Trusted Execution for Auctions
How CloudX uses an isolated AWS Nitro Enclave to make protected auction execution independently verifiable.
Think of a Trusted Execution Environment (TEE) as a sealed room for auction ranking. CloudX can send eligible bids and auction settings into an isolated AWS Nitro Enclave, where CloudX’s source-available logic selects the result. The enclave produces cryptographic evidence so supported verifiers can validate the enclave image and check the reported outcome against the evidence for that round.
How a protected round works
Collect eligible bids
CloudX sends normal bid requests and collects responses for a TEE-enabled auction round. Existing timeout and privacy rules apply. A bid selected by the enclave can still fail later response or creative validation before delivery.
Rank bids in isolation
The enclave applies the round’s configured adjustments and floor, ranks eligible bids, and selects the winner. Supported buyers can optionally encrypt only the bid price so the host cannot read it before enclave processing. Unencrypted prices remain visible in the normal OpenRTB flow.
Attest the result
A successful enclave execution produces an AWS Nitro attestation containing enclave measurements, cryptographic commitments to processed bids and configured adjustments, and signed floor, winner, and runner-up details. Supported verifiers can check the AWS certificate chain, enclave measurements, and signed evidence.
What buyers can rely on
- Isolated execution. Bid ranking for a protected round runs inside an AWS Nitro Enclave, separated from the host operating system.
- Inspectable logic. The OpenAuction source is publicly available under the Elastic License 2.0.
- Verifiable execution. Signed attestation evidence lets supported verifiers compare the measured enclave image with expected measurements.
- Fail-closed ranking. When Auction TEE is enabled, a failed enclave execution does not fall back to local ranking.
- Optional price privacy. Supported buyers can protect only the bid price until enclave processing. The resolved winner and runner-up values return to CloudX host services with the result; other bid metadata and creative content remain part of the normal OpenRTB flow.
- Existing integration compatibility. Buyers that do not use TEE-specific capabilities continue to use the standard CloudX OpenRTB contract.
The highest raw CPM is not always the effective winner. Configured auction rounds, price floors, bid adjustments, validation, and random tie-breaking still apply. See Auction Dynamics for the ranking model.
Auction TEE and Trusted Arbiter
These capabilities use trusted execution for their protected decision paths, but they make different decisions:
| Capability | What it decides |
|---|---|
| Auction TEE | Ranks eligible bids within one CloudX auction round. This is the buyer-facing capability described on this page. |
| TEE 2.0 / Trusted Arbiter | Compares already-loaded candidates from CloudX and supported third-party sources after their separate auctions. It is a publisher-side SDK capability, not a new OpenRTB version. |
Trusted Arbiter uses a local fallback when its service is unavailable or times out: the SDK selects the highest comparable USD bid among the supplied candidates. A single candidate wins without a service call.
Read the TEE introduction for the original auction design and TEE 2.0 for the Trusted Arbiter model. Publishers can follow the platform-specific Trusted Arbiter guides for Android, iOS, React Native, or Unity.