---
title: "Nitro Enclave Deployment"
description: "Nitro Enclave deployment for the Fystack Cosigner is coming soon."
url: https://docs.fystack.io/cosigner/nitro-enclave
last_updated: 2026-10-14
---

> ## Documentation index
> Fetch the complete documentation index at: https://docs.fystack.io/llms.txt
> Use it to discover all available pages before exploring further.

# Nitro Enclave Deployment

Coming soon

Running the cosigner inside an [AWS Nitro Enclave](https://aws.amazon.com/ec2/nitro/nitro-enclaves/) is in testing and not yet supported for production.

Use [regular mode](https://docs.fystack.io/cosigner/installation.md) today.

## What's planned

_Diagram: Planned Nitro deployment: enclave and host on one EC2 instance linked by vsock, with the host relaying to the Fystack Gateway, DynamoDB and AWS KMS_

- **Enclave**: runs MPC, holds the identity key and decrypts key shares. No network, disk or shell.
- **Host**: untrusted relay for the Gateway stream, storage and KMS.
- **Attested key release**: AWS KMS releases the storage key only to an enclave whose PCR0 matches your key policy.

Result: host admins cannot read key shares.

> **Note:** Need enclave isolation now? Contact Fystack to join early testing.