Caution Is Building a Lie Detector for the Cloud

The YC security startup wants production software to prove it is exactly what humans reviewed—before the next trusted machine smiles and empties the vault.

August 24, 2026

In partnership with

10x the context. Half the time.

Speak your prompts into ChatGPT or Claude and get detailed, paste-ready input that actually gives you useful output. Wispr Flow captures what you'd cut when typing. Free on Mac, Windows, and iPhone.

The George Town, Cayman Islands company, part of Y Combinator’s Summer 2026 batch, is building a hosting platform for sensitive workloads. It packages applications into reproducible images, deploys them inside hardware-isolated secure enclaves, and lets customers, auditors, or counterparties verify that the production machine is running the reviewed source, build inputs, configuration, runtime, operating system, and kernel. The company’s slogan could be translated into plain English as: the hash on the corpse matches the hash in the file.

That is useful when the workload handles payment policy, private AI inference, healthcare data, signing keys, fraud decisions, or other machinery where “our security team looked into it” is merely the first sentence of an expensive obituary.

The product: source code enters, proof comes out

Confidential computing is not new. Trusted Execution Environments, or TEEs, use hardware to isolate code and data even from a host operating system or privileged cloud administrator. Remote attestation can produce a signed measurement showing that a particular enclave image is running. The catch is deliciously bureaucratic: a hash proves that the binary matches a hash. It does not automatically prove what human-readable source produced the binary, whether the toolchain was poisoned, or whether the approved code and the deployed artifact are actually kin.

Caution tries to close that evidentiary gap. A developer initializes a project, deploys through a Git-based workflow, and receives an application endpoint plus an attestation endpoint. The platform builds an enclave image deterministically; an independent verifier can rebuild from disclosed source and inputs, compare measurements, and inspect the chain down through the kernel and compiler. Its EnclaveOS runtime is minimal, immutable, open source, and designed for deterministic builds.

For data in transit, Caution offers STEVE—Secure Transport Encryption Via Enclave—which adds an encrypted channel terminating inside the enclave rather than at an ordinary host proxy. The company says this binds encryption keys to attestation so the host sees ciphertext instead of the sensitive prompt, key, or transaction passing through its hands.

The commercial target is a security-conscious engineering or infrastructure team that needs stronger evidence for customers, regulators, partners, or itself. Caution cites fintech, blockchain, regulated data collaboration, private AI, healthcare, key management, and fraud systems. Its current documentation supports managed deployments and bring-your-own-compute deployments in a customer’s AWS account.

The builders have been inside the vault

YC lists three active founders. Anton Livaja is co-founder and CEO. His YC bio says he previously co-founded security consultancy Distrust and worked on systems for hedge funds, custodians, blockchain teams, cloud platforms, and critical infrastructure responsible for more than $600 billion in assets. His stated specialties include confidential computing, software-supply-chain security, and applied cryptography.

Ksenia Lesko leads the business and product side. YC says she previously ran strategy and operations at Distrust and led customer education and activation at Ada. This is less decorative than it sounds. Confidential computing has spent years as a cathedral of acronyms guarded by specialists; turning it into something a buyer can understand, procure, and deploy may be the company’s hardest engineering problem.

Lance Vick is co-founder and CTO. His public résumé stretches across more than two decades of security and infrastructure work, including security leadership at Turnkey, BitGo, Unit 410, and Pebble. At Turnkey he says he prototyped a multi-party-controlled cloud enclave and implemented deterministic, full-source-bootstrapped enclave builds. He also founded the Stagex Linux distribution and the Hashbang community, and lists lockpicking among his physical-security skills—a biographical detail so perfectly calibrated for this company that a novelist would be told to tone it down.

YC lists Brad Flora as Caution’s primary partner. The YC bio links Lesko’s and Livaja’s LinkedIn profiles and Vick’s personal site. It does not list a founder Twitter/X profile for Lesko, Livaja, or Vick. The page does link Caution’s company accounts on LinkedIn and X, but those are not founder-profile links.

Traction, with the sirens switched off

Caution says it is in production and onboarding customers in crypto infrastructure, blockchain labs, digital-asset lending, consumer hardware, post-quantum security, and private AI inference. It says the team’s prior Distrust work covered systems responsible for more than $600 billion in assets. Those are company claims, not independently audited traction.

The public material reviewed does not disclose customer names, revenue, funding, deployment count, retention, pricing, or a third-party security assessment. Its February 2026 demonstration runs an LLM inside an enclave and lets a verifier reproduce the deployed stack; Caution calls it the first fully source-bootstrapped, deterministic, end-to-end encrypted, verifiable AI inference deployment. The demo is CPU-based and explicitly not optimized for production performance. That caveat is healthy. Security theater thrives on benchmarks that arrive wearing fake mustaches.

Today, the production story is narrower than the vision. Caution supports AWS Nitro Enclaves. Intel TDX, AMD SEV-SNP, TPM 2.0, NVIDIA confidential computing, and broader cloud support are described as coming or in active development. The company ultimately wants multi-hardware attestation so a flaw or compromise in one vendor’s root of trust does not become the single trapdoor under the entire proof.

The competitors also know how to spell “attestation”

The category is not an empty alley. Anjuna sells Seaglass as a universal confidential-computing platform spanning major clouds, with policy-based attestation and workload isolation. Fortanix offers a control plane for confidential computing across CPU and GPU infrastructure, emphasizing enterprise operations, policy, and attestation-gated key release. Edgeless Systems’ Contrast runs Kubernetes workloads inside confidential VMs, uses hardware attestation, and relies on open-source components and reproducible builds.

Cloud vendors themselves provide Nitro Enclaves, Azure confidential computing, and Google Cloud confidential VMs. Open-source projects such as Enarx, Gramine, Kata Confidential Containers, and industry standards continue to improve the plumbing. Caution’s wedge is not merely “we put code in an enclave.” It is an opinionated developer workflow joining reproducible source-to-image builds, verification, enclave deployment, and end-to-end encrypted transport—open enough that the vendor is not supposed to become another object of faith.

That wedge must remain sharper than the incumbents’ roadmaps. The security industry is full of features that begin as insurgencies and end as checkboxes in a cloud console.

The risks are hiding in the trusted base

The first risk is the hardware root. Caution’s own threat model says current AWS Nitro deployments ultimately trust the attestation hardware and its chain. If AWS or the hardware root lies, the proof becomes a very elegant receipt for fiction. Multi-hardware verification could reduce that risk, but it is not the general production reality described today.

Second, reproducibility proves correspondence, not goodness. If reviewers approve vulnerable application code, a malicious dependency, or a foolish configuration, Caution can faithfully prove that the approved disaster is running. The platform explicitly does not determine whether application logic or source inputs are safe. A perfect chain of custody cannot improve the contents of the package.

Third is usability. Rebuilding an enclave image, checking source provenance, managing keys, understanding PCR measurements, and interpreting attestation evidence are not ordinary habits for most application teams. If verification remains the ritual of one security priest during procurement, the product risks becoming expensive ceremonial armor.

Fourth is performance and compatibility. Enclaves impose hardware constraints, memory and I/O tradeoffs, debugging friction, and cloud-specific operational complexity. The customers with the most sensitive workloads may also be the least willing to move them onto an early platform.

Finally, there is open-source economics. Caution says the platform is fully open source under AGPLv3 plus a commercial license, with hosted service and support as the business. That can build trust and adoption. It can also compress differentiation unless the managed experience, verification network, and engineering pace become difficult to copy.

Why it matters

Software security has traditionally asked organizations to trust a chain of humans and machines long enough to transact. Sign the release. Protect the laptop. Harden the pipeline. Restrict root. Audit the vendor. Then send the valuable data into a server and hope the black box has manners.

Caution’s bet is that increasingly automated, hostile, and regulated infrastructure needs a different primitive: proof attached to the running service. Not a policy document. Not a badge. Not a sales engineer saying “military-grade” while a slide glows blue. Evidence that the software operating now is the software somebody actually examined.

The company is early, the hardware trust has not vanished, the competitive field is armed, and the public traction remains qualitative. But the direction is important. AI agents are being handed credentials, financial authority, health records, and production access at precisely the moment software supply chains are becoming faster and harder to inspect. The old trust model is staggering toward the future with a clipboard and a SOC 2 report.

Caution wants to put the server under oath.

That is not the same as making it honest. It is, however, a fine way to catch it changing its story.

Sources and factual notes

All customer, asset-value, performance, novelty, and roadmap statements are attributed to the companies making them unless otherwise noted. The profile was prepared August 19, 2026. It was not published.

Your customer messaged on Instagram. You never saw it.

Your customers reach out on the channels they already use — Instagram, Facebook Messenger, WhatsApp, SMS — and when no one's there to answer, they move on to a business that was.

Wati connects those channels into one inbox with AI-powered automations that help you reply the moment a message lands. So you show up where your customers already are — and never leave them waiting.