TEE attestation

Remote attestation lets a verifier establish that a gateway is running on Intel TDX hardware and bind its identity key to a measured workload.

At a high level, verification checks:

1. The quote is valid for genuine TDX hardware.
2. The measured workload matches an approved SayGM image.
3. The gateway public key is bound into the quote’s report data.
4. A caller-provided nonce is bound into the response to prevent replay.

The gateway identity is also used by SayGM’s accounting and validation pipeline.

Freshness matters

An attestation response must be requested with a fresh random nonce and verified against that same nonce. Caching a prior successful response defeats freshness.

What attestation does not prove

Attestation proves properties of the measured environment and key binding. It does not, by itself, prove the behavior or data policy of an upstream frontier model provider. The privacy model explains that separate trust boundary.

Note

The lower-level attestation verification interface is still being prepared for general buyer use. This page documents the trust model without asking users to depend on an unstable verification command.