Takes an OpenTofu state snapshot and a passphrase, encrypts the snapshot through the pinned OpenTofu state-encryption code, then proves the result three ways: the authorized key recovers the state with an identical semantic hash, a wrong key is rejected, and a tampered payload is rejected. What comes back is the encrypted artifact plus those proofs and the resource-instance count, never the plaintext.

Payment Options