Below the OS
TPM state lives in silicon, not in the filesystem. An attacker who images the disk gets the sealed files — but not the hardware anchor they were bound to.
SECURITY ARCHITECTURE
TPM 2.0 Binding
On guarded fleets, licenses can be anchored to the machine's Trusted Platform Module — a dedicated security chip whose state cannot be cloned by copying a disk.
A hardware root of trust
A TPM (Trusted Platform Module) is a dedicated security chip present on modern servers, workstations and industrial PCs. It holds cryptographic state that the operating system cannot extract and a disk image cannot carry away.
Machine identity, not file identity
Binding to TPM state ties the license to the physical machine. Cloning the environment to a second box leaves the license unverifiable.
Tamper-evident by design
Hardware-rooted measurements change when the boot chain or platform configuration is altered — a machine that has been rebuilt no longer presents the same trust state.
How binding strengthens machine locking
Standard OnionZero licenses already pin to a hardware/OS fingerprint. TPM binding adds a second, hardware-rooted factor for high-value deployments.
Fingerprint + hardware anchor
The license is matched against both the machine fingerprint and the TPM security state. Both must agree for the license to verify.
Clone resistance
A copied VM or restored image presents the same software environment but a different TPM — the mismatch is detected at verification time.
Re-issue, not workaround
Moving to genuinely new hardware follows the vendor-controlled re-issue (or signed reset token) flow — the same governed path as standard licenses.
Built for guarded fleets
TPM binding is aimed at deployments where each machine is provisioned, audited and accounted for — not at mass-market shared hosting.
- Enterprise server fleets with standardized TPM 2.0 hardware
- Industrial PCs and kiosks deployed to customer sites
- Regulated environments that require hardware-rooted device identity
- High-value licenses where a single leaked copy is a serious incident
BEYOND PHP
The same guarantee beyond PHP
OnionZero PE/Binary and Android protection seal ready-made .exe/.dll binaries and Android APKs under the same security architecture:
- PE/Binary protection derives its sealing key from the device anchor — hardware-rooted factors, TPM included where present, decide whether the protected program can be decrypted at all.
- A copied binary or cloned image presents a different anchor; the sealing key simply does not resolve off the bound machine.
Anchor your licenses to hardware
Tell us about your fleet — we will assess whether TPM binding fits your deployment tier.