FAQ
Recovery, portability, updates, and hardware changes.
What happens if my machine dies or I reinstall the OS?
A file sealed to a CPU/TPM binding opens only on that machine's measurement. Before decommissioning hardware, unseal your files (open them on the original machine and save the plaintext) or seal a copy to a second machine you control. Treat a hardware-bound seal like a safe bolted to the floor: deliberately not portable.
Can I open a sealed file on another computer?
Not directly — that is the point. To share, seal a copy to the recipient's approved hardware, or use a GPU binding on an attested GPU that both parties can reach.
Does a passphrase replace the hardware binding?
No. The passphrase is a second factor combined with the hardware-derived key. You need both the correct machine and the passphrase.
What if my GPU driver or firmware updates?
GPU binding measures driver and firmware state. A significant change alters the measurement. For workflows where drivers change often, prefer a CPU/TPM binding, or re-seal after planned updates.
Are updates safe?
Yes. Builds are signed, and the updater verifies each update against its published signature before applying it. See the Releases.
Which platforms are supported?
macOS (Apple Silicon and Intel) and Windows today, with a Linux build available as a binary. See Install.