Enclave, coming later: a record even we cannot read.
Enclave is a tier we plan to offer later. Your record will be sealed with a key made on your phone, and opened only inside verified hardware, one question at a time. Today our contract says we will never read your record. With Enclave, it will be impossible.
How it will work, in three steps
Every answer on Enclave will be produced this way.
- 1
The key is made on your phone
The key will be generated on your device and stay there. We will never receive it and could not rebuild it.
- 2
Verified hardware opens it
The hardware will prove exactly what code it is running before your record is opened inside it, for one question.
- 3
The key is discarded
The work will end, the key will go, and only the answer will remain.
What "verified hardware" means
Modern processors can create a sealed compartment, called an enclave, that even the people running the server cannot look inside. Before an enclave is trusted with your record, it produces a signed statement of the exact code running inside it.
If that code is not the code it should be, your record will not be opened. That check is what will turn a promise into a property of the system.
Never, or impossible
Never
Our contract, at launch.
- Read your record.
- Train anything on it.
- Sell it or share it.
Impossible
The hardware, with Enclave.
- Reading what is inside the enclave
- Recovering your key, because we never hold it
- Handing over anything readable, whoever asks
Who Enclave is for
Client conversations
Advice, consultations and anything a regulator, a court or a client may one day ask about. If they ask who could have read it, the answer will be nobody.
Anything you would not want handed over
Today, a lawful order could reach your record. With Enclave, anyone compelling us would receive only sealed data.
The most private parts of life
Health, family, money, and the conversations you would only ever have in person.
What we will still see, and what it will cost you
What we can see
That a question was asked and answered, and how much the system was used. Nothing about what any of it contained.
What you give up
As designed, if you lose every device you have enrolled, nobody will be able to recover your record, including us. That is the cost of a system where nobody else holds the key.
What it costs
Verified hardware costs more to run, so Enclave will cost more than the launch plan. Its price will be confirmed before it is available.
A record even we cannot read, coming later.
Enclave is a tier we plan to offer later.