Plain answers
How a job is sealed
Every job is encrypted to exactly one device with a key that is used once and thrown away. The coordinator moves ciphertext and counts tokens; it does not keep the text. Here is the path a prompt takes.
The path of one prompt
- A buyer sends a prompt to the coordinator over TLS, like any API call.
- The coordinator picks one device for the job and generates a fresh key pair for this job only (X25519).
- It seals the prompt to that device's registered public key (NaCl box) and forwards the sealed job. The device is the only party that can open it.
- The device runs the model and returns the completion sealed the same way, chunk by chunk.
- The coordinator decrypts each chunk only at the relay boundary, in memory, to stream it back to the buyer and count tokens. Nothing is written to disk and nothing is logged.
- The job key is discarded. A later compromise of the coordinator cannot decrypt past jobs.
Who can see what
| Party | Sees |
|---|---|
| The buyer | Their own prompt and completion, which device served it, and the price. |
| The device owner | At the community tier, the owner is not prevented from inspecting the plaintext in memory on their own device. Buyers who need more require the attested tier. |
| The coordinator | Ciphertext in transit, token counts, timing, model, tier and which device. Plaintext exists only transiently at the relay boundary and is never stored. |
| Anyone on the network path | TLS on the outside, a per-job seal on the inside. Nothing readable. |
Trust tiers
- community: signed provider binary and mandatory encryption. Today's default.
- device_attested: Android phones whose keystore, verified boot and lock state were checked against Google's root. A buyer asks for it with one header and pays 1.4×.
- confidential: hardware enclaves; on the roadmap, priced at 3×.
What keeps this honest
- A CI check that fails the build if any code path could log a prompt.
- The public demo shows the entire record the network keeps for a job; search it for a sentence from your text and it is not there.
- Every workload's shape (counts, tier, price, never content) is reviewed by a fail-closed Council whose decisions are published with a hash chain.
- All of it is Apache 2.0. Read the threat model and tell us what is wrong with it.