Caution, a Cayman Islands company in Y Combinator's Summer 2026 batch, is selling a hosting platform that lets teams deploy sensitive software into AWS Nitro Enclaves with a short git-based workflow, then demonstrate to anyone what code is actually executing. It describes the service as a "hosting platform for software you can't afford to have hacked," according to its Launch YC post.
The pitch rests on a problem familiar to security engineers: open source code tells you little about what a server is running at any given moment. Caution says it closes that gap.
How verification works
According to the company's website, Caution links live enclave measurements to reviewed source code, pinned build inputs and configuration. Outside parties can check the result with a command-line tool called "caution verify."
The workflow takes three commands. A developer runs "caution init," pushes code with "git push caution main" to trigger a build, and then runs "caution verify" to compare the live attestation with the expected measurements.
Under the hood, the tool rebuilds the software independently from source, toolchain included, using StageX, to derive what the measurements should be. It then compares those figures with the live attestation (for Nitro, PCR values, which are cryptographic fingerprints of the enclave's contents) and fails closed on a mismatch, meaning it rejects rather than permits an unverified result. That description comes from Caution's September 21 post on MPC cosigners.
"True verifiability means getting cryptographic proof tying the current runtime to the desired code, not just opening code and hoping that's what's running," Anton Livaja, co-founder and CEO, wrote in an October 16 blog post.
Encryption that ends inside the enclave
Caution's encryption layer is called STEVE, for Secure Transport Encryption Via Enclave. It terminates end-to-end encryption inside the enclave itself. Version 2, released August 25, ties fresh attestation to each session.
"This release binds fresh attestation evidence directly to each session, so application data flows only after the client verifies that the attested enclave holds the session keys," wrote Vincent Kobel, chief product officer and founding engineer. Caution's documentation argues that TLS alone falls short if it ends outside the enclave.
Three deployment models, no listed prices
At launch, Caution offers three arrangements: bring your own compute (BYOC) in a customer's AWS account, a fully managed version hosted by Caution, and self-hosting. In the BYOC model, Caution manages the enclave lifecycle and verification workflow while the data stays in the customer's account.
The self-hosted platform is open source under AGPLv3, and a commercial license is also available. The company says the platform is open source throughout, so verification does not depend on trusting Caution. Its public Forgejo server showed repositories for the platform, STEVE and EnclaveOS, each updated between October 15 and 22.
The pricing page names the options but showed no dollar figures as of October 27.
Release notes dated October 20 added opt-in blue-green deployments (a method of switching between old and new versions with minimal downtime) for managed and BYOC setups. They also added quorum creation using OpenPGP and passkeys, and tighter enclave firewall controls with ingress and egress allowlists.
Nitro first, other hardware later
Nitro is the only platform supported today. Caution's homepage says attestations for Intel TDX, AMD SEV-SNP and TPM 2.0 are due in 2026, and the Launch YC post lists NVIDIA Confidential Computing as coming soon.
The company points to a long list of target workloads: AI inference over sensitive data, healthcare records, custody and key systems, MPC cosigners, oracles, staking infrastructure, and policy and fraud engines. The Launch YC post, published around July, said Caution is "in production and onboarding customers" in crypto infrastructure, digital asset lending, consumer hardware, post-quantum security and private AI inference. It named none of them.
Caution's security page maps its evidence to NIST CSF 2.0, ISO/IEC 27001, SOC 2 and NIS2. The company states plainly that these mappings are not certifications.
The team
Livaja is CEO, Lance Vick is CTO and Ksenia Lesko is COO. Kobel and Ryan Heywood are security engineers. Y Combinator's directory lists a team of five. The company traces its origins to the security consultancy Distrust, and YC's listing cites earlier work with BitGo, Turnkey, Coinbase, OpenZeppelin and StageX Linux.
A crowded field
The launch arrives as larger vendors push the same idea. Google Cloud announced general availability of Confidential G4 GPUs with NVIDIA Blackwell on October 21, across 36 zones. Cohere announced confidential computing for Model Vault on Azure H100 around October 22. Microsoft made Azure Enclave generally available for government and regulated industries on October 13.
Specialist vendors include Anjuna, Fortanix, Edgeless Systems and OPAQUE. Fortanix announced Confidential AI on March 18.
Funding details are sparse. VCBacked lists a $500,000 pre-seed from Y Combinator, but that figure is unconfirmed beyond the listing, and Caution has not announced a round.
The next test is breadth of hardware. Caution says support for TDX, SEV-SNP and TPM 2.0 is due in 2026, and Kobel wrote that the long-term goal is the same verification flow across Nitro, SEV-SNP and TDX.
