Certificate Theft Is Now
Physically Impossible
Hardware-bound certificates make digital identities physical. Even if attackers steal the certificate file, it's useless without the physical device present and online (continuous heartbeat).
What Hardware Binding Protects Against
| Attack Scenario | Traditional Cert | Hardware-Bound |
|---|---|---|
| Certificate file stolen | Compromised | Useless without device |
| Server hacked | Attacker uses cert | Device must be present |
| Insider copies cert | Employee leaks | Can't forge PUF |
| Memory dump | Cert extracted | Requires live device |
| Backup leaked | Cert recovered | No device = no signing |
Bind New Hardware Device
Connect a TerraLink Hardware Key to enable physically-bound certificates
Your Hardware Devices
Loading devices...
Real-World Use Cases
Financial Services
"Even if hackers breach our servers, they can't sign transactions without physically stealing the device from our vault."
Healthcare
"Patient record certificates are hardware-bound. If a laptop is stolen, the certificates stop working instantly."
Government
"Classified document signing requires physical possession of the hardware key in a SCIF. No remote compromise possible."
Enterprise CI/CD
"Production deployments require the hardware key to be present in the secure room. Build server compromise can't deploy."
Why Hardware-Bound?
Unfakeable
Proof only works with the USB key present. Can't copy, can't clone, can't replay.
Live
Continuously re-checks—not "verified once." See "Last proof: 42s ago" in real-time.
Simple
Plug in → click Certify → badge shows "Hardware‑Bound". That's it.
See It Work
"Unplug it. Plug it back in. It still verifies as the same device."
Dead-Simple Onboarding
Plug in TerraLink Key
USB-A or USB-C. Works with any computer.
Click "Bind to Certificate"
In your TerraLink dashboard. One click.
Badge shows "Hardware‑Bound"
Instant upgrade. Continuous verification.
Who Needs Hardware‑Bound Trust?
Anyone who needs to prove "this is the real thing, running right now, on approved hardware."
AI Agent Operators
Pain: "My agent can be copied/spoofed, and I can't prove runtime integrity."
Solution: Add TerraLink Key and your badge becomes hardware-backed.
Platforms & Marketplaces
Pain: "Need to verify real sellers/agents, not impersonators."
Solution: Hardware-bound identity proves "real seller" on your platform.
Crypto / API Teams
Pain: "API keys get stolen and reused elsewhere."
Solution: Keys that only work when TerraLink Key is present + alive.
Software-Based Device Locking
Use built-in TPM/Secure Enclave for device-locked authentication. No external hardware required. Works on all modern laptops and phones today.
DLPK (Available Now)
Built-in TPM/Secure Enclave
No additional hardware needed
Works on all modern devices
Hardware counter for replay protection
Free tier available
No continuous liveness monitoring
External Key (Q1 2026)
Physical PUF hardware
All DLPK features
Continuous heartbeat monitoring
Trajectory-based tamper detection
Air-gapped high security
Requires physical device ($99+)
Simple Pricing
Hardware unlocks subscription. Not selling a stick—selling an upgrade.
Dev Kit
For pilots and proof-of-concepts
- 1 TerraLink Key
- Hardware‑Bound badges
- 1,000 hardware certs/mo
- Live proof dashboard
- Priority support
Production
For production deployments
- Volume pricing
- Everything in Dev Kit
- Unlimited hardware certs
- SLA available
- On-prem verification
Join the Hardware Beta
Be first to get TerraLink Key. Ships Q1 2026.
We'll email you when beta units are ready. No spam.
Common Questions
Why do I need hardware?
Because software proofs can be copied. TerraLink Key makes the proof physically unique—it only works with that specific device, right now.
Is this like YubiKey?
Same simplicity (USB trust key), but aimed at certifying AI/services continuously—not just logging in once.
Do I need to change my stack?
No—TerraLink stays exactly the same. Hardware just upgrades your existing certificate to "Hardware‑Bound".
What happens if I unplug it?
Badge drops to "Not live" immediately. Plug it back in, and it verifies as the same device. That's continuous trust.
What can you claim now?
- ✓ Hardware-bound identity survives unplug/replug
- ✓ Quantum-safe signing and verification
- ✓ Keys persist across power cycles
- ✓ ~0.5s operations (human-friendly UX)