Isolated and Shared modes
An evaluation VTA and a VTA holding keys that other parties rely on need different protection, and the mode you pick when you create the configuration decides which one you get. Affinidi hosts a VTA in one of two modes, set as Appliance type in Affinidi Portal and fixed for the life of the configuration:
- Isolated: runs in an AWS Nitro Enclave, a Trusted Execution Environment (TEE). Hardware-rooted attestation, keys and data.
- Shared: runs on a shared network. Evaluation and development purposes only.
Match the mode to your workload and plan, then deploy. Deploy VTA appliance →
Both modes are hosted and operated by Affinidi. To run the VTA on your own infrastructure instead, see Self-hosted (open source).
What each mode provides
| Isolated | Shared | |
|---|---|---|
| Where it runs | An AWS Nitro Enclave, a hardware-isolated environment with no persistent storage, no interactive access, and no network interface of its own. | The VTA software on a shared network, without an enclave. |
| How keys are protected | The master seed is generated inside the enclave and encrypted at rest. In normal operation, the seed is released to an enclave with the expected attestation, and its plaintext stays in the enclave’s own memory. | Keys are held by the VTA software on Affinidi’s hosting platform. |
| Independent verification | You pin the enclave’s measurements at bootstrap, PCR0 and also PCR8 when Affinidi Portal shows it, so PNM checks the enclave’s attestation before it creates your Administrator DID and hands the first administrator role to it. | Trust rests on Affinidi’s hosting, with no enclave measurement to pin. |
| First admin setup | You create a one-time bootstrap claim DID with pnm bootstrap claim-did create and enter it in Affinidi Portal. Once the VTA is up, pnm bootstrap connect claims the first administrator, and only the holder of that claim DID can. PNM then replaces the claim DID with an Administrator DID it creates on your machine. | You create an Administrator DID with pnm setup and enter it in Affinidi Portal. Once the VTA is up, pnm setup continue connects PNM and replaces that DID with a permanent one. |
| Intended for | Workloads whose keys or secrets matter beyond your own testing. | Evaluation and development. |
For how the enclave protects keys and what pinning verifies, see Security model.
Which mode to choose
Choose Isolated for any workload whose keys matter beyond your own testing: signing on behalf of your users, issuing credentials that other parties rely on, or holding third-party API tokens. You can check the enclave’s measurement yourself before you trust it, and in normal operation the enclave keeps key material out of reach of the host it runs on.
Choose Shared to try the API, build an integration, run tests, or demonstrate a prototype, using keys you are prepared to discard. It is the mode available on every plan, including the free Essential and Community plans.
When the work is ready for real users, move it to an Isolated configuration and create its keys and secrets there. Each project holds one VTA configuration, so delete the Shared configuration before you create the Isolated one.
Which modes and sizes your plan includes
Your Affinidi Portal plan sets which modes and sizes a project can create, and how long the VTA is kept. Every plan allows one VTA configuration per project, in a mode the plan includes.
| Plan | Isolated | Shared | Retention |
|---|---|---|---|
| Essential and Community (free) | Not available | Basic | Deleted automatically 60 days after creation |
| Standard | Enhanced | Basic | Kept until you delete it |
| Enterprise | Enhanced, Advanced | Basic | Kept until you delete it |
Standard and Enterprise are custom plans, shown in Affinidi Portal as coming soon. To use Isolated mode, contact Affinidi.
- Basic: the Shared size, for evaluation and development.
- Enhanced: the Isolated size on the Standard and Enterprise plans.
- Advanced: the largest Isolated size, for scaling.
An Isolated VTA created on a free plan before open beta, through the Verifiable Trust Agent Early Access Programme, is deleted automatically 14 days after creation. The configuration’s details page shows the exact date as its Deletion notice. For how plans and limits work, see Plans, credits, and limits.
Related
Glad to hear it. Thanks for letting us know.
Sorry to hear that. Thanks for letting us know.