Don't trust. Verify.
Open any attested reply, read its seven checks, export the signed report. It checks out against Intel and NVIDIA, not against us.
Experience confidential AIHow a message travels, the hardware checks that come back with the reply, and what stays visible anyway.
Your messages are encrypted on your machine to a key that belongs to the enclave. Our gateway relays ciphertext it has no key for, and the machine's own operator has no path to the plaintext. That is hardware, not a policy we could quietly change.
See how a message travels ↓Seven hardware checks run before a reply reaches you, and the signed report exports as JSON that checks out against Intel and NVIDIA rather than against us. When someone asks you to prove where the work happened, you have a document.
Read the seven checks ↓Your local database is encrypted on your own machine with a key derived from a passphrase we never see. Encrypted export is free on every plan, with a verifier that runs without us, and nothing reaches the outside world without your explicit approval.
See what we publish ↓Built for professionals bound by GDPR, HIPAA and IRC §7216. SOC 2 / ISO 27001: readiness program underway. Amnesia AI® does not itself confer compliance or create attorney-client privilege.
Every AI vendor selling to regulated work offers a zero-retention tier. This is what the two arrangements actually differ on.
Four steps, none of which ask you to work differently. The mono lines below are real values from the report published further down this page, not illustrations.
Ask a question, attach a document, hand the agent a task. No redaction step, no coded stand-ins, no new habits.
Your message is encrypted on your machine to a key that belongs to the enclave, not to us. Amnesia AI®'s gateway relays ciphertext it has no key for.
Decryption and inference happen inside a confidential-computing enclave on attested Intel TDX hosts with NVIDIA H100 GPUs. Memory is encrypted, TLS terminates inside the enclave, and the machine's operator has no path to the plaintext.
Seven independent hardware checks run before the reply reaches you. One click opens the report; one click exports it as signed JSON.
Two properties that have nothing to do with the enclave
Web search, shell commands and file writes each require an explicit approval, every time, with the full arguments shown. Shell is limited to an allowlist of 22 binaries and includes no general-purpose interpreter.
Encrypted export and import are free on every plan, with a standalone verifier binary that runs without Amnesia AI®. Local storage is SQLCipher with keys derived from a passphrase we never see.
That is the whole architecture. The rest of this page is the evidence for it.
Experience confidential AI"Trust us" is a policy. This is a receipt. Three levels, in order: the checks that run, the report they produce, and the primitives underneath.
These are the seven rows the app's own attestation panel shows, in its order and its wording, so the page and the product say the same thing.
report_data == sha256(signing_address‖tls_cert_fingerprint)‖our nonce. A cached, replayed, or forged report fails closed before evidence is ever recorded.
The Intel TDX quote's own ECDSA signature and PCK certificate chain, checked against live Intel PCS collateral, not a shape check.
Same DCAP check as Quote Signature verifies the PCK chain in the same pass, so one field backs both rows, honestly.
Real status, disclosed plainly and never summarised as up to date. This build blocks only on Revoked and ConfigurationNeeded, the platform itself needing attention, and lets OutOfDate and SWHardeningNeeded through, which is a patch that has not rolled out yet.
Each GPU device independently posted to NVIDIA's own attestation service and checked: signed verdict, our nonce, measres, secboot and dbgstat all passing.
The certificate the app's own connection received matches the SPKI fingerprint bound into the quote. A reverse proxy in front of the enclave cannot produce this.
An ed25519 signature from the enclave over the model name and the hashes of the request and the response, fetched separately and checked against the enclave's published signing address.
The fields below are the app's "Identity & receipt" drawer, filled from one real report captured from a NEAR AI enclave for a Qwen/Qwen3.5-122B-A10B reply and published unmodified. It is a sample, not your receipt: the app produces one of these per attested reply and exports it as amnesia-attestation-<chat_id>.json.
The report is signed by the enclave and chains to Intel and NVIDIA, not to Amnesia AI®. Anyone can re-run the checks against NVIDIA's attestation service and Intel's provisioning certification service, on a machine that has never run our software. In normal use those checks run on our gateway before the reply reaches you. See Where verification runs.
Named primitives, so a reader who knows this field can check the claims rather than take the adjectives.
Argon2id, from your passphrase, on-device. The derived key never leaves your machine.
XChaCha20-Poly1305 authenticated encryption, per-column AEAD on top of SQLCipher.
SQLCipher: the full database file is ciphertext at rest.
X25519 key agreement and HKDF-SHA256, then XChaCha20-Poly1305 over the payload. The enclave's public key is fetched per session; TLS terminates inside the enclave.
Intel TDX DCAP quote with PCK certificate chain, TCB status checked against live Intel PCS collateral, NVIDIA GPU evidence via NRAS, TLS binding, and an ed25519 signature over the request and response hashes.
No other AI vendor publishes this. The right-hand column is the app's own list, word for word, plus every other exposure we know of — because a guarantee you cannot examine is marketing.
your messages are encrypted to the enclave, so our gateway relays them without being able to read them — the actions your agent takes (tool calls, file paths, screenshots) it can still see.
Relays ciphertext encrypted to the enclave's public key. It holds no decryption key for your messages.
Intel TDX keeps enclave memory encrypted while it runs, so the machine's own OS and its operator have no path to the plaintext.
NVIDIA H100 confidential computing, with each device independently checked through NVIDIA's own attestation service on every attested reply.
TLS terminates inside the enclave, and the certificate's fingerprint is bound into the attestation quote. A proxy in front of the enclave cannot produce that.
Names, descriptions, and JSON schemas for every tool the agent can call. Mandatory plaintext on this protocol — an encrypted function name is accepted but unusable, so this is never encrypted, deliberately.
The name and full arguments of every tool call the model makes, and the result your agent sends back — file paths, URLs, shell commands, search queries, whatever the call carries.
Any image the agent sends the model, including computer-use screenshots of your screen. Mandatory plaintext — an encrypted image is accepted but the model can't read it, so vision would silently break.
Which model answered, how large the request and reply were, and how long the turn took. None of this reveals what you said, but none of it is hidden either.
Search goes to Brave in the clear, under one account-wide subscription token. Nothing about a search query is confidential to Brave.
The transcription model runs in a TEE, but the audio reaches it through our gateway as plaintext, because the endpoint accepts multipart uploads only.
The attestation proves an enclave, not a specific set of weights. Which model answered is the provider's word rather than a measurement.
Which exact model weights ran — that is still the provider's word, not a measurement. And it is not a claim that nothing about this turn is visible: tool calls, the file paths and URLs your agent touched, sizes and timing all stay outside the encrypted content.
Seven more things the architecture does not cover, starting with the fact that the verification itself runs on our gateway rather than on your computer. Every one of them is disclosed inside the product too.
A guarantee you cannot examine is marketing. This box ships inside the product on every report, not only here.
Everything above, restated for a reader who has to decide rather than audit.
A Trusted Execution Environment is a region of a CPU and GPU that stays encrypted while it is running, not only at rest and in transit. Your message is decrypted and answered inside it, and the machine's own operating system, its operator and we ourselves have no path to the plaintext. It is the difference between a company choosing not to read your work and a machine that cannot.
We can be compelled to produce what we hold, which is why what we hold matters. Your messages reach our gateway as ciphertext we have no key for, and your local database is encrypted on your own machine with a key derived from a passphrase we never see. What we can produce is the leak surface published above: tool calls and their arguments, the paths and URLs your agent touched, sizes and timing.
Open-weight models up to 122B parameters, served on attested Intel TDX hardware with NVIDIA H100 GPUs. You pick one, or let Amnesia AI® pick. There is no route out to a provider that could read your work: the endpoint allowlist rejects anything that is not an attested enclave.
Your messages are encrypted to the enclave, so our gateway relays them without being able to read them. What it does see is the work your agent does around them: tool calls and their arguments, the file paths and URLs it touches, images, and message sizes and timing. We publish that list in full rather than describing ourselves as private.
Open any attested reply and export its signed report as JSON. It contains the Intel TDX quote, the NVIDIA GPU evidence and the TLS binding, and it can be checked against Intel and NVIDIA directly, by someone who has never run Amnesia AI®.
More at the full FAQ.
Open any attested reply, read its seven checks, export the signed report. It checks out against Intel and NVIDIA, not against us.
Experience confidential AI