Deploy like it's a cloud. Prove it isn't.
One policy in your repo, one motion — and your app is running sealed in a TEE on a real Acurast phone, on real home broadband. Secrets delivered sealed, logs streaming, front door wired.
Early access The Hohmann plugin is rolling out now. APIs and pricing may change.
Already building on Acurast? See how Hohmann fits your stack →
01 — The destination
Acurast jobs run inside TEEs on real smartphones, parked on residential broadband around the world. Hohmann exists to put your app there — because that topology can prove things no datacenter can.
01 · hardware
TEE attestation proves exactly what code is running — on a real phone, not a VM that says so.
02 · topology
You can't spin up a home. Real ISPs, real neighborhoods, the true last mile — Acurast has them at fleet scale.
03 · privacy
The seal encrypts everything it touches — memory, keys, traffic. Not the phone's owner, not the network, not us.
What launches here first
If your app just needs a server, use a server. If it needs to be private, placed, and provable — this is the only ramp.
02 — The problem
The destination is extraordinary; the path to it is hostile. Production needs a deployment you can repeat, secrets that arrive sealed, logs you can actually read — and out of the box, each is its own ceremony:
01 · orchestration
Pin the artifact, fund the job, match processors, pass admission — each step its own extrinsic, wallet prompt, and failure mode.
02 · observability
Your code runs on a phone you'll never meet — you need its logs. But unless they're encrypted end-to-end, to your key alone, your sealed app leaks through its own diagnostics.
03 · secrets
The job needs its API keys at runtime — but nothing outside the enclave should ever see them, now or later. A store that can decrypt them later is a leak on a timer.
03 — The policy
One JSON file in your repo declares the whole launch — runtime, schedule, secrets, logging, ingress. Hohmann turns it into a plan you can read before a single token moves — and backs it with preflights, replacement holds, and post-mortem diagnosis.
acme-api · read it before you pay
04 — The platform
Each piece replaces a manual ceremony with something declared, auditable, and repeatable — what it takes to run TEEs on home internet like production infrastructure. Eight are live today; the ninth is on the slips.
One commit declares the deployment — reviewable, repeatable, OIDC-pinned. No key files.
Encrypted to the job's enclave before they leave you — no “store now, decrypt later”.
Encrypted end-to-end, from inside the seal to your terminal — readable by you alone.
A public HTTPS front door — one line of policy.
Your bundle is plaintext in exactly two places: your repo and the TEE. Ciphertext everywhere between.
Replicas, windows, durations, rolling replacements — declared once, kept on time.
Budgets, quotes, and settlement in USDC — Hohmann does the token dance, your books never see it.
Caps, preflights, and explicit --yes-spend gates — nothing spends while you're not looking.
Bring a full proot image — your CI builds it, Hohmann serves it straight to the phone.
05 — The seal & the circuit
The vault never opens; the front door never closes.
Everything enters. Nothing readable leaves.
Ingress, or egress — all over the world.
Hohmann works the harbor; it never boards a ship. It plans launches, keeps schedules, meters USDC past your spend gates, and moves sealed cargo both ways — holding keys to none of it.
06 — Launch
Install the PROOF CLI, publish your policy, preflight, launch. Artifacts, secrets, logs, and routing are handled for you.
acme-api · application-policy.v3
The full walkthrough, policy reference, and concepts live in the docs.
Read the docs →