Setting up your first secure server

Before you begin

Provisioning begins after your capacity agreement is signed. Before you start, your organization will have a capacity allocation, a defined authorization boundary, and at least one administrator account in the Client Portal.

You will need the administrator account, an SSH public key for the initial operator, and the network plan agreed during onboarding. If any of these are missing, contact your deployment engineer directly for the fastest resolution.

Provisioning steps

1. Select the allocationIn the Client Portal, open Allocations and choose the region and hardware profile from your agreement. Only profiles included in your allocation are shown, which prevents provisioning outside your agreement.
2. Define the hostGive the host a name, attach the SSH key for the initial operator, and confirm the storage profile. Names cannot be changed after provisioning, because they appear in attestation and audit records.
3. Attach networkingAssign the host to a segment from your network plan. If the workload requires a private interconnect or a site-to-site tunnel, configure it now rather than after the server first starts.
4. Confirm and launchReview the summary, then confirm. Physical provisioning takes time: each server is installed, its firmware is configured, and its operating system is written before it is available. The status will progress through Allocated, Baselining, and Imaging before it shows Ready.
5. Verify the launch measurementWhen the status shows Ready, retrieve the attestation report and verify its signature before storing any data. This step confirms that the server is exactly what you requested.

Verify before use

Always complete verification, even when the portal shows Ready. The portal status reflects our management system's view of the server. The attestation report comes from the server's own processor, describing exactly what it started, and is signed with a key the virtualization software never holds.

Retrieve the report and compare it with the expected measurement for your hardware profile:

curl -sS \
  -H "Authorization: Bearer $SERVLOGI_TOKEN" \
  https://api.servlogi.com/v1/hosts/$HOST_ID/attestation \
  > report.json

servlogi-verify report.json --profile enclave-gen4

If verification fails, stop and open a P1 incident with the Security Operations Center. A failed measurement is treated as a potential platform integrity event.

What happens next

Once verified, the server is ready for you to configure. Because it is not shared with any other customer, security hardening decisions are entirely within your control and are your responsibility.

Your inherited baseline covers the facility, hardware, firmware, and virtualization software. It does not cover your operating system configuration or your application. The control responsibility matrix in your onboarding package defines this division precisely.