Tacy Open Tacy Chat

Private AI chat for client work

Use AI on client work without handing it to anyone.

Tacy encrypts your conversations on your device and runs the AI inside sealed hardware. Our servers only ever see your conversations encrypted, and your browser checks the proof before anything is sent.

Open Tacy Chat See how it's checked

Invite-only for now. You'll need an invite code to sign up.

On your device readable

Draft a reply to Dana about her 2025 return. Her K-1 from Larkspur Partners shows $48,200 of ordinary income, and she wants to know if the estimated payments she made in June cover it.

On our server AES-256-GCM

Iq4cmgki2pcgkyMT4ZxUOLXiydtcMsfW8J2VEQqlYE1bJ4mFmsZBJrGb5+aYc+wOU40k7NPRFIPvF012/RkBsP6VfSQPg5aVY2Bfab686UWLl6RYoMp2OmRBLKkH1x3Wv3KqYFr0y/yEpmxATfN+OGJJWdZ77CwX0Lt97mjbYNdJft+g8RdxhV/8sZW09y361ADudc/K94aEBCigWROJy3bsm4vmesZ/komF4f/y/+FfsKAjxExVcodlB6AynW3uh1Yi0Wct+J0fnYQFm0QUz0evTr4cc6xY8+9Lw2u4/DPaMkwNO/cL0sehdxIe20uT2zBSFIGvneg

The same message, twice. Only your device and a verified enclave can turn the second back into the first.

01

Most AI tools can read what you type.

In the usual setup, your messages reach the provider as readable text. They're stored on its servers, can be seen by people with access, may be used to train models depending on your settings or plan, and can be handed over when the law requires it. When you work with clients, that text is usually theirs: a tax return, a contract under NDA, a portfolio.

Question The usual AI chat or search Tacy
Who can read your messages The provider, and anyone who gets into its systems Your device and a verified enclave. Not us.
Your chat history Stored readable on the provider's servers Stored encrypted. We hold only ciphertext.
Training on your data Depends on settings and plan We never have it in readable form, so we can't.
Web searches Usually linked to your account and IP address Sent from our verified VM with emails and numbers masked. The search provider never sees your IP.
How you know A privacy policy A proof your browser checks before sending

02

How a message travels.

Green boxes can read your message. Everything between them only ever carries sealed, encrypted data. Answers come back the same way, sealed to your device.

Reads it · yours

Your device

Holds your keys. Seals each message before it leaves.

Ciphertext only

Our server

Checks your session and passes sealed data along. Stores your history encrypted. Can't open any of it.

Reads it · verified

Model enclave

Runs the AI model in hardware-isolated memory. Run by Tinfoil on AMD SEV-SNP and NVIDIA confidential GPUs.

Reads it · verified

Agent VM

Our confidential VM on Intel TDX. Searches the web, reads pages, fetches images. Keeps nothing.

Search text only

Search provider

Gets the query from our VM, with emails and numbers masked. Never your IP or your account.

Can read your message: only your device and enclaves your browser has verified Sees ciphertext only Outside service: sees the search text, not who asked

  1. Keys stay on your device.

    Your password and encryption keys never leave your browser. We keep only a locked copy of your key that we can't open.

  2. History is stored encrypted.

    Every conversation is encrypted before it's saved. Our database holds ciphertext, so a leak or a curious admin gets nothing readable.

  3. Models run in sealed hardware.

    Open models like GPT-OSS, DeepSeek, Kimi and Gemma run in enclaves: memory that the cloud, the host and we can't look into. Documents you attach are converted in a verified enclave too.

  4. Search runs in our verified VM.

    In agent mode, web search and page reading run in our own confidential VM. It masks emails, phone, card and account numbers before a query leaves, and the search provider sees the VM, not you.

  5. Your browser never touches those sites.

    Images and site icons in answers are downloaded by the VM and sent to you inside the encrypted stream, so those sites never see your IP either.

03

Nothing is sent until your browser has checked the proof.

“Private” is easy to claim. Here it's something your own browser checks, using signatures from the chip makers and a public record of the code.

  1. Remote attestation

    The enclave's chip measures the exact code it loaded, a fingerprint (hash) of it, and signs a report with a key only genuine AMD or Intel hardware holds.

  2. Transparency log

    When the code is released, its fingerprint is published in a public, append-only log (Sigstore's Rekor, for Tinfoil's releases). Entries can't be quietly changed or removed later.

  3. Verification, in your browser

    Your browser checks the hardware signature and compares the running fingerprint with the published one. If they match, it encrypts to a key that only that enclave holds. If anything is off, nothing is sent.

What this means for you

You don't have to trust us. The proof comes from the hardware and a public record, and your browser checks it, not our server. The green “Verified” badge in the app opens the details, like the panel here.

The agent VM's 14 checks, in plain words

  • Is this a real Intel TDX chip, with current firmware and debugging switched off?
  • Was the report made just now, for this browser, rather than replayed?
  • Is the encryption key the one created inside this VM?
  • Is it running exactly our code, on the production system image, with nothing unexpected started first?
Verified checked in this browser

Model enclave

router-0.tinfoil.sh
  • Hardware report signed by AMD SEV-SNP report chains to AMD's root key
  • Enclave code fingerprint 5a2f5576ff6b2850…
  • Matches release v0.0.157 in the public transparency log tinfoilsh/confidential-model-router · Sigstore (Rekor)
  • Encryption key bound to the report HPKE X25519 · requests sealed to this key

Agent VM

Intel TDX
Compose hash Matches our compose.yaml
94a35d35d61a216c1197f7e2af884460d6665c4431c7d84f6f4550e82026bc6b
Show checks (14/14 passed)
  1. attestation format
  2. response is for our nonce
  3. HPKE key is X25519 with the expected suite
  4. platform is dstack
  5. parse quote
  6. genuine Intel TDX quote (signature chain, collateral, revocation, debug off)
  7. TCB up to date, debug off
  8. quote binds our nonce and the HPKE key (report_data)
  9. parse event log
  10. event log replays to RTMR3; compose-hash event = sha256(app-compose.json)
  11. production dstack OS image (attested os-image-hash)
  12. parse app-compose.json
  13. app-compose: reviewed pre-launch script, docker-compose runner, expected env names only
  14. runs exactly our compose.yaml (service source + pinned binary hash)

History

on this device
  • Encrypted before it's saved AES-256-GCM · key made in this browser · password stretched with Argon2id
Example values from real checks on 13 and 14 October 2026. Fingerprints change with each release; the app shows the current ones.

04

What it doesn't do.

No system is perfect, and you should know where the edges are.

  • The search provider still sees the search text.

    It doesn't learn who asked or from where, and we mask emails and numbers first. Pages the agent reads see a visit from our VM, not from you.

  • The app's code comes from our server.

    Like any web app. A compromised server could send different code to your browser. Signed releases you can check, the way the enclaves are checked, are planned.

  • Some metadata is visible to us.

    Your username, when you chat, which model you pick and how large messages are. Never what they say.

  • Private doesn't mean it can't be lost.

    Privacy here means nobody else can read your data. If you lose your password, every passkey and your recovery key, nobody can restore your history, including us.

  • You still rely on the hardware.

    The guarantees rest on AMD, Intel and NVIDIA's chips and on the enclave software being correct. That's far less to trust than a company's promise, but it isn't nothing.

Try it on real work.

Tacy is invite-only while we work with our first firms. Agent mode, with web search, is in early access.

Open Tacy Chat