TRUST CENTRE
For buyers.
What’s in place, and what isn’t yet.
Each claim links to the page or the code behind it.
At a glance
In placeEncrypted to the enclave
How we know
In the workspace, your browser checks the model enclave’s attestation and encrypts each request to it. Our relay passes on ciphertext it can’t read.
In partDeveloper API
How we know
The gateway reads API requests in memory to check them, then sends them to the enclave over an attested connection. It doesn’t store or log them.
Not yetIndependent assessment
How we know
No audit, penetration test report, SOC 2 report or ISO 27001 certificate yet. What exists is open to check: the code your browser runs, a formal model and a challenge.
Not yetData processing agreement
How we know
Not offered yet. The terms are drafts, and the operator’s identity and privacy contact will be published before paid launch.
In partUptime
How we know
Checked live and on a schedule, with the results public. There’s no service level agreement.
In placeSingle sign-on and provisioning
How we know
Shared projects can require sign-in through your identity provider (OpenID Connect) and take users from it by SCIM. SAML isn’t supported.
Read the full textHide the full text
01 · Security
How requests are protected
The workspace and the developer API protect requests differently, and every page below says which one it means.
Before the workspace sends anything, your browser checks the enclave’s hardware attestation against Tinfoil’s published release, then encrypts the request (HPKE) to a key held inside it. Our relay checks your allowance and passes on ciphertext.
Each answer can carry a receipt: the enclave, release and measurements your browser verified, and the key it encrypted to. It’s your browser’s own record, not a signed statement.
Who could see what, for our hosting, us, Tinfoil, the network and a court order, with the files that make it so.
The page’s own code can be checked: compare what your browser loaded with the build’s manifest, signed in GitHub Actions, rebuild it yourself, and read the software bill of materials.
The browser calls only this site: no third-party scripts, analytics or fonts. Python, JavaScript and on-device models run in workers whose network access is removed, each with its own content security policy.
Shared projects are end-to-end encrypted. The protocol that hands out and changes their key has a formal model, checked with the Tamarin prover, in the source under docs/proofs.
Logs hold route names, status codes and timings: never prompts, answers, account IDs or keys. Tests check this.
02 · Data
What’s kept, and for how long
Conversations stay in the browser unless you choose otherwise. What our servers keep:
Limit counters: requests and estimated spend under a one-way hash, with no content, for up to two days.
Sync: each item encrypted in your browser with a key only your devices hold, until you delete it. We see sizes and times.
Shared links: an encrypted copy for 1, 7 or 30 days, or until first opened; the key is after the # and never reaches us.
Shared projects: ciphertext, membership, roles and an audit log of who changed what (never content), kept for 90 days by default.
Where it’s processed: there’s no EU or US choice yet. Tinfoil doesn’t publish where its enclaves run, and our hosting and database each run in one region set in their project settings, not chosen per account. We’ll offer a choice only once the region can be checked, not just stated.
Crash reports and speed figures: only after you say yes, with no content, account or address; crash reports are counted by error for 90 days.
03 · Subprocessors
Who handles data for us
These services handle data on Undergrove’s behalf. Your own identity provider, if your team connects one, isn’t ours to list. We’ll announce a new service in the changelog before it handles data.
| Service | What it does for us | What it can see | When |
|---|---|---|---|
| Tinfoil | Runs every model in hardware enclaves: chat, document conversion, transcription, speech, embeddings, and web search from inside the enclave. | Requests are decrypted only inside an enclave whose attestation was checked. Tinfoil states it can’t access its enclaves and that nothing in them persists between restarts. | Every live answer |
| Vercel | Hosts the site, the relay and the developer API’s gateway. | Ordinary request details, including IP addresses, under its own logging and retention. Workspace requests pass through as ciphertext; developer API requests are read in memory by our gateway, which runs here. | Every visit and request |
| Upstash | Our database: API keys, limit counters, billing records, and the encrypted copies behind sync, shared links and shared projects. | Hashed keys, counters under one-way hashes, account IDs where billing needs them, and ciphertext whose keys it doesn’t have. What you publish to the gallery is stored as published. | With an account |
| Privy | Sign-in. | Your email or wallet address and session. Never chat content. | When you sign in |
| Stripe | Payments for plans and prepaid credit. | The price or amount, an opaque reference and its own customer ID. Checkout collects the email and payment details itself. | Only once payments are enabled; they aren’t yet |
04 · Data processing terms
Data processing terms
Not yetWe don’t offer a data processing agreement yet, and the terms of use are drafts. The operator’s identity, a privacy contact and legal bases will be published before paid launch.
Until then, what we can show is how the code handles data, which is what this page and the privacy notice describe.
05 · Attestation
Check the enclave yourself
The status page checks the enclave’s attestation from your browser when you open it.
Each developer API answer names the attestation bundle the gateway verified, which anyone can fetch and check again.
Aggregate counts of encrypted requests and enclave checks, with the commit in production.
06 · Uptime
Uptime and monitoring
In partThere’s no service level agreement or uptime commitment. What’s checked, and where to see it:
Every two hours, a scheduled job checks production’s status, a small real answer and the attestation endpoint; every 15 minutes it runs the critical flows, including a sealed answer. A failure opens an issue.
A model moves to an alternate route only if its own fails before answering, and only to a route of the same kind. Each response names the route that answered.
07 · Reporting
Reporting a security problem
What’s in scope, the recorded request to try to break and how to report are on the challenge page, and in security.txt.