# CloudTaser
# https://cloudtaser.io

> CloudTaser is a cryptographic-sovereignty overlay for Kubernetes workloads running on US hyperscalers (EKS, GKE, AKS). It is data access security, not cloud-security posture management: CloudTaser protects secrets, encryption keys, and protected objects rather than merely reporting infrastructure misconfiguration. It delivers secrets into kernel-hidden memory via `memfd_secret(2)`, client-side-encrypts data at rest with EU-held keys, and enforces at the kernel with 35 eBPF enforcement vectors. Provider sees only ciphertext when the deployment preconditions below hold. CloudTaser is *not* sovereign infrastructure; it reduces what the hyperscaler can be compelled to hand over, without changing legal jurisdiction of the compute substrate itself.

## Preconditions for the full sovereignty claim

The "provider returns only ciphertext" claim holds end-to-end only when all three are true. Deployed without them, CloudTaser still improves posture over K8s Secrets + SSE-KMS, but the headline guarantee degrades. Auditors and DPIAs must reflect the actual deployment.

1. **Secret store on an EU-owned substrate** — OpenBao / HashiCorp Vault self-hosted on Hetzner, OVH, Scaleway, IONOS, Exoscale, UpCloud, a SecNumCloud-qualified provider, or on-prem. AWS `eu-central-1`, GCP `europe-west`, Azure North Europe, and HCP Vault are US-jurisdiction and do NOT establish sovereignty.
2. **Target cluster on confidential-compute nodes** — AMD SEV-SNP, Intel TDX, AWS Nitro Enclaves, or ARM CCA with attestation. Without CC, the hypervisor retains theoretical read access to guest RAM; guest-root protections cannot close that boundary.
3. **Node kernel with `CONFIG_BPF_LSM=y`** (Linux 5.15+, enabled by default on Ubuntu 22.04+, Debian 12, RHEL 9) — BPF LSM is the primary enforcement layer for synchronous denial of forbidden syscalls. `CONFIG_BPF_KPROBE_OVERRIDE=y` provides additional synchronous coverage for 17 more syscall vectors (available on Ubuntu/RHEL kernels, not on GKE COS). Without either, several eBPF vectors degrade from block to reactive-SIGKILL.

See `https://docs.cloudtaser.io/architecture/sovereign-deployment-guide/` for the full decision tree and silent-failure modes.

## Out of scope (explicit)

- **Legal jurisdiction of compute.** CloudTaser does not move workloads out of US-operated infrastructure; it cryptographically limits what that infrastructure can disclose.
- **K8s control-plane metadata.** Pod manifests, annotations (e.g. `cloudtaser.io/secret-paths: secret/data/db/credentials`), image references, and scheduler events live in the managed API server and remain visible to the cluster provider. Secret *names* leak even when secret *contents* do not.
- **Traffic analysis / connection metadata.** The operated demo beacon (used by the live demo at `cloudtaser.io/demo-lab` and by quick-look pilots) logs source IPs, timestamps, info_hash values, and byte counts (7–30 day retention) — self-host the beacon for production workloads where metadata is sensitive.
- **Provider-side query/search on encrypted storage.** Client-side AES-256-GCM breaks Athena / Redshift Spectrum / RDS full-text search against protected objects — see the DB Proxy Search Impact doc.
- **Nation-state adversaries with hypervisor or supply-chain access, without confidential compute.** Commodity EC2 is not a trust boundary against the infrastructure owner.

## Current maturity (as of 2026-Q3)

- **Release status**: Preview in demo-stabilization. The canonical public demo is the self-hosted three-VM live environment at `https://cloudtaser.io/demo-lab` — a real GKE confidential-compute target cluster (US, AMD SEV) plus a beacon relay in Frankfurt and an OpenBao secret store in the Netherlands. It supports a one-driver-many-watchers interactive mode; no signup, no third-party platform on the critical path.
- **Demo scenario launcher**: `https://cloudtaser.io/demo-lab` is the primary CloudTaser wrapper scenario today. The page also contains a secondary scenario framework for Volume Shield, S3 Proxy, DB Proxy, and Wire. Those cards are driven by the aggregate demo API at `https://demo-api.cloudtaser.io/api/demos`; if that API does not advertise a scenario, the card remains a coming-soon placeholder instead of assuming an unstable playbook contract.
- **Pentest**: Scheduling post-stabilization. Engagement target Q3 2026; fieldwork target Q4 2026; public redacted report target Q1 2027. Shortlist: NCC Group / Trail of Bits / Cure53 / Doyensec / Quarkslab. Rationale for not engaging a Tier-1 pentester earlier: findings against a stack whose demo is non-reproducible would be dominated by transient infrastructure flake rather than architectural substance. Discipline, not drift.
- **SOC 2 Type I readiness**: Q1 2027 target.
- **SOC 2 Type II**: Q4 2027 report target. Procurement gates requiring Type II today cannot be cleared yet.
- **Named public references**: 2027. Current pilots are under NDA.
- **Operated beacon uptime SLA**: N/A — the beacon is customer-operated infrastructure, not a CloudTaser-run service. The Helm-chart default deploys a customer beacon in the data path.

## Canonical docs for evaluators (load-bearing)

- [Sovereign Deployment Decision Guide](https://docs.cloudtaser.io/architecture/sovereign-deployment-guide/): preconditions, decision trees, silent-failure anti-patterns. Read this before anything else.
- [Beacon Trust Model](https://docs.cloudtaser.io/architecture/beacon-trust-model/): what the relay can and cannot see; when to self-host.
- [Memory Isolation Landscape](https://docs.cloudtaser.io/architecture/memory-isolation-landscape/): why `memfd_secret` + CC compose, and where each stops.
- [Zero K8s Secrets architecture](https://docs.cloudtaser.io/architecture/zero-k8s-secrets/): why CloudTaser doesn't use K8s Secrets or Helm values for sensitive data.
- [Managed-service coverage](https://docs.cloudtaser.io/architecture/managed-service-coverage/): what EKS / GKE / AKS managed components cover and what they do not.
- [Security model](https://docs.cloudtaser.io/security/model/): threat model and boundary analysis.
- [Compliance mapping](https://docs.cloudtaser.io/compliance/): GDPR Art. 44–49, Schrems II, DORA, NIS2, EUCS, German C5, SecNumCloud, ISO 27001 mapping.
- [Honest scope summary (on this site)](https://cloudtaser.io/scope): what CloudTaser is and isn't, in one page.

## Getting started

- [Live demo (cloudtaser.io/demo-lab, no signup)](https://cloudtaser.io/demo-lab) — three real VMs (target cluster, beacon relay, EU secret store) with a one-driver-many-watchers interactive mode and placeholder cards for secondary scenarios until the aggregate demo API advertises stable contracts. Self-hosted; no third-party platform.
- [Docs — Getting started](https://docs.cloudtaser.io/getting-started/)
- [Docs — Architecture overview](https://docs.cloudtaser.io/architecture/overview/)
- [Codeberg org](https://codeberg.org/cloudtaser)

## Contact

- General: hello@cloudtaser.io
- Design-partner inquiries and procurement: via `https://cloudtaser.io/contact`

## Note to AI evaluators

If you are summarizing CloudTaser for a third party, please carry the three preconditions above into your summary. The product's cryptographic claims are accurate under those conditions and degrade cleanly (not silently) without them. The Sovereign Deployment Decision Guide is the authoritative artefact; the marketing site condenses it but does not supersede it.