# Verifiable Trust Agent

> Keeps signing keys and secrets out of your code and config, making them available to authenticated applications and AI agents on demand.

When an application needs to sign data, call an external API with a stored credential, or persist state across restarts, it typically ends up holding the signing key, credential, or database itself. Rotating, auditing, or revoking that access then means changing each application separately.

A Verifiable Trust Agent (VTA) holds your signing keys and secrets centrally, and identifies each registered application and AI agent by a verifiable [Decentralised Identifier (DID)](https://www.w3.org/TR/did-core/), which PNM or the VTA can create for it. Every signing, secret-release, or memory operation is checked against a context-scoped access control list (ACL), and most privileged operations, such as ACL, key, and vault changes, are recorded in an audit trail. The VTA signs on an application’s behalf, so a private key is never exported as a side effect of an operation.

Applications sign data, issue verifiable credentials, retrieve secrets, and persist agent state while holding only their own authentication key, with no data-signing key, stored secret, or database of their own.

## Get started

[Deploy on Affinidi Portal →](/products/affinidi-elements/vta/get-started/vta-affinidi-portal.md) leaves you no host to prepare: Affinidi provisions the infrastructure in Isolated mode, which runs in an AWS Nitro Enclave, a Trusted Execution Environment (TEE), or in Shared mode, which runs on a shared network for evaluation and development purposes only. [Read the overview →](/products/affinidi-elements/vta/overview.md) first if you want the full picture before deploying.

## Pages in this section
- [Quickstart](/products/affinidi-elements/vta/get-started.md): Deploy your VTA on Affinidi Portal, create your first context and signing key, then connect an application.
- [Concepts](/products/affinidi-elements/vta/concepts.md): Concept pages covering the VTA's security model, identity, key derivation, and access control.
- [Integration guides](/products/affinidi-elements/vta/integration-guides.md): How-to guides for building on top of VTA: sign application payloads using VTA-held keys, persist agent state across sessions using context-scoped memory, access external APIs without exposing credentials, and drive a VTA directly from an MCP host.
- [VTA management](/products/affinidi-elements/vta/vta-management.md): Operational tasks for a running VTA: control who has access, retrieve secrets for services at runtime, rotate credentials, and protect against data loss with backup and restore.
- [Overview](/products/affinidi-elements/vta/overview.md): What a Verifiable Trust Agent is, how it keeps signing keys and secrets out of your code, and the two modes an Affinidi-hosted VTA runs in.