The Cryptographic Security Layer for Autonomous AI Agents

AI agents are vulnerable to prompt injection and data exfiltration. Enclavia traps your agent's execution logic and keys inside a hardware-isolated TEE, mathematically guaranteeing that PII never leaves your network and unauthorized actions are blocked.

Hardware-Enforced DLP

Block SSNs, API keys, and sensitive payloads from leaving your VPC. Policies are baked into the Enclave image and cannot be bypassed by the host.

Signed Policy Enforcement

Runtime policies require an Ed25519 signature from the approval key and are verified inside the enclave. If an employee alters the baked policy, the PCR0 measurement changes and the platform refuses to attest it.

Cryptographic Audit Trail

Every action the agent takes is logged with a verifiable AWS Attestation Document. Prove to your auditors exactly what code ran inside the black box.

One protected egress path, any language

Use the native HTTP contract from any runtime, run the dependency-free Enclavia CLI for smoke tests and jobs, or install the optional Python hook for zero-code requests and httpx interception. Workload credentials use headers and never need to be embedded in application URLs.

npm install --global @enclavia-os/cli

export ENCLAVIA_API_URL="https://<data-plane>/api/agent/egress"
export ENCLAVIA_API_KEY="<workload-key>"
export ENCLAVIA_AGENT_ID="<workload-id>"

enclavia doctor
enclavia request \
  --action post_data \
  --target https://api.example.com/v1/run \
  --content '{"input":"hello"}'