Astro.props;
const { Content } = await render(post);
function fmtDate(d: Date) {
- return new Date(d).toLocaleDateString('en-US', { year: 'numeric', month: 'long', day: 'numeric' });
+ return new Date(d).toLocaleDateString("en-US", {
+ year: "numeric",
+ month: "long",
+ day: "numeric",
+ });
}
-const coverImage = post.data.image || post.data.coverImage || `/img/blog/${post.slug}.png`;
-const eyebrow = post.data.category || (post.data.tags || [])[0] || 'Blog';
-const authors: { name: string; picture?: string }[] =
- post.data.authors?.length ? post.data.authors : post.data.author ? [post.data.author] : [];
+const coverImage =
+ post.data.image || post.data.coverImage || `/img/blog/${post.slug}.png`;
+const eyebrow = post.data.category || (post.data.tags || [])[0] || "Blog";
+const authors: { name: string; picture?: string }[] = post.data.authors?.length
+ ? post.data.authors
+ : post.data.author
+ ? [post.data.author]
+ : [];
function getPostAuthors(p: typeof post): { name: string; picture?: string }[] {
- return p.data.authors?.length ? p.data.authors : p.data.author ? [p.data.author] : [];
+ return p.data.authors?.length
+ ? p.data.authors
+ : p.data.author
+ ? [p.data.author]
+ : [];
}
---
@@ -49,21 +63,32 @@ function getPostAuthors(p: typeof post): { name: string; picture?: string }[] {
diff --git a/src/pages/company/index.astro b/src/pages/company/index.astro
index b74c8a2..c653d5e 100644
--- a/src/pages/company/index.astro
+++ b/src/pages/company/index.astro
@@ -1,3 +1,3 @@
---
-return Astro.redirect('/company/about', 301);
+return Astro.redirect("/company/about", 301);
---
diff --git a/src/pages/contact.astro b/src/pages/contact.astro
index 105437e..7c3b302 100644
--- a/src/pages/contact.astro
+++ b/src/pages/contact.astro
@@ -1,3 +1,3 @@
---
-return Astro.redirect('/company/contact', 301);
+return Astro.redirect("/company/contact", 301);
---
diff --git a/src/pages/cube/privacy.astro b/src/pages/cube/privacy.astro
index bb14dcf..effbfaf 100644
--- a/src/pages/cube/privacy.astro
+++ b/src/pages/cube/privacy.astro
@@ -1,129 +1,173 @@
---
-import Layout from '../../layouts/Layout.astro';
-import Header from '../../components/Header.astro';
-import Footer from '../../components/Footer.astro';
+import Layout from "../../layouts/Layout.astro";
+import Header from "../../components/Header.astro";
+import Footer from "../../components/Footer.astro";
const title = "Cube AI Privacy Policy - Ultraviolet";
-const description = "Privacy Policy for Cube AI. Learn how Ultraviolet collects, uses, and protects your personal data when using the Cube AI platform.";
+const description =
+ "Privacy Policy for Cube AI. Learn how Ultraviolet collects, uses, and protects your personal data when using the Cube AI platform.";
---
-
-
-
-
-
-
-
- Privacy Policy
-
-
-
-
- This Privacy Policy explains how Ultraviolet ("we," "us," or
- "our") collects, uses, and protects your personal data when
- you use the Cube AI platform ("Platform"). We are committed to
- complying with the General Data Protection Regulation (GDPR)
- and other applicable privacy laws.
-
-
-
1. Who We Are
-
- Ultraviolet is a company registered in Serbia with
- headquarters at Bulevar Arsenija Carnojevica 103, 11000
- Belgrade, Serbia. We are the data controller for your personal
- data when you create and use an account on our Platform.
-
-
-
2. WHAT DATA WE COLLECT
-
-
Full name
-
Email address
-
Company name
-
User credentials and login metadata (IP, device, browser)
-
Payment and billing information (processed via third-party payment processor)
-
Technical usage data (e.g., API usage, project activity)
-
-
-
3. HOW WE USE YOUR DATA
-
We use your data to:
-
-
Provide access to and operate the Platform
-
Communicate with you regarding your account and service updates
-
Provide support and respond to inquiries
-
Process payments and manage subscriptions
-
Improve the Platform and monitor usage
-
Comply with legal obligations
-
-
-
4. LEGAL BASIS FOR PROCESSING
-
We process your data on the following legal bases:
-
-
Contractual necessity – to deliver the services you signed up for
-
Legitimate interests – to maintain and improve our services
-
Legal obligation – to meet accounting or regulatory requirements
-
Consent - where applicable (e.g., marketing communications)
-
-
-
5. DATA RETENTION
-
- We retain your personal data for as long as your account is
- active and for a limited period thereafter to comply with
- legal and operational obligations. Data may be anonymized for
- analytics.
-
-
-
6. DATA SHARING AND SUBPROCESSORS
-
We do not sell or share your personal data with third parties, except:
-
-
With cloud hosting providers, email service providers, and payment processors strictly as needed to provide the Platform
-
With public authorities if legally required
-
-
All subprocessors are GDPR-compliant and under data processing agreements.
-
-
7. DATA TRANSFERS
-
- Your data may be processed or stored in the EU or other
- jurisdictions with adequate protection standards. Where
- applicable, we use Standard Contractual Clauses (SCCs) to
- safeguard cross-border data transfers.
-
-
-
8. YOUR RIGHTS UNDER GDPR
-
You have the right to:
-
-
Access your personal data
-
Correct or update inaccuracies
-
Request deletion ("right to be forgotten")
-
Restrict or object to processing
-
Data portability
-
Lodge a complaint with a data protection authority
- We implement appropriate technical and organizational measures
- to protect your data, including encryption, access control,
- and regular security reviews.
-
-
-
10. CHANGES TO THIS POLICY
-
- We may update this Privacy Policy from time to time. We will
- notify you via email or through the Platform when significant
- changes occur.
-
-
-
11. CONTACT
-
- If you have questions or concerns about this policy or how we
- handle your data, contact us at: privacy@ultraviolet.rs
- Ultraviolet, Bulevar Arsenija Carnojevica 103, 11000 Belgrade, Serbia.
-
-
-
-
-
-
+
+
+
+
+
+
+
+ Privacy Policy
+
+
+
+
+ This Privacy Policy explains how Ultraviolet ("we," "us," or "our")
+ collects, uses, and protects your personal data when you use the Cube
+ AI platform ("Platform"). We are committed to complying with the
+ General Data Protection Regulation (GDPR) and other applicable privacy
+ laws.
+
+
+
1. Who We Are
+
+ Ultraviolet is a company registered in Serbia with headquarters at
+ Bulevar Arsenija Carnojevica 103, 11000 Belgrade, Serbia. We are the
+ data controller for your personal data when you create and use an
+ account on our Platform.
+
+
+
+ 2. WHAT DATA WE COLLECT
+
+
+
Full name
+
Email address
+
Company name
+
User credentials and login metadata (IP, device, browser)
+
+ Payment and billing information (processed via third-party payment
+ processor)
+
+
Technical usage data (e.g., API usage, project activity)
+
+
+
+ 3. HOW WE USE YOUR DATA
+
+
We use your data to:
+
+
Provide access to and operate the Platform
+
+ Communicate with you regarding your account and service updates
+
+
Provide support and respond to inquiries
+
Process payments and manage subscriptions
+
Improve the Platform and monitor usage
+
Comply with legal obligations
+
+
+
+ 4. LEGAL BASIS FOR PROCESSING
+
+
We process your data on the following legal bases:
+
+
+ Contractual necessity – to deliver the services you signed
+ up for
+
+
+ Legitimate interests – to maintain and improve our services
+
+
+ Legal obligation – to meet accounting or regulatory requirements
+
+
+ Consent - where applicable (e.g., marketing communications)
+
+
+
+
+ 5. DATA RETENTION
+
+
+ We retain your personal data for as long as your account is active and
+ for a limited period thereafter to comply with legal and operational
+ obligations. Data may be anonymized for analytics.
+
+
+
+ 6. DATA SHARING AND SUBPROCESSORS
+
+
+ We do not sell or share your personal data with third parties, except:
+
+
+
+ With cloud hosting providers, email service providers, and payment
+ processors strictly as needed to provide the Platform
+
+
With public authorities if legally required
+
+
+ All subprocessors are GDPR-compliant and under data processing
+ agreements.
+
+
+
+ 7. DATA TRANSFERS
+
+
+ Your data may be processed or stored in the EU or other jurisdictions
+ with adequate protection standards. Where applicable, we use Standard
+ Contractual Clauses (SCCs) to safeguard cross-border data transfers.
+
+
+
+ 8. YOUR RIGHTS UNDER GDPR
+
+
You have the right to:
+
+
Access your personal data
+
Correct or update inaccuracies
+
Request deletion ("right to be forgotten")
+
Restrict or object to processing
+
Data portability
+
Lodge a complaint with a data protection authority
+ We implement appropriate technical and organizational measures to
+ protect your data, including encryption, access control, and regular
+ security reviews.
+
+
+
+ 10. CHANGES TO THIS POLICY
+
+
+ We may update this Privacy Policy from time to time. We will notify
+ you via email or through the Platform when significant changes occur.
+
+
+
11. CONTACT
+
+ If you have questions or concerns about this policy or how we handle
+ your data, contact us at: privacy@ultraviolet.rs
+ Ultraviolet, Bulevar Arsenija Carnojevica 103, 11000 Belgrade, Serbia.
+
+
+
+
+
+
diff --git a/src/pages/cube/terms.astro b/src/pages/cube/terms.astro
index 853fe8d..a5b030b 100644
--- a/src/pages/cube/terms.astro
+++ b/src/pages/cube/terms.astro
@@ -1,139 +1,215 @@
---
-import Layout from '../../layouts/Layout.astro';
-import Header from '../../components/Header.astro';
-import Footer from '../../components/Footer.astro';
+import Layout from "../../layouts/Layout.astro";
+import Header from "../../components/Header.astro";
+import Footer from "../../components/Footer.astro";
const title = "Cube AI Terms of Service - Ultraviolet";
-const description = "Terms of Service for Cube AI. Read the agreement governing your access and use of the Cube AI platform.";
+const description =
+ "Terms of Service for Cube AI. Read the agreement governing your access and use of the Cube AI platform.";
---
-
-
-
-
-
-
-
- Terms of Service
-
-
-
-
- By using the Platform, you agree to be bound by these Terms of
- Service and our Privacy Policy. These Terms of Service
- ("Terms") govern your access to and use of the Cube AI
- Platform ("Platform"), a software-as-a-service offering
- operated by Ultraviolet ("Ultraviolet," "we," "us," or "our").
- By creating an account, accessing, or using the Platform, you
- agree to be bound by these Terms.
-
-
-
1. DEFINITIONS
-
-
"Customer" means the company or individual who registers for an account to use the Platform.
-
"User" means any person authorized by the Customer to access the Platform.
-
"Services" means the hosted Cube AI Platform and associated features provided by Ultraviolet.
-
"Subscription Plan" means the selected monthly or yearly paid offering with specified limits and features.
-
-
-
2. ACCOUNT REGISTRATION
-
To use the Platform, you must:
-
-
Be at least 18 years old (or the legal age in your jurisdiction);
-
Provide accurate registration information;
-
Maintain the confidentiality of your credentials. You are responsible for all activity under your account.
-
-
-
3. ACCESS AND LICENSE
-
- Ultraviolet grants you a non-exclusive, non-transferable, revocable right to access and use the Platform in accordance with your selected Subscription Plan. You may not:
-
-
-
Reverse engineer, copy, or modify the Platform;
-
Rent, lease, sublicense, or resell access to the Platform;
-
Circumvent usage limits or security controls.
-
-
-
4. SUBSCRIPTION AND PAYMENT
-
Access to paid features requires a valid Subscription Plan. By subscribing:
-
-
You agree to recurring billing according to your selected billing cycle (monthly or annually);
-
Fees are non-refundable except as required by law;
-
You may cancel anytime, and service continues until the end of the current billing period.
-
-
-
5. SERVICE LEVELS
-
- We aim to provide 99.5% monthly uptime. Planned maintenance and
- force majeure events are excluded. Service availability is
- provided "as is," and no specific SLA is guaranteed unless
- separately agreed.
-
-
-
6. CUSTOMER DATA
-
-
You retain all rights to your data uploaded or collected through the Platform.
-
You grant us permission to process data as necessary to provide the Services.
-
We will not access or share your data except to provide support, comply with legal obligations, or with your consent.
-
-
-
7. ACCEPTABLE USE
-
You agree not to use the Platform to:
-
-
Violate laws or regulations;
-
Send spam or malicious content;
-
Interfere with the normal operation of the Platform. We reserve the right to suspend or terminate accounts for abuse.
-
-
-
8. SUPPORT
-
- Support services are available depending on your Subscription
- Plan. Enterprise customers may receive custom support and SLAs
- under separate agreements.
-
-
-
9. TERM AND TERMINATION
-
These Terms remain in effect until:
-
-
You cancel your subscription;
-
We terminate your access for violation of these Terms. Upon termination, your data will be deleted in accordance with our data retention policy.
-
-
-
10. INTELLECTUAL PROPERTY
-
- The Platform and all related content are the intellectual
- property of Ultraviolet. These Terms do not transfer any
- ownership rights.
-
-
-
11. DISCLAIMERS AND LIMITATION OF LIABILITY
-
The Platform is provided "as is" and "as available."
-
-
We disclaim all warranties not expressly stated;
-
We are not liable for indirect, incidental, or consequential damages;
-
Our total liability is limited to the fees paid by you in the past 12 months.
-
-
-
12. CHANGES TO TERMS
-
- We may update these Terms with notice via the Platform or email.
- Continued use after changes indicates acceptance.
-
-
-
13. GOVERNING LAW
-
- These Terms are governed by the laws of Serbia. Any disputes
- shall be resolved in the courts of Belgrade, Serbia.
-
+ By using the Platform, you agree to be bound by these Terms of Service
+ and our Privacy Policy. These Terms of Service ("Terms") govern your
+ access to and use of the Cube AI Platform ("Platform"), a
+ software-as-a-service offering operated by Ultraviolet ("Ultraviolet,"
+ "we," "us," or "our"). By creating an account, accessing, or using the
+ Platform, you agree to be bound by these Terms.
+
+
+
+ 1. DEFINITIONS
+
+
+
+ "Customer" means the company or individual who registers
+ for an account to use the Platform.
+
+
+ "User" means any person authorized by the Customer to
+ access the Platform.
+
+
+ "Services" means the hosted Cube AI Platform and associated
+ features provided by Ultraviolet.
+
+
+ "Subscription Plan" means the selected monthly or yearly
+ paid offering with specified limits and features.
+
+
+
+
+ 2. ACCOUNT REGISTRATION
+
+
To use the Platform, you must:
+
+
+ Be at least 18 years old (or the legal age in your jurisdiction);
+
+
Provide accurate registration information;
+
+ Maintain the confidentiality of your credentials. You are
+ responsible for all activity under your account.
+
+
+
+
+ 3. ACCESS AND LICENSE
+
+
+ Ultraviolet grants you a non-exclusive, non-transferable, revocable right to access and use the Platform in accordance with your selected
+ Subscription Plan. You may not:
+
+
+
Reverse engineer, copy, or modify the Platform;
+
Rent, lease, sublicense, or resell access to the Platform;
+
Circumvent usage limits or security controls.
+
+
+
+ 4. SUBSCRIPTION AND PAYMENT
+
+
+ Access to paid features requires a valid Subscription Plan. By
+ subscribing:
+
+
+
+ You agree to recurring billing according to your selected billing
+ cycle (monthly or annually);
+
+
Fees are non-refundable except as required by law;
+
+ You may cancel anytime, and service continues until the end of the
+ current billing period.
+
+
+
+
+ 5. SERVICE LEVELS
+
+
+ We aim to provide 99.5% monthly uptime. Planned maintenance and force
+ majeure events are excluded. Service availability is provided "as is,"
+ and no specific SLA is guaranteed unless separately agreed.
+
+
+
+ 6. CUSTOMER DATA
+
+
+
+ You retain all rights to your data uploaded or collected through the
+ Platform.
+
+
+ You grant us permission to process data as necessary to provide the
+ Services.
+
+
+ We will not access or share your data except to provide support,
+ comply with legal obligations, or with your consent.
+
+
+
+
+ 7. ACCEPTABLE USE
+
+
You agree not to use the Platform to:
+
+
Violate laws or regulations;
+
Send spam or malicious content;
+
+ Interfere with the normal operation of the Platform. We reserve the
+ right to suspend or terminate accounts for abuse.
+
+
+
+
8. SUPPORT
+
+ Support services are available depending on your Subscription Plan.
+ Enterprise customers may receive custom support and SLAs under
+ separate agreements.
+
+
+
+ 9. TERM AND TERMINATION
+
+
These Terms remain in effect until:
+
+
You cancel your subscription;
+
+ We terminate your access for violation of these Terms. Upon
+ termination, your data will be deleted in accordance with our data
+ retention policy.
+
+
+
+
+ 10. INTELLECTUAL PROPERTY
+
+
+ The Platform and all related content are the intellectual property of
+ Ultraviolet. These Terms do not transfer any ownership rights.
+
+
+
+ 11. DISCLAIMERS AND LIMITATION OF LIABILITY
+
+
The Platform is provided "as is" and "as available."
+
+
We disclaim all warranties not expressly stated;
+
+ We are not liable for indirect, incidental, or consequential
+ damages;
+
+
+ Our total liability is limited to the fees paid by you in the past
+ 12 months.
+
+
+
+
+ 12. CHANGES TO TERMS
+
+
+ We may update these Terms with notice via the Platform or email.
+ Continued use after changes indicates acceptance.
+
+
+
+ 13. GOVERNING LAW
+
+
+ These Terms are governed by the laws of Serbia. Any disputes shall be
+ resolved in the courts of Belgrade, Serbia.
+
ELASTIC redefines service orchestration within 6G networks, integrating cutting-edge technologies like WebAssembly and confidential computing to optimize network functionality and security across diverse infrastructures.
-
By combining emerging technologies such as WebAssembly, eBPF, Trusted Execution Environments, and Federated Learning, ELASTIC optimizes latency, throughput, and cybersecurity resilience — creating a more secure, efficient, and flexible networking environment.
+
+ ELASTIC redefines service orchestration within 6G networks,
+ integrating cutting-edge technologies like WebAssembly and
+ confidential computing to optimize network functionality and
+ security across diverse infrastructures.
+
+
+ By combining emerging technologies such as WebAssembly, eBPF,
+ Trusted Execution Environments, and Federated Learning, ELASTIC
+ optimizes latency, throughput, and cybersecurity resilience —
+ creating a more secure, efficient, and flexible networking
+ environment.
+
@@ -88,17 +160,35 @@ const partners = [
Key objectives
- {objectives.map(([t, x]) => (
-
{t}: {x}
- ))}
+ {
+ objectives.map(([t, x]) => (
+
+ <>
+
+
+ {t}: {x}
+
+ >
+
+ ))
+ }
Expected outcomes
- {outcomes.map(([t, x]) => (
-
{t}: {x}
- ))}
+ {
+ outcomes.map(([t, x]) => (
+
+ <>
+
+
+ {t}: {x}
+
+ >
+
+ ))
+ }
@@ -109,10 +199,21 @@ const partners = [
Our involvement
-
Ultraviolet's role.
+
+ Ultraviolet's role.
+
-
Ultraviolet is an SME from Belgrade, Serbia, specializing in cloud computing, AI/ML, multi-party computation, secure data sharing, and Trusted Execution Environments. In ELASTIC, we focus on confidential computing and secure multi-party computation — enhancing our Cocos AI platform through improvements in remote attestation and lightweight in-enclave runtimes, and developing a secure Software Management Agent (SMA) that manages AI/ML workloads within secure enclaves using TEE technologies.
+
+ Ultraviolet is an SME from Belgrade, Serbia, specializing in cloud
+ computing, AI/ML, multi-party computation, secure data sharing, and
+ Trusted Execution Environments. In ELASTIC, we focus on confidential
+ computing and secure multi-party computation — enhancing our Cocos
+ AI platform through improvements in remote attestation and
+ lightweight in-enclave runtimes, and developing a secure Software
+ Management Agent (SMA) that manages AI/ML workloads within secure
+ enclaves using TEE technologies.
+
@@ -120,15 +221,26 @@ const partners = [
Project partners
-
Collaborating with leading organizations across Europe.
+
+ Collaborating with leading organizations across Europe.
+
- Ultraviolet has received over €10M in EU Horizon Europe research funding, validating our confidential computing approach with some of Europe's leading technology organizations.
+
+ Ultraviolet has received over €10M in EU Horizon Europe research
+ funding, validating our confidential computing approach with some of
+ Europe's leading technology organizations.
TITAN is a 36-month project that develops secure and trustworthy confidential data processing and sharing capabilities, and demonstrates them in the EOSC ecosystem.
-
The sharing of sensitive data follows FAIR data and open-science principles, with significant emphasis on privacy preservation and AI solutions aligned to EU ethical, regulatory, and legal boundaries. The open-source software platform focuses on two use cases: government data and healthcare.
+
+ TITAN is a 36-month project that develops secure and trustworthy
+ confidential data processing and sharing capabilities, and
+ demonstrates them in the EOSC ecosystem.
+
+
+ The sharing of sensitive data follows FAIR data and open-science
+ principles, with significant emphasis on privacy preservation and
+ AI solutions aligned to EU ethical, regulatory, and legal
+ boundaries. The open-source software platform focuses on two use
+ cases: government data and healthcare.
+
@@ -87,17 +155,35 @@ const partners = [
Key objectives
- {objectives.map(([t, x]) => (
-
{t}: {x}
- ))}
+ {
+ objectives.map(([t, x]) => (
+
+ <>
+
+
+ {t}: {x}
+
+ >
+
+ ))
+ }
Expected outcomes
- {outcomes.map(([t, x]) => (
-
{t}: {x}
- ))}
+ {
+ outcomes.map(([t, x]) => (
+
+ <>
+
+
+ {t}: {x}
+
+ >
+
+ ))
+ }
@@ -108,14 +194,42 @@ const partners = [
Our involvement
-
Ultraviolet's role.
+
+ Ultraviolet's role.
+
-
Ultraviolet brings extensive expertise in confidential computing and privacy-preserving technologies to TITAN. Our experience with TEEs, secure multi-party computation, and collaborative AI platforms positions us as a key contributor to developing trusted AI systems.
+
+ Ultraviolet brings extensive expertise in confidential computing and
+ privacy-preserving technologies to TITAN. Our experience with TEEs,
+ secure multi-party computation, and collaborative AI platforms
+ positions us as a key contributor to developing trusted AI systems.
+
-
Confidential computing architecture
Designing and implementing TEE-based architectures for secure AI workloads.
-
Privacy-preserving AI frameworks
Frameworks for secure collaborative ML using SMPC and confidential computing.
-
Platform integration
Integrating confidential computing into existing AI/ML platforms and workflows.
+
+
+ Confidential computing architecture
+
+ Designing and implementing TEE-based architectures for secure AI
+ workloads.
+
+
+
+
+ Privacy-preserving AI frameworks
+
+ Frameworks for secure collaborative ML using SMPC and
+ confidential computing.
+
+
+
+
Platform integration
+ Integrating confidential computing into existing AI/ML platforms
+ and workflows.
+
+
@@ -124,15 +238,26 @@ const partners = [
Project partners
-
Collaborating with leading organizations across Europe.
+
+ Collaborating with leading organizations across Europe.
+
diff --git a/src/pages/solutions/index.astro b/src/pages/solutions/index.astro
index 8edcfbb..2a85523 100644
--- a/src/pages/solutions/index.astro
+++ b/src/pages/solutions/index.astro
@@ -1,42 +1,87 @@
---
-import Layout from '../../layouts/Layout.astro';
-import Header from '../../components/Header.astro';
-import Footer from '../../components/Footer.astro';
-import PageHero from '../../components/PageHero.astro';
-import ProductCTA from '../../components/ProductCTA.astro';
+import Layout from "../../layouts/Layout.astro";
+import Header from "../../components/Header.astro";
+import Footer from "../../components/Footer.astro";
+import PageHero from "../../components/PageHero.astro";
+import ProductCTA from "../../components/ProductCTA.astro";
const solutions = [
- { name: 'Sovereign AI', href: '/solutions/sovereign-ai', hero: 'cube', supporting: ['cocos'],
- problem: 'AI under your jurisdiction and your control.',
- blurb: 'Build, run, and govern AI entirely inside your national or organizational boundary — no foreign cloud, no data egress.' },
- { name: 'Private AI', href: '/solutions/private-ai', hero: 'cube', supporting: [],
- problem: 'Frontier models, zero data leaving your perimeter.',
- blurb: 'Self-hosted inference and RAG on your own GPUs, so prompts, embeddings, and responses never leave your network.' },
- { name: 'Enterprise AI', href: '/solutions/enterprise-ai', hero: 'cube', supporting: ['prism'],
- problem: 'Production AI with governance teams can trust.',
- blurb: 'A governed platform — audit, RBAC, usage accounting, and guardrails — that scales across every team and domain.' },
- { name: 'Air-Gapped AI', href: '/solutions/air-gapped-ai', hero: 'cube', supporting: ['cocos'],
- problem: 'AI for fully disconnected environments.',
- blurb: 'Deploy the entire stack with no outbound connectivity at all — for classified, regulated, and isolated networks.' },
- { name: 'Secure Collaboration', href: '/solutions/secure-collaboration', hero: 'prism', supporting: ['cocos'],
- problem: 'Joint AI across organizations, data never exposed.',
- blurb: 'Run shared models and analyses across organizational boundaries with every party\'s inputs sealed inside a TEE.' },
- { name: 'AI Governance', href: '/solutions/ai-governance', hero: 'cube', supporting: [],
- problem: 'Prove compliance — don\'t just promise it.',
- blurb: 'Policy enforcement, complete audit trails, and attestation that make AI use provable to a regulator.' },
- { name: 'Agentic AI', href: '/solutions/agentic-ai', hero: 'cube', supporting: ['cocos'],
- problem: 'Autonomous agents that never leak your IP.',
- blurb: 'OpenAI-compatible endpoints power agents and copilots on private models, with guardrails on every step.' },
+ {
+ name: "Sovereign AI",
+ href: "/solutions/sovereign-ai",
+ hero: "cube",
+ supporting: ["cocos"],
+ problem: "AI under your jurisdiction and your control.",
+ blurb:
+ "Build, run, and govern AI entirely inside your national or organizational boundary — no foreign cloud, no data egress.",
+ },
+ {
+ name: "Private AI",
+ href: "/solutions/private-ai",
+ hero: "cube",
+ supporting: [],
+ problem: "Frontier models, zero data leaving your perimeter.",
+ blurb:
+ "Self-hosted inference and RAG on your own GPUs, so prompts, embeddings, and responses never leave your network.",
+ },
+ {
+ name: "Enterprise AI",
+ href: "/solutions/enterprise-ai",
+ hero: "cube",
+ supporting: ["prism"],
+ problem: "Production AI with governance teams can trust.",
+ blurb:
+ "A governed platform — audit, RBAC, usage accounting, and guardrails — that scales across every team and domain.",
+ },
+ {
+ name: "Air-Gapped AI",
+ href: "/solutions/air-gapped-ai",
+ hero: "cube",
+ supporting: ["cocos"],
+ problem: "AI for fully disconnected environments.",
+ blurb:
+ "Deploy the entire stack with no outbound connectivity at all — for classified, regulated, and isolated networks.",
+ },
+ {
+ name: "Secure Collaboration",
+ href: "/solutions/secure-collaboration",
+ hero: "prism",
+ supporting: ["cocos"],
+ problem: "Joint AI across organizations, data never exposed.",
+ blurb:
+ "Run shared models and analyses across organizational boundaries with every party's inputs sealed inside a TEE.",
+ },
+ {
+ name: "AI Governance",
+ href: "/solutions/ai-governance",
+ hero: "cube",
+ supporting: [],
+ problem: "Prove compliance — don't just promise it.",
+ blurb:
+ "Policy enforcement, complete audit trails, and attestation that make AI use provable to a regulator.",
+ },
+ {
+ name: "Agentic AI",
+ href: "/solutions/agentic-ai",
+ hero: "cube",
+ supporting: ["cocos"],
+ problem: "Autonomous agents that never leak your IP.",
+ blurb:
+ "OpenAI-compatible endpoints power agents and copilots on private models, with guardrails on every step.",
+ },
];
const products: Record = {
- cube: { name: 'Cube AI' },
- prism: { name: 'Prism AI' },
- cocos: { name: 'Cocos AI' },
+ cube: { name: "Cube AI" },
+ prism: { name: "Prism AI" },
+ cocos: { name: "Cocos AI" },
};
---
-
+ = {