ARCHITECTURE
Four stops on the way.
What each can see.
A message you send in the workspace passes through your browser, our relay, Tinfoil’s router enclave and the enclave where the model runs. Choose a stop to see what runs there, what it can and can’t see, and the code that does it.
Your words readableOnly ciphertext
Your browser checks the enclave, then seals the message.
What runs here
The workspace, and Tinfoil’s open-source verifier (the tinfoil SDK). Before the first message it fetches the enclave’s attestation, checks the chip’s signature on it, and checks that the code it measured is a release Tinfoil published to Sigstore’s public transparency log. Then it seals each request to the key that attestation names: EHBP, which is HPKE with X25519 and AES-256-GCM.
Can see
- Everything you write, attach and get back. It’s your device.
- Which enclave it verified, and a receipt for each answer.
Keeps
- Nothing is hidden from you here. Conversations stay in this browser, in memory or in its storage if you turn saving on; copies you sync or share are encrypted here first.
Where the excerpts come from
The build reads each one from the source file it names, at those lines, so the code here is the code this site was built from. Our repository isn’t public yet, so it’s shown here instead of linked. The build’s manifest hashes every file the site serves, these excerpts included; Verify this page checks the code your browser loaded against it. Tinfoil publishes its verifier and the code its enclaves run as open source.
Two other paths
The developer API is different: our gateway reads each request in memory to check it, then sends it to the enclave the same way, and never stores or logs it. The small model “On this device” runs in your browser, and nothing you send it leaves the device.
What this doesn’t show
None of this has been independently assessed yet, and you’re trusting us to serve the verifying code as published. The privacy page has the full detail, and the transparency page our counts and scheduled checks.