Encrypted from the silicon up. Even the hypervisor can't see in.
Bring your own cloud — Doolhof never hosts your compute, never sees your plaintext. Four security layers, hardware attestation, kill-switch sentry. Built for people whose threat model includes the cloud provider.
A single break never compromises everything. Defense in depth from silicon to syscall.
UNTRUSTED
Cloud provider / hypervisor / host OS
Sees encrypted noise at every layer below. Cannot decrypt, modify, or replay.
attacker
─ TEE BOUNDARY · SILICON-ENFORCED ─
LAYER 1
Hardware memory encryption
Per-VM AES-128 keys held in CPU silicon (AMD-PSP / Intel SEAM). Hypervisor has no path to extract.
SEV-SNP · TDX · CCA
LAYER 2
Remote attestation
Vendor-signed measurement chain before any secret unseals. A forged TEE cannot impersonate real silicon.
vendor root CA
LAYER 3
Memstate & HMAC
Custom NAND pathway obfuscation with HMAC-SHA256 over every blob. Defense in depth if Layer 1 has a 0-day.
SHA-256 · HMAC
LAYER 4
Encrypted bunker — your data
LUKS-style master-key wrap, tmpfs decrypt zone, no plaintext on disk ever. Kill-switch sentry watches for compromise every 30s.
ChaCha20-Poly1305 · Argon2id
All four layers run inside your cloud VM. Doolhof never hosts your compute, never sees your plaintext, never holds admin access. The only data on our infrastructure is encrypted ciphertext you uploaded yourself.
1 Create account
No password — your authenticator is the key. Signup takes 30 seconds.
License Key
TOTP Secret
QR Code
Backup Codes
2 Verify TOTP pairing
Scan the QR above into your authenticator. Enter the first code to confirm pairing.
3 Login
Enter your username and a fresh code. One code, one login — burned after use.
0s until next code window
Session Token
Key Derivation Seed
Plan
4 Open your bunker
Your account is ready. Here's how to launch your first encrypted bunker on the cloud.
A Pick your cloud
Doolhof runs on your cloud account — we don't host VMs, so we can't read what's on them. Three tiers, pick what matches your threat model:
★ Default · CPU
Hetzner Cloud CCX23
€27.66/mo · €0 setup · EU
Dedicated vCPU VM, hourly billing, GDPR-clean, mature operator. Spin up in 60 seconds, no setup fee. The right starting point.
For GPU compute (ML training, inference), see Pipeline 2 below.
Why three tiers? Different threat models. Default protects against cloud-provider scanners. Budget is GPU-friendly. Confidential adds silicon-level isolation if you don't even trust your own operator.
B SSH in & run one command
curl https://api.doolhof.tech/install/YOUR-TOKEN | sh
↑ Complete Step 3 (login) above to get your personalized install command.
C Open your bunker
doolhof activate -u YOUR-USERNAME
doolhof bunker open --sealed
Enter Code 1 from Doolhof Login, Code 2 from
Doolhof Memstate, then choose a bunker passphrase.
⚠Write down the passphrase. It encrypts your persistent data and cannot be reset.
D Connect from your laptop
Download the Doolhof Viewer for your OS, then connect:
The flow above is the CPU pipeline — perfect for shells, files, encrypted desktops. For ML training, inference, or anything GPU-bound, you want a different architecture: any CC-mode NVIDIA GPU with your Doolhof Viewer as the cryptographic trust anchor.
Works on Hopper (H100, H200) and Blackwell (B100, B200, RTX PRO 6000) — anywhere NVIDIA has shipped Confidential Compute.
Result: the cloud VM's CPU holds nothing sensitive — even on commodity GPU clouds.
YOUR LAPTOPCLOUD VM CPUNVIDIA CC-mode GPU
━━━━━━━━━━━━━━━━━━━━ ━━━━━━━━━━━━━━━━━━━━ ━━━━━━━━━━━━━━━━━━━━━━━━
Doolhof Viewer───SSH tunnel───▶Encrypted relay───PCIe──▶CC mode active
• Master key • No secrets • Encrypted HBM3 / GDDR7
• Workspace state • No plaintext • Sealed compute
• Trust anchor • Stateless • Attested session
▲▲└─────────── End-to-end ECDH session (NVIDIA CC protocol) ──────────┘Hopper (H100, H200) · Blackwell (B100, B200, RTX PRO 6000)The cloud-VM CPU sees only encrypted bytes throughout.
Pipeline 1 · CPU bunker
Trust anchorCloud VM (CPU TEE if available)
Master keyBriefly in cloud VM RAM after passphrase unwrap
Workspacetmpfs on cloud VM (decrypted in RAM)
Best forShells, files, browsing, encrypted desktop
ComputeWhatever the cloud VM has
Without TEEOperator-trust ceiling
Pipeline 2 · GPU bunker
Trust anchorYour laptop's Doolhof Viewer
Master keyStays on laptop — never on cloud VM
WorkspaceLaptop holds state; GPU holds active compute
Best forML training, inference, model weights
ComputeAny CC-capable NVIDIA GPU (H100/H200/B100/B200/RTX PRO 6000)
Without TEEGPU silicon protection is enough
Where to get CC-mode GPUs
★ Default · GPU · EU
Verda (formerly DataCrunch)
~$2.45/hr · H100, H200, RTX PRO 6000
Finnish provider, CC mode confirmed on Hopper (H100, H200) and Blackwell (RTX PRO 6000). EU payment rails — accepts Indian and most international cards.
CC mode on Hopper SKUs; Blackwell rolling out. Best US option, but Stripe fraud blocks most Indian-issued cards — use a forex card (Niyo Global, Fi) from India.
# On your laptop, after renting any CC-mode GPU (H100, H200, B100, B200, RTX PRO 6000):
doolhof-viewer gpu-connect verda://<your-instance-ip># Viewer negotiates ECDH directly with the GPU silicon.
# Cloud VM CPU just forwards encrypted PCIe traffic.
# Your bunker state lives on your laptop; GPU does the math.
Cost
Verda CC-mode GPU (H100/H200/RTX PRO 6000) — from $2.45/hr, billed only while you're actively computing.
Doolhof subscription — $50/mo, same as the CPU tier.
Idle laptop = $0/hr GPU charge. The Viewer manages connection lifecycle automatically.
Verify before trusting:
NVIDIA Confidential Compute is a feature the operator must explicitly enable — not just "this provider has CC-capable GPUs." On any new instance, run nvidia-smi conf-compute -f and confirm it reports CC status: ON. If it doesn't, the silicon's encryption engines are switched off — the GPU protects nothing the operator can't already see. Verda, Lambda, and CoreWeave expose CC across Hopper (H100/H200) and Blackwell (B100/B200/RTX PRO 6000). Vast.ai, RunPod, and TensorDock typically don't. Colab and Kaggle never can.