Why ask for trust,
when you can prove it?
When a customer, an auditor, or a regulator asks you to prove what’s actually running, you can. WaveBend builds one unbroken chain of proof: from your source on GitHub, through the deployment that boots it, to the end user who connects. Verifiable and tamper-evident at every link, on a fully open-source stack, inside your own accounts. Then we hand it over.
They hesitate at wallet-connect because they can’t tell your frontend from a drainer’s copy. Make it checkable before they sign: the page they connect to is provably the code in your public repo, built by CI, running on an attested server.
Move to immutable, attested infrastructure: servers run a fixed image and change only through your pipeline, never by hand. Tighter internal processes, and a far smaller blast radius when a credential leaks or an insider goes bad.
Your competitors answer security questionnaires with PDFs and promises. You answer with evidence their own engineers can check: which commit, which CI run, which attested machine, right now.
Cryptographic evidence where today you hand over a policy PDF. The proof maps onto MiCA, DORA, BaFin, SOC 2, and ISO 27001, not because we wrote it to but because those frameworks describe the same underlying controls.
One chain of proof, end to end
From your source on GitHub to the user who connects, every link is checkable. Two of them are ours to build:
1 · Prove what the software is
Verifiable builds. Your core code is open-source and built by CI, never by a human. GitHub build attestation ties every release artifact to the exact public commit that produced it.
2 · Prove what it’s running on
Verifiable secure boot. That verified image boots under UEFI Secure Boot on locked-down cloud instances and produces a remote attestation signed by the cloud’s own hardware root of trust. A remote party can confirm exactly which image booted, and that nothing was tampered with along the way.
How we work
We’re a consultancy, and the deliverable is a transformation, not hours. The stack is open-source, the work happens in your accounts, and when we’re done there’s nothing of ours left to depend on.
- Discovery call. 30 minutes, free: where your trust chain is real, and where it’s theater. The diagnosis is the demo.
- Close the chain. Fixed scope: verifiable builds in your release flow, attested boot in your cloud accounts.
- Handover. The open-source stack, your accounts, and the evidence story documented for your auditors and customers.
The open-source stack
Everything we deploy is public. It has to be, because the proof depends on it. A closed tool that promises verification is the theater we exist to end.
stage0
The UEFI loader at the bottom of the chain. On cloud instances whose firmware can’t netboot, it brings up the network itself, then fetches, verifies and measures a signed boot image before launching it.
lockboot
The measured Linux image stage0 launches. CI-built and TPM-attested, it proves exactly what booted, then fetches and runs your workload, with nothing taken on faith in between.
vaporTPM
The cloud vTPM attestation library lockboot builds on. Verify an instance’s attestation anywhere, with zero C dependencies.
vaporTPM RISC Zero Research
Verify instance attestations anonymously and/or on Ethereum.
Engineering notes
-
2026-06-24EC2's UEFI firmware has no driver for the network card AWS put in the instance, so a firmware-level netboot has no network at all. Here is a clean-room Rust UEFI driver for the ENA adapter, the 24-reboot hunt for the one undocumented register that gates it, and the pile of confident theories that were all wrong.
-
2026-06-13A ~150 KB UEFI loader that pulls, verifies, measures and boots a signed payload over HTTP. Configure a fleet once, publish new builds to a signed release channel, and machines roll forward on the next boot — no re-imaging, no metadata changes.
-
2026-02-11How lockboot establishes trust using cloud vTPMs — the generic boot model, provider-specific trust chains for AWS Nitro and GCP, and what this doesn't protect against.
Why ask for trust, when you can prove it?