When you message an AI provider today, that company can read every word. Confidant closes that gap. Your messages are encrypted before they leave your device, and they are only ever unlocked inside a sealed hardware box (a Trusted Execution Environment, or TEE) that your device checks and verifies first.
Every medical question, financial decision, or private thought you send to ChatGPT, Claude, Gemini, and others sits in plaintext (unencrypted, readable text) on that company's servers. It is not just visible. It can be pieced together into a profile of who you are and what matters to you.
People and companies keep adopting AI out of fear of falling behind. To make it work well, we hand over more context about ourselves and quietly lower our privacy standards. That trade should not exist. It erodes your ownership of your own data and keeps you from using AI for the moments that matter most.
Many companies sign zero-data-retention (ZDR) agreements, trusting that this protects them. A ZDR is only a promise on paper. If a provider can technically read your data in plaintext, one engineer opening the wrong file, deal memo, patient record, or line of source code, can do damage no contract can undo.
Here is the path your message takes. Your device connects straight to the server, with no middleman, and checks its hardware receipt (attestation, a signed proof of what the server is running) before sending anything. Inside a sealed hardware boundary, the server can search the web and run the AI model, but only there, in memory nobody, not even us, can reach from outside. The answer is encrypted again before it ever leaves that boundary.
Attestation gives you proof, not a promise, of how your data is handled. Your auditors can check that proof themselves, which makes it easier to meet data protection requirements.
Your prompts and answers never leave the encrypted channel. No intermediary, not even us, can read them. We do not store your name, your passwords, or your IP address. You sign in with a passkey, nothing else.
Your search queries are only decrypted inside the attested enclave, so Confidant, as the operator, cannot read them either. We route through privacy-first providers like Brave and DuckDuckGo, and we can swap them without changing what you trust.
Confidant can route between multiple AI models, and every server proves its own hardware identity. Builds are reproducible so anyone can audit them. Every disk image is checked on every read. It scales from a single machine to a fleet.
Not won't be read. Can't be. Three properties of the encryption make that true.
Your encryption keys change constantly, and old keys are destroyed for good. Even if a key is compromised years from now, whatever you sent today stays unreadable. Your past conversations are sealed permanently.
Fresh encryption material is mixed into every session as it runs. If someone manages to steal a key, the very next exchange locks them back out automatically. A compromise is contained to a single moment, never the whole conversation.
The server's encryption key is baked into its hardware attestation report. Your device checks that the key it is using matches the key in that report, proving you are talking to the exact machine that was verified. Man-in-the-middle attacks are ruled out by math, not policy.
Confidant can sync your conversations across your devices without ever showing them to our servers. Everything is encrypted on your device before it leaves, and only devices that share your passkey can unlock it.
Every message and title is encrypted on your device with its own key (AES-256-GCM) before it is sent anywhere. Our server only ever stores scrambled ciphertext. Even with full access to that database, your conversations stay unreadable without your passkey.
Your passkey produces a private output that your device turns into a master key (using HKDF-SHA256, a standard key-derivation method). Each conversation gets its own key, locked under that master key. Only a device holding your passkey can unlock them.
Passkeys already sync between your own devices: iCloud Keychain on Apple, Google Password Manager on Chrome and Android. Any device with your synced passkey can decrypt your conversations.
You do not have to take our word for it. Each link below is something you or an independent auditor can check yourself, from the code we publish to the message on your screen.
| Capability | Standard LLM API | Self-Hosted | Confidant |
|---|---|---|---|
| Data encrypted in transit | ✓TLS | ✓TLS | ✓Noise protocol |
| Data invisible to provider | ✗Provider sees plaintext | ✗Admin sees plaintext | ✓Only in TEE memory |
| Provable server integrity | ✗ | ✗ | ✓Hardware attestation |
| Resilient to key compromise | ✗ | ✗ | ✓Continuous key rotation |
| Provider-agnostic search | ✗Locked to provider's search | ✗Typically one provider | ✓Privacy-first engines |
| No PII required | ✗ | ✓ | ✓Passkey-only auth |
| Zero operational overhead | ✓Fully managed | ✗ | ✓Fully managed |