Who sees what
The trust boundary of Ainek, as stated in the spec. We say "our server cannot read", not "nobody can".
| Party | Sees | Does not see | Guarantee |
|---|---|---|---|
| Relay (our server) | ciphertext, size, timing, IP, API key; model id, message count and roles, the reasoning-effort setting, token usage, completion ids | prompt, response and tool-call contents | E2EE to the model key from the verified attestation report |
| Relay on the Incognito demo route (user-chosen) | the plaintext prompts and replies of that route, and no earlier turn sent to the private model | — | none (no model key to encrypt to); the red card says so |
| Hosting (Vercel), hosted demo only | what the relay sees, since the relay runs there, plus request logs (IP, path, time) and the API key in the project's settings | on the E2EE route, prompt, response and tool-call contents (on the Incognito route it sees the plaintext, as the relay does) | E2EE, as for the relay; it also serves the page's code, so you trust it to serve this repo's (pnpm -F web dev from a clean clone removes that) |
| NEAR AI gateway and proxy | ciphertext, the reasoning-effort setting, token accounting; the browser's IP during collateral and NRAS calls | contents | E2EE; the gateway is attested; the proxy cannot forge the NVIDIA verdict (checked against NVIDIA's keys) |
| NVIDIA key server | the browser's IP and timing of each cold verification (the SDK fetches NVIDIA's public keys directly) | anything about the exchange | public keys only; the NRAS verdict itself goes through NEAR AI's proxy |
| Wallet connector's hosts (raw.githubusercontent.com, the connected wallet's code host, storage.herewallet.app for an icon) | the browser's IP and the time of each page load: @hot-labs/near-connect fetches the wallet list from hot-dao/near-selector and, once a wallet is connected, that wallet's code; opening Connect also loads wallet icons | the conversation | none for privacy; the wallet list is pinned to a commit, the code it points to is not (Nightly's is on hot-dao/near-selector's main branch); that code runs in a sandboxed iframe on Connect and, once connected, on every page load and signature. Outside the list: a browser-extension wallet and a wallet added by hand in the dialog's settings (kept in the browser) |
| NEAR RPC endpoint (FastNear by default, NEAR_RPC_URL) | the browser's IP and the time of every log read (per message: one for the model and one for each verifier you trust), the model id; on a commit, /verify and /auditor also the NEAR account and the commit looked up; on /agent reads of public records only, every ten seconds while the page is open; the signed commit_proof transaction, which the wallet connector broadcasts through its own FastNear endpoint (the storage deposit goes through the wallet's) | contents | none for privacy; the log read is a plain JSON-RPC view with no light-client proof, so the client trusts what the endpoint answers: a lying endpoint can pass an unlogged key or refuse a logged one, not swap in an unattested key (attestation is checked locally) |
| Model enclave | plaintext for the duration of inference | — | TDX + GPU attestation; retention inside the enclave is not provable by attestation |
| NEAR blockchain | provider keys and measurements, salted commits with the committing account and time, executed transfers (testnet); (Tier 2) proposed actions, the OutLayer job input, decisions, the policy hash | the policy contents, the conversation, the proofs | salted commits; transfer details are hidden only with Confidential Intents (out of scope) |
| OutLayer policy job (Tier 2) | the action and the policy, while computing | the conversation | TDX, decision key generated in the TEE; a WASI-P1 module with no network or disk and a reproducible build cannot retain its input (the model enclave can; this says nothing about the OutLayer worker, and the action input is public on-chain); what the OutLayer API gateway sees is still open; checking an action proof on /verify shows that API the browser's IP and which run |
| Agent service and Telegram (Tier 2) | the owner's messages and the agent's replies in plaintext; the service also holds the proofs and their salts | the policy contents, the owner's keys | none for privacy: ordinary server code and a messenger; what the agent can do is bounded on-chain (function-call key, TEE-signed decisions, contract checks, stop button), not eliminated |
| Auditor | one disclosed proof, its salt and the ciphertext bytes | the plaintext, the other exchanges | selective disclosure (/auditor) |
The "does not see" column holds for requests. For replies it rests on E2EE v3 (SDK 0.3.0, since Nov 10): the reply key is bound into every encrypted request field, and NEAR AI's proxy refuses a request whose reply key was swapped in transit. We tested that refusal on Nov 12 with a request of our own (README, "Known issues we inherited").