# Verifiable Trust Agent

> Keeps signing keys and secrets out of your code and config, making them available to authenticated applications and AI agents on demand.

When an application needs to sign data, call an external API, or persist state across restarts, it typically ends up holding the signing key, credential, or database itself. There is no central point to rotate, audit, or revoke access when that happens.

A Verifiable Trust Agent (VTA) holds your signing keys and secrets centrally, and provisions a verifiable [Decentralised Identifier (DID)](https://www.w3.org/TR/did-core/) for each registered application and AI agent. Every signing, secret-release, or memory operation runs inside a context-scoped access control list (ACL) with a full audit trail. The VTA signs on an application’s behalf, so a private key is never exported as a side effect of an operation.

Applications sign data, retrieve secrets, and persist agent state without holding a key, token, or database of their own.

## Get started

[Deploy on Affinidi Portal →](/products/affinidi-elements/vta/get-started/vta-affinidi-portal.md) leaves you no host to prepare: Affinidi provisions the infrastructure, hardware-isolated inside a Trusted Execution Environment. [Read the overview →](/products/affinidi-elements/vta/overview.md) first if you want the full picture before deploying.

## Pages in this section
- [Quickstart](/products/affinidi-elements/vta/get-started.md): Deploy your VTA on Affinidi Portal, create your first context and signing key, then connect an application.
- [Concepts](/products/affinidi-elements/vta/concepts.md): Concept pages covering the VTA's security model, identity, key derivation, and access control.
- [Integration guides](/products/affinidi-elements/vta/integration-guides.md): How-to guides for building on top of VTA: sign application payloads using VTA-held keys, persist agent state across sessions using context-scoped memory, access external APIs without exposing credentials, and drive a VTA directly from an MCP host.
- [VTA management](/products/affinidi-elements/vta/vta-management.md): Operational tasks for a running VTA: control who has access, retrieve secrets for services at runtime, rotate credentials, and protect against data loss with backup and restore.
- [Overview](/products/affinidi-elements/vta/overview.md): What a Verifiable Trust Agent is, how it keeps signing keys and secrets out of your code, and why an Affinidi-hosted VTA protects keys even from Affinidi.