Solutions
Controlled data on devices you own. Opened only where you say.
Heads of engineering or OT at manufacturers, utilities and defense suppliers whose digital twins and technical data must never be readable off the machines they designate.
Why now
CMMC stopped being a plan and became a clause.
CMMC is in force for defense suppliers
The 48 CFR final rule took effect on 10 November 2025, starting Phase 1. Level 2 third-party assessments were scheduled for Phase 2 and paused by the Department on 13 July 2026: the obligation is live and the certification wave is pending, not cancelled. [1]
Source48 CFR CMMC acquisition rule, in effect November 10, 2025; Department of Defense pause of Phase 2 assessments, July 13, 2026. The full citation and link are in the footer notes.
What it means for you
Primes are writing the clause into subcontracts now and asking suppliers for status. The question on the next bid is where controlled information lives and who can touch it.
What waiting costs
A supplier who cannot show where controlled information lives, and who can touch it, loses the bid to one who can. When the assessment wave restarts it favours those with the evidence already filed.
Why Triple X
Triple X keeps controlled data on devices you own, placed and pinned where the contract says, with operator access logged and Sealed for the data no operator may read. CMMC Level 2 is in progress for the platform underneath; your control of the hardware is what the assessor sees.
In plain English
If you make parts for the defense base, your customers must now prove their suppliers handle controlled information properly, and they will prove it by asking you. Triple X lets a small supplier run cloud workloads on its own machines, inside its own walls, and hand over the record that shows it.
What you get
Four things, each a product you can open.
Your devices, your sites
Controlled and CUI-marked work stays on devices you own. Nothing of it is scheduled onto shared nodes.
OpenSealed with named machines
Data stored anywhere, decryptable only inside enclaves on machines you name. The key is released only to a machine that attests.
OpenFailover between named enclaves only
Designate more than one. The twin never fails over to an unnamed machine.
OpenAn attestation chain, not a policy document
Hand the assessor the attestation and the key-release record.
Open
Which way in
Start where it fits. Move later without a new vendor.
Triple X Cloud nodes
No hardware of your own. Join the waitlist and start when your seat opens.
Your own devices
Triple X connects your racks or devices to a private cloud of your own.
Both
Sensitive work on your devices, the rest on ours, one private cloud.
Objections you will hear
What someone in the room will say.
Encryption at rest is enough.
At rest and in transit, yes. In use is where a twin is readable, and that is where the enclave closes the gap.
We cannot put this on a shared cloud.
You do not. Your devices, your sites, your private cloud. The network carries ciphertext; the enclave you named is the only place it becomes a model.
Is the platform CMMC certified?
No. CMMC Level 2 is pursued, with no assessment held. The platform holds a SOC 2 Type II attestation. Say attested, not certified, and we will too.
What if a designated machine fails?
Designate more than one. Failover moves the work between the enclaves you named and records the move.
What yes looks like
The list a buyer brings to the table.
- Data decryptable only inside named enclaves on named machines in named places
- An attestation chain an assessor will accept
- Their own devices at their own sites, one private cloud
- Failover only between designated enclaves
- A pilot across three sites with a deliberate failed read in the test plan
- No claim of a certification the platform does not hold
Get started
Plan a three-site pilot.
With a failed read on purpose in the test plan.
- 01
Join the waitlist.
Tell us what you want to run and where. No credit card.
TakesTwo minutes
- 02
Run the pilot.
Ten nodes, 60 days, a pass mark you set in writing.
Takes60 days
- 03
Decide on day 60.
Extend, or leave at the transfer rate and nothing else.
WhoYou
We never ask for your root credentials, API keys or bank details by email.
The first 60 days
A pilot with a pass mark you set.
Three sites, named machines, and a failed read on purpose before anyone signs for the whole fleet.
Week 1
Your private cloud and the first site
Triple X connects your devices at the first site to a private cloud with its own network. The first workload is uncontrolled, to prove the plumbing.
Weeks 2 to 4
The twin on named enclaves
Run the twin on enclaves at three sites. Attempt a read from an unnamed machine and confirm it fails. Fail a named machine and confirm the move. The pass mark is the head of engineering's: no unnamed read, recovery timed, every key release on the record.
Day 30
Review with the assessor
Hand over the attestation chain, the key-release record and the receipts. Read the first invoice beside the cost of the room you did not build.
Day 60
Decision
Extend to the rest of the fleet, or stop. The devices, the data and the ciphertext stay with you either way.
Questions
What buyers ask before they sign.
In the order they come up. Every answer ends with where to check it.
10 answers
All questionsCan controlled data stay on the machines we designate, with no exceptions?
Yes. Controlled and CUI-marked work runs on devices you own at your sites, and none of it is scheduled onto shared nodes. With Sealed, the data is stored as ciphertext anywhere and decrypted only inside an enclave on a machine you named.
Proofthe four steps on the Sealed page and the pinned placement control on the Security page.
Does the platform operator ever hold the key?
The key is released only to a machine whose attestation matches, and only to the enclave you named. The platform underneath sees that a run happened, how large it was and what it cost. The receipt records the release.
Proofthe Sealed page and the SOC 2 Type II report under NDA.[2]
Are you CMMC Level 2 assessed?
No. CMMC Level 2 is in progress and no assessment is held. The Department paused Phase 2 third-party assessments on July 13, 2026; the obligation under the 48 CFR rule stands. The platform holds a SOC 2 Type II attestation.
Proofthe 48 CFR CMMC rule and the July 13, 2026 pause.[1]
What does the assessor get instead of a policy binder?
An attestation chain and a key-release record per run, and a receipt stating what ran, where, and that it was sealed. Operator actions are logged. The binder still matters; this is the evidence that sits behind it.
Proofthe Sealed page and the access table on the Security page.
What happens if the designated machine at the second plant fails?
Designate more than one. Failover moves the twin only between the enclaves you named and records the move. It never fails over to an unnamed machine, even if that leaves the work waiting.
Proofthe rule 'never past your policy' on the Reliability page.
What does this cost against building an air-gapped room?
Your devices are yours. The hourly platform charge that schedules, networks, bills and fails over your work on them is quoted in writing. Hosted nodes, for the uncontrolled work, start at $0.024 an hour with no minimum term. Compare it with the build, not with a public cloud list.
Proofthe own-devices answer on the Pricing page and a written quote.[3]
What does it cost to pull out?
The outbound transfer rate, from $0.01 per GB, and nothing else. No exit fee, no minimum term. The devices and the data were yours throughout, and the ciphertext stays on them.
Proofthe transfer bands in the published pricing and the no-exit-fee clause in the contract.[3]
Do we have to open the OT network to the internet?
No. One private network per customer, and nothing in it is reachable unless you publish it. The network carries ciphertext; the enclave you named is the only place it becomes a model.
Proofthe controls list on the Security page.
Is Sealed available for the twin today?
Sealed is available for inference today. Sealed for other workloads, a twin among them, is arranged with an engineer rather than from the console. It is a hardware boundary and a receipt, not a certification; nine USPTO filings are pending, not granted.
Proofthe honest limits on the Sealed page.
How does a three-site pilot start, and what is not included?
Triple X connects devices at three of your sites to one private cloud. The test plan includes a deliberate failed read from an unnamed machine. Not included: your assessor, your system security plan, or GPU capacity, which is on quote.
Proofthe Contact page and a written quote from Triple X for your private cloud.
No questions under this term yet. Ask Triple X.