claim verification, starting with confidential compute
Trust, decided from evidence.
Not from paperwork or promises.
Confidior is a claim verification engine. It grades security claims against the evidence machines produce: attestation quotes and measurements today, IaC and supply chains next, one adapter at a time. Open source, runs locally, and every verdict can be re-run by anyone.
A point-in-time verdict on RedPill's production TDX gateway, captured 2026-08-14: the attestation was cryptographically valid, the measurement matched, and six known attacks apply unmitigated. Rekor anchoring makes the evidence tamper-evident, not correct. This is a snapshot, not a live status.
The problem
Certifications grade paperwork. Verifiers check signatures. Nobody grades the machine.
Confidential compute claims to protect your workload. Attestation verifiers check that a quote is cryptographically valid. What they don't do is grade it: score it against known attacks, map it to compliance frameworks, or track whether it's still trustworthy next month. C5:2026 makes remote attestation mandatory for confidential-computing offerings. The verification exists. The grading doesn't.
compliance tools
A snapshot, taken annually
- Checklists over evidence
- One point in time, twelve months old
- Attestation that never sees the runtime
attestation verifiers
Valid, but not graded
- Check the quote's signature and chain
- Stop at "this attestation is genuine"
- No attack scoring, no compliance mapping, no freshness tracking
confidior
Evidence, graded
- Measured at boot and runtime
- Scored against known attacks
- Badge re-runnable by anyone
Who it's for
Anyone who has to decide whether a security claim is true.
Three people ask the same question in different words: is the confidential environment actually protecting me?
compliance teams
Prove it, don't assert it
C5:2026 and other frameworks demand verifiable attestation evidence. A graded, re-runnable verdict turns audit prep into a query.
security engineers
Grade before you trust
Evaluate a confidential-compute provider's claim against known attacks and TCB freshness before you put a workload or a key on it.
individuals
Verify the claim yourself
Don't take the vendor's word. Run the engine, check the evidence, decide. The tool is open source and runs locally.
Three ways to use it
Run it yourself, get it hosted, or have it independently assessed.
Same engine, three ways in. Pick the one that matches what you need to prove.
free · today
Run the engine yourself
Open source, runs locally. Point it at an attestation quote and get a graded badge you can re-run any time. For engineers who want to verify claims directly.
Try the enginewaitlist · later
Hosted verifier
A badge is a point in time. Trust decays: new attacks are disclosed, firmware ages, and a deployment that was safe last month may not be today. The hosted verifier keeps watching: monitoring, policy gating, compliance reports.
Join the waitlistindependent · by request
Independent assessment
A graded report on your attestation evidence: badge, C5:2026 mapping, attack analysis, and a public verdict you can show auditors and customers. The finding is published either way, which is what makes it credible.
Request an assessmentHow it works
Four steps. Evidence in, graded verdict out.
The engine turns attestation evidence into a graded, re-runnable verdict. The same process powers the local tool and, later, the hosted service.
- 1
Ingest
Point the engine at raw evidence: attestation quotes, PCRs, memory measurements.
- 2
Authenticate
Signatures checked, freshness enforced, debug-enabled platforms rejected outright.
- 3
Evaluate
Known attacks in the open database, graded by attack cost. A $10 BadRAM stick matters more than a $5,000 vendor call.
- 4
Output
A graded badge with every dimension, plus the sources to re-run it yourself.
Read the badge
Every badge says what it found, including the failures.
One badge, six dimensions. Click a dimension to see what it means and why it matters.
A real badge from a real attestation: RedPill's production TDX gateway, verified by the engine and anchored to Rekor. Fixture: bundle-20260814131745.
measurement
The runtime measurement extracted from the quote matches the expected value in the registry. The evidence is internally consistent.
Why it's honest
Honesty is the product. Bad news is the feature.
“Known attacks, graded by attack cost in the open attack database. The cheapest is $10 of commodity BadRAM hardware: cheaper than most vendor calls. The engine verifies real quotes against those attacks, and the result is a grade, not a marketing page.”
How we think
Credit score, not a credential.
A badge is a point-in-time grade, not a warranty. Scores decay, feeds update, and the badge re-runs. It grades what is known, and says what it cannot see.
Signed and re-runnable
Every badge ships with its sources. Anyone can re-run the engine and re-verify the verdict end to end.
Every badge is bounded: it grades the known attacks in our database, not the unknown ones. Fewer known attacks on a platform does not mean more security: it may mean less research. The grade says what it looked at and what it could not.
And the honest context: most single-vendor confidential deployments grade CRITICAL today. That is the state of the attack landscape, not a quirk of the engine. The value of the grade is the detail behind the label: which attacks, what they cost, what is unmitigated.
why the grade is worth reading
We grade; we don't sell
Confidior never sells the hardware or services it grades. A grade is only worth reading if the grader has nothing to gain from the answer.
why you can trust it
Every verdict is re-runnable
Each badge points back to its sources: the quote, the measurements, the attack database. Run the engine yourself and get the same answer.
what it covers today
Starts with confidential compute
The engine grades TEE attestation today. Zero-knowledge proofs, FHE, MPC, IaC, and supply chains are the same pipeline: later, one evidence type at a time.
Questions
Asked and answered, in the open.
The short versions, with no hedging. The long versions live in the engine docs.
Because the badge is reproducible. The engine runs locally under Apache-2.0, the test suite is public and grows with the engine, and anyone can re-run the generator on the same evidence and get the same badge. Trust is checkable, not asserted.
Open source
Self-verifiable, end to end.
You can build the engine, run the test suite, and reproduce every badge on this page. No hidden servers, no black boxes.
confidior-engine
Apache-2.0, runs locally
A public test suite that grows with the engine. A CLI, a web UI, and a badge generator that tells the truth about what it measured.
View on GitHub# verify a TDX attestation, locally
$ uv run python -m src.cli.main verify --input tdx.hex --platform tdx