PRESS
Writing about Undergrove?
Start here.
Facts that hold today, words you can copy, the film, screenshots and the brand kit. Everything here is free to use in coverage of Undergrove.
The facts
- Models
- Open-weight models from several labs, listed live on the models page.
- What it is
- A private AI workspace and an OpenAI-compatible developer API, on open-weight models. →
- Where models run
- In hardware enclaves operated by Tinfoil, on one declared route per model. →
- How requests are protected
- In the workspace, each request is encrypted in the browser to an enclave whose attestation the browser has checked. The developer API’s gateway reads requests in memory to check them and doesn’t store them. →
- Availability
- Live models in a private alpha. Anyone can try the workspace with labelled sample answers, a scripted tour, and a small model that runs in the browser. →
- Languages
- The site and the workspace in English, Spanish, German, French, Portuguese, Italian, Japanese, Korean, Chinese, Arabic and Hebrew.
- Not yet
- No independent security assessment or certification, and no data processing agreement yet. →
- Website
- undergrove.vercel.app
- Press contact
- Not published yet. It will be listed here, beside the privacy contact, before paid launch.
In a sentence, and in a paragraph
Undergrove is a private AI workspace and API on open-weight models. Models run in hardware enclaves operated by Tinfoil; before the workspace sends a request, your browser checks the enclave’s attestation and encrypts the request to it.
Undergrove is a private AI workspace and an OpenAI-compatible API on open-weight models such as GLM-5.3, Kimi K3 and Gemma 4, which run in hardware enclaves operated by Tinfoil. Before the workspace sends a request, your browser checks the enclave’s hardware attestation against Tinfoil’s published release and encrypts the request so that only that enclave can read it; Undergrove’s relay passes on ciphertext. The workspace adds web search with citations, documents and codebases, Python that runs in the browser, model races, deep research and end-to-end encrypted shared projects. Live models are in a private alpha; anyone can try the workspace with sample answers.
Getting the claims right
Privacy is easy to overstate. These are the words that match what the code does; how verification works explains why.
| Say | Rather than |
|---|---|
| “encrypted in the browser to a hardware enclave it has verified” | “100% private”, “zero-knowledge” or “nobody can ever see your data” |
| “end-to-end encrypted” for shared projects and sync | “end-to-end encrypted” for the developer API, whose gateway reads requests |
| “open-weight models” and the models’ names | “open source” for every model, or naming models we don’t offer |
| “not yet independently assessed” | “audited” or “certified” |
The film
Sixty seconds, silent, with captions in the picture: a model race, the Verified check, an answer with formulas and a chart, Python on a spreadsheet, tracked changes, a shared project, time travel and the command palette.
Recorded in the workspace; answers scripted for the recording, some clips sped up. The Verified checks ran in the browser against a recorded attestation.
Screenshots
The real workspace and site, with answers scripted for the recording; each image says so in its corner. Please keep that label when you use them.
