1 · Attest
Every confidential turn starts by fetching the enclave's Intel TDX + NVIDIA confidential-computing evidence and binding it to a nonce we just generated.
attested · end-to-end encrypted · local-first
Private AI you can verify, not just believe.
Prompts are encrypted in your browser and decrypted only inside a hardware enclave. Before anything is sent, we fetch the enclave's attestation and check it — and so can you, right here on this page.
See the live attestation Start chatting
Free tier · no card · chats stay on your device
Live enclave attestation
Fetching a fresh attestation with a new nonce…
| check | result | detail |
|---|
Generated by GET /api/attestation?model=… — a fresh 32-byte nonce per fetch,
verified server-side and reported here verbatim. Full report: /proof.
2 · Verify
Ten checks run before a single token is sent: quote validity, certificate chain to a pinned root, GPU signature, signing-address and nonce binding, key shape, and enclave measurement pinning.
3 · Encrypt
Messages are sealed with secp256k1 ECDH → HKDF-SHA256 → AES-256-GCM. What leaves this server is ciphertext; even we cannot read the answer.
Your conversations stay on your device.
History is stored locally. Cross-device sync uploads ciphertext sealed with a passphrase we never see.
Open the app See pricingWhat we don't claim
- We don't run the hardware. Enclaves are operated by our inference provider; the attestation is what tells you which image is running, and we pin it across requests so a swap gets noticed.
- Verification depends on this server's honesty. The report above is produced by an endpoint we control. For an independent check, run
node scripts/e2ee-check.mjsfrom the repository against the provider directly. - Only confidential models are end-to-end encrypted. Standard models are still private by contract but the provider sees the prompt in plaintext in-process.
- Buckets, not magic. Rate limits and plans still exist; encryption protects content, not your usage metadata.