Betteredge Secure Edge Cloud

Appearance

Getting Started ​

Betteredge Secure Edge Cloud runs confidential workloads inside Trusted Execution Domains (TEDs): verifiable, attested virtual machines.

This guide covers the path from invitation to a running, accessible TED, followed by the day-to-day features available to organization and project users.

Registration ​

Access is invitation-based. An email invitation arrives either for an Organization Admin (when onboarding a new organization) or for a Project User.

  1. Open the invitation email and click the registration link.
  2. The link verifies the invitation token and opens the registration form.
  3. Set a username (pre-filled from the email) and a password.
  4. Multi-factor authentication (MFA) is enabled by default. Scan the displayed QR code with an authenticator application and enter the 6-digit code. MFA can be toggled off, but keeping it on is recommended.
  5. Submit. The browser is redirected to the login page.

When MFA is enabled, the TOTP code is required on every login.

Projects ​

Work is organized into projects. Every user has a default project (marked with a star) and can switch between or create projects from the project dropdown in the top bar.

  • Switch project: click a project in the dropdown to switch into its space.
  • My Projects: view the full project list.
  • Create new: create a project with a name and optional description.

All resources (TEDs, usage, journal) are scoped to the currently selected project.

Inviting Users ​

Invite users from the user management screen. Available roles depend on the inviter's role:

Inviter roleCan invite
Organization AdminOrganization Admins, Project Users
Project AdminProject Users

Enter the invitee's email and send. The invitee receives an invitation email and completes Registration. When the organization uses SSO, the invitation can target the default identity provider (see SSO).

SSH Keys ​

Add SSH public keys to the profile so they can be automatically imported into new TEDs.

  1. Open the profile SSH Keys section.
  2. Click Add key, provide a name, and paste the public key.
  3. Saved keys appear in the list and can be removed at any time.

When creating a TED with SSH access, enable Import SSH keys from all project users to inject all profile keys into the domain automatically.

Create a Trusted Execution Domain ​

Open Create TED and configure:

  1. vCPUs: number of virtual CPUs.
  2. Memory: RAM in GB.
  3. Storage: disk size in GB (SSD).
  4. Operating system: select from the available images.
  5. Access: choose the login method.
    • Password: set a password for the default user.
    • SSH key: paste one or more public keys, and/or enable Include my account SSH keys to import the profile keys.

Submit to start the creation job. The new TED appears in the TED list once provisioning completes.

Module selection is no longer required: placement is handled automatically.

Connect to a TED ​

Open a TED to view its Overview:

  • vCPUs, Memory, Storage, OS, and Status.
  • EUI-64 IPv6 address: the address used to reach the domain (copyable).
  • Copy the default user username.

Connect over SSH using the default user and the IPv6 address:

sh
ssh linux@<ipv6-address>

For a password-based TED, use the password to authenticate; or else authenticate with the imported SSH key.

Port Forwarding ​

By default only the SSH port is reachable. Expose additional services from the TED's Network tab.

  1. Click Add rule.
  2. Choose the protocol: TCP or UDP.
  3. Enter a single port (e.g. 9000) or a range (e.g. 9000:9001).
  4. Click Apply.

Edit or delete existing rules from the same view. Valid ports range from 1 to 65535.

Trust & Attestation ​

The TED's Trust tab provides cryptographic evidence on domain integrity and that it was booted securely.

  • System Firmware: download the OVMF firmware the domain boots from, so it can be inspected and its measurements reproduced.
  • System Boot: each key request proves the domain was remotely attested, obtained a valid key, and decrypted its root filesystem. Each event allows the following:
    • Inspect secure boot state and digests.
    • View the TDX quote and event log.
    • Download the quote for offline verification.

API Tokens ​

Create tokens for programmatic and CLI access.

  1. Open API Tokens under Settings and click New.
  2. Enter a name, select the organization, and choose the scopes the token grants.
  3. Submit, then copy the token.

Pass the token in the X-Token header on each request:

sh
curl -H "X-Token: <token>" https://<platform-base-url>/api/...

Copy the token immediately. It is shown only once and cannot be retrieved later.

Revoke a token at any time from the token list.

Usage Report ​

View resource usage per project or organization.

  • Select a date range.
  • The report lists each TED with its specs, creation date, and status.
  • Click Download PDF to export the report.

Journal ​

The Journal is an audit trail of events in a project or organization.

  • Filter by date range and category.
  • Search across events.
  • Expand any entry to see its full payload.

SSO (Identity Provider) ​

Organization Admins can configure single sign-on under Organization Settings > Identity Provider (OpenID Connect). Set these values from your provider's OIDC / discovery configuration.

  • Client ID and Client Secret
  • Authorization, Token, JWKS, and well-known URIs

Once configured, invitations can target the organization's default identity provider, and users sign in via SSO.

Billing ​

Organization billing details (address, VAT) are maintained under Organization Settings > Billing.