> For the complete documentation index, see [llms.txt](https://hinkal-team.gitbook.io/hinkal/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://hinkal-team.gitbook.io/hinkal/hinkal-waas/description/secure-enclave.md).

# Secure Enclave

Hinkal runs all security-critical operations — private key generation, storage, transaction signing, UTXO decryption, and zero-knowledge proof generation — inside a **GCP Confidential VM** powered by AMD SEV (Secure Encrypted Virtualization). Confidential VMs encrypt the VM's memory at the hardware level, meaning the contents of the enclave's memory are inaccessible to the underlying host infrastructure, including GCP itself.

The enclave runs as a custom application, isolated in a dedicated GCP project separate from the rest of Hinkal's infrastructure. The same enclave backs both products: the WaaS managed wallets and the [Hinkal API](/hinkal/hinkal-api/description/overview.md), whose shielded keys and proof generation are likewise confined to the enclave.

## Request validation layers

Every request that reaches the enclave goes through multiple independent validation steps before any key material is touched:

1. **User stamp verification** — the enclave parses and verifies the X-Stamp header, confirming the request was signed by the legitimate user's Ed25519 private key
2. **API server signature verification** — the enclave verifies a separate signature produced by the WaaS API server over the transaction payload, confirming the request came through Hinkal's legitimate API and was not forged or injected directly
3. **Payload integrity check** — the enclave verifies that the payload fields (organization, user, wallet, chain) are internally consistent and have not been tampered with in transit
4. **Policy enforcement** — the enclave checks that the caller has permission to perform the requested action before proceeding

All four checks must pass. A request that fails any one of them is rejected before the enclave decrypts or uses any key material.

## Encrypted responses

Signing results returned by the enclave are encrypted so that only the WaaS API server can decrypt them. Raw signatures are never transmitted in plaintext.