Trust starts with infrastructure you can inspect. Explore our operating Brisbane cluster and the security architecture guiding future deployments.
This website uses a publicly trusted certificate. You do not need to install an Aloom certificate to read it.
ALOOM TRUST / DEPLOYMENT DESIGN
Identity. Controls. Verifiable evidence.
SECURITY ARCHITECTURE / DEVELOPMENT
Status summary only. Public web PKI and Stage-0 telemetry do not establish a customer-production trust chain, certified control set or SLA. Production controls remain configuration-specific and require accepted evidence. Detailed current posture, target controls and the six required gates follow below.
What is live today
Public website. Served over the public web PKI so any visitor can inspect the site without changing a device trust store.
Moorooka telemetry. A public allowlist exposes coarse accelerator power, load, memory and thermal measurements when the feed is current. The feed is operator-published and unsigned. Inspect the live feed below.
Controlled interfaces. The browser chat demonstration is paused. No reusable service credential is delivered in public JavaScript.
No production assurance claim. Stage-0 operation does not establish a customer-production root, trust bundle, public attestation, certified security control set, production trust chain or SLA.
The Brisbane RTX 4090 cluster
connecting…
Our Brisbane RTX 4090 cluster publishes GPU measurements every 60 seconds. Inspect utilisation, memory, power and temperature directly from the source.
Accelerator.—
GPU use.—
GPU memory.—
GPU-rail power.— · —
Junction temperature.—
GPU-level telemetry; facility and service measurements are assessed separately. Explore the larger architecture under Systems.
The production design is configuration-specific. It must bind an identified operator, customer, workload, location, hardware state and data-flow policy to evidence the customer can inspect.
Explicit identity. Legal entity, service names and certificate scope match the contracted deployment.
Separated keys. Transport identity, code signing and workload attestation do not share one root key.
Offline root control. Root material is generated and retained under a documented offline ceremony with recovery and revocation procedures.
Short-lived service credentials. Online intermediates issue narrowly scoped certificates with observable rotation.
Independent verification. Fingerprints and evidence are delivered through a second authenticated channel, not merely repeated on the same website.
This is the design target. It is not a statement that those production controls are operating today.
Before the first customer production deployment
Identity closure. Confirm the contracting entity, DNS names, service boundary and certificate policy.
New root ceremony. Generate production root material offline; retire the Stage-0 experimental root.
Key separation. Establish independent transport, signing and attestation hierarchies.
Security review. Review the threat model, certificate profiles, name constraints, revocation, recovery and operator access.
Customer trust pack. Supply the chain, fingerprints, ceremony record, verification commands and incident contacts through agreed channels.
Acceptance evidence. Demonstrate the controls against the selected deployment before a production claim or SLA begins.
All six gates are required and none is declared complete. This list does not imply a named site, delivery date, certification or SLA.
Verify before relying.
Aloom will publish or supply only the evidence that matches an accepted deployment configuration. If you are assessing a C250, MW1 or MW50 project, include security, residency, retention and attestation requirements in the site study.