A computer-implemented method of enabling a server computing device (101, 601) to determine if a software application executing on a client computing device (104, 603) has not been tampered, the method comprising the steps of: executing software on the server device (101, 601) that communicates either directly or indirectly with an attestation server device; running a client software application on the client computing device (104, 603) that communicates with the same said attestation server device; calculating by the client software application a cryptographic hash fingerprint of its executing code image, wherein the cryptographic hash fingerprint is communicated to the attestation server device to prove that the client software application is untampered; generating by the attestation server device a pass or fail attestation result; communicating the attestation result between the attestation server device and the server computing device (101, 601) by means of a signed token; wherein the communication between the attestation server device and the server computing device (101, 601) is communicated indirectly via the client computing device (104, 603), including using the signed token provided from the attestation server device to the client computing device (104, 603), in which: a shared secret key is known by the attestation server device and the server computing device (101, 601) but not by the client computing device (104, 603); wherein the secret is used to sign the token such that the signed token proves that the signer is in possession of the secret key; and receiving by the server computing device a request for services and/or data and the signed token from the client computing device, and controlling the behaviour of the server computing device (101, 601) in a way that is conditional on whether the prior attestation result of the client software was a pass or fail attestation result, wherein the server computing device (101, 601) refuses to provide requested services and/or data to the client computing device (104, 603) if the client computing device (104, 603) has failed attestation. executing software on the server device (101, 601) that communicates either directly or indirectly with an attestation server device; running a client software application on the client computing device (104, 603) that communicates with the same said attestation server device; calculating by the client software application a cryptographic hash fingerprint of its executing code image, wherein the cryptographic hash fingerprint is communicated to the attestation server device to prove that the client software application is untampered; generating by the attestation server device a pass or fail attestation result; communicating the attestation result between the attestation server device and the server computing device (101, 601) by means of a signed token; wherein the communication between the attestation server device and the server computing device (101, 601) is communicated indirectly via the client computing device (104, 603), including using the signed token provided from the attestation server device to the client computing device (104, 603), in which: a shared secret key is known by the attestation server device and the server computing device (101, 601) but not by the client computing device (104, 603); wherein the secret is used to sign the token such that the signed token proves that the signer is in possession of the secret key; and receiving by the server computing device a request for services and/or data and the signed token from the client computing device, and controlling the behaviour of the server computing device (101, 601) in a way that is conditional on whether the prior attestation result of the client software was a pass or fail attestation result, wherein the server computing device (101, 601) refuses to provide requested services and/or data to the client computing device (104, 603) if the client computing device (104, 603) has failed attestation. a shared secret key is known by the attestation server device and the server computing device (101, 601) but not by the client computing device (104, 603); wherein the secret is used to sign the token such that the signed token proves that the signer is in possession of the secret key; and receiving by the server computing device a request for services and/or data and the signed token from the client computing device, and controlling the behaviour of the server computing device (101, 601) in a way that is conditional on whether the prior attestation result of the client software was a pass or fail attestation result, wherein the server computing device (101, 601) refuses to provide requested services and/or data to the client computing device (104, 603) if the client computing device (104, 603) has failed attestation.