Trust

Proof you can check

The parts that matter most can be checked by anyone, without trusting us.

• The AI hardware is checked before anything is sent

  The models run on Tinfoil's sealed hardware (AMD SEV-SNP). Before sending anything, your browser checks the hardware's report, signed by AMD, and that the code inside is a published, signed release. Only then does it encrypt your request, so that only that hardware can read it. If a check fails, nothing is sent.

• The Security panel shows what was checked

  In Tacy Chat, click Verified. The panel shows what your browser checked just now: the hardware, the code's fingerprint and the public release it matches, its entry in the public log, and how your history is encrypted.

• Signed, reproducible releases in a public log

  Each release of our agent machine, v0.1.0 to v0.8.17 so far, is signed with Sigstore by our public release workflow and recorded in Rekor, a public log that nobody can quietly change, us included. Since v0.2.0, anyone can rebuild a release and get the same fingerprints. The chat accepts only signed releases.

  Latest: v0.8.17 · its Rekor entry

• Public source

  Everything that runs inside the agent machine, and the verifier your browser uses to check it, is public under the Apache-2.0 license at github.com/tacyhq/tacy. The chat app and our server code aren't in that repository.

Check it yourself

1. Open Tacy Chat, click Verified, and follow the links to the release and its log entry. The steps on the home page walk through it.
2. Check that an agent release was signed by our release workflow, with the GitHub CLI:

   gh release download v0.8.17 -R tacyhq/tacy -p compose.yaml
   gh attestation verify compose.yaml --repo tacyhq/tacy \
     --signer-workflow tacyhq/tacy/.github/workflows/release.yml \
     --source-ref refs/tags/v0.8.17

3. Rebuild it and compare, in a copy of the repository: scripts/reproduce.sh v0.8.17. The repository's README explains every check.

How your data is handled

• Temporary chats

  A temporary chat is never saved, not even encrypted: not on our servers and not in your browser. Leave it and it's gone.

  In place

• Memory only when you approve

  The AI can offer to remember or forget something, but nothing changes until you press Save or Delete. Automatic suggestions are off unless you turn them on.

  In place

• Web search only when you allow it

  In Tacy Chat the model can ask to search the web, never to open pages. Each search goes through the agent's confidential machine, as in agent mode, which masks details such as email addresses and phone numbers in search terms first. Opening pages needs agent mode.

  In place

• Ask before anything leaves the sealed hardware

  Before each web search (in chat or agent mode), page read or image search, Tacy shows exactly what it would send and why, and you pick Allow once, Deny or Always allow (changeable in Settings → Chat). After reading the web, a link the agent wrote itself is always asked about, even with Always allow. Pictures on product cards come from pages and results you already allowed: the confidential machine downloads them itself, never your browser, and nothing from your chat goes with them.

  In place

• Quarantined reader for web pages

  Pages and search results, in agent mode and in chat's web search, are first read by a separate model that can't take any action. The model answering you sees only checked facts, references to quotes, and each source's site, not its address, which makes it much harder for text hidden in a page to steer it. Quotes are exact sentences from the page, chosen by the reader; you see them word for word.

  In place

Security controls

In place means running in production today. Planned means not done yet. Agents run in production but aren't open to customers yet; their controls are listed separately.

Tacy Chat and our servers

• Encryption on your device

  Conversations, files and memory are encrypted in your browser before they're saved (AES-256-GCM).

  In place

• Attested hardware for the models

  Every request goes to sealed hardware your browser has checked first (Tinfoil, AMD SEV-SNP).

  In place

• Budgets and rate limits

  Each account has a daily allowance and there's a daily cap overall. Sign-ins and requests are rate limited.

  In place

• Request logs off

  Logging and tracing are switched off on our servers.

  In place

• Admin audit log

  What our staff and firm admins do (deploys, keys, safety settings, invites, roles) goes in an append-only, hash-chained log, so an edit or a gap shows. It never holds content or email addresses.

  In place

• Monitoring from metadata only

  Health checks run every 5 minutes on counts, timings and error codes. Never accounts or content.

  In place

• Tested deploys, rollback and restore

  Tests run on every change. Any deploy can be rolled back with one command, and a full database restore was rehearsed on 16 October 2026.

  In place

• Deploys blocked unless tests pass

  Today the tests run on every change, but a deploy doesn't yet wait for them automatically.

  Planned

• Vulnerability disclosure

  A reporting policy with safe harbor for good-faith research, and a security.txt file.

  In place

Agents

• Attested confidential machine

  Agents run in a confidential machine (Intel TDX, hosted by Phala). Your browser runs 16 checks, including that it runs a signed release of our public code, before sending it anything.

  In place

• One gateway out, with leak scanning

  Only one process in the machine has network access. Model and search calls go only to listed services; web pages can be any public site, never a private address. Outgoing requests are scanned for passwords and keys, which are blocked.

  In place

• A vault the AI can't reach

  Service keys sit in a separate vault. The AI never holds one: the gateway gets one key per call, for one exact service, and each use is recorded without the key.

  In place

• Sandboxed agent

  The agent's own loop runs in a gVisor sandbox, with no network and no keys.

  In place

• Signed policy and kill switch

  What an agent may use is set by a signed policy that the machine checks. A kill switch stops agents, and the machine checks for it every 10 seconds. If it can't hear from us for 3 minutes, agents stop until it does.

  In place

• Budgets per run and per day

  Limits on time, model use and tool calls, reserved before each call.

  In place

• Encrypted, chained activity records

  Each run gets a signed record of what it did (calls, sites, sizes; never content). Records are chained, so a missing one shows, and encrypted so only you can read them.

  In place

• A separate machine for each firm

  Today agents share one machine, with each request encrypted to it.

  Planned

• Approve before anything is sent

  Agents can't send email or act outside Tacy yet. When they can, you'll approve each action first.

  Planned

Subprocessors

The companies that handle data for Tacy, and what each can see.

• Provider What it does What it can see

• Cloudflare

  What it doesHosts this site and the app, runs our servers and database, and routes email to tacy.io.

  What it can seeYour IP address and traffic timing in transit, and the encrypted data we store. Not your content.

• Tinfoil

  What it doesRuns the AI models and reads attached documents, inside sealed hardware your browser checks.

  What it can seeYour requests only inside that hardware, handled by code you can check. Outside it: our traffic, sizes and timing, not who you are.

• Phala

  What it doesHosts the confidential machine for agents and chat's web search. Not yet open to customers.

  What it can seeWhen the machine runs, and its encrypted memory and disk. Not what runs inside.

• Exa

  What it doesWeb search, in agent mode and in chat, once you allow each search. Not yet open to customers.

  What it can seeThe search terms, with details like email addresses and phone numbers masked first, sent from our confidential machine. Not who you are. It may keep search terms and use them to improve its service unless we have a zero-retention agreement with it; we've asked for one and don't have it yet.

• Tavily

  What it doesImage search for agents. Agents only, not yet open to customers.

  What it can seeThe search terms, with details like email addresses and phone numbers masked first. Not who you are. Tavily may keep those terms, use them to improve its service (including training), and pass them to other search engines such as Google.

• WorkOS

  What it doesSign-in through your firm's identity provider. Built, not switched on yet.

  What it can seeYour work email and firm. Never your conversations or keys.

• GitHub

  What it doesHosts our public source code, and builds and signs the agent machine's releases.

  What it can seeNo customer data.

The checks also use certificates from AMD and Intel and Sigstore's public log; none of them receive customer data. We don't take payments yet, so no payment provider holds your details.

Limits to know about

• The checks run in app code we send to your browser. We restrict what it can load and fingerprint every file, but you are trusting that code.
• Sealed hardware has been broken before by researchers. We rely on AMD's and Intel's fixes and their signed reports.
• We and our providers see some metadata: when you use Tacy, roughly how much, and your IP address in transit.
• Deleted data stays in our database provider's backups for up to 30 days, still encrypted.
• We haven't had an independent security audit yet.

Policies and documents

• Privacy

  What we can't see, what we keep and for how long, and how to export or delete it.

• Terms of use

  Who can use Tacy and what not to use it for.

• Disclaimer

  AI answers can be wrong and aren't professional advice.

• Report a security issue

  How to tell us about a weakness, and our safe harbor for good-faith research.

• security.txt

  Our security contact in the standard format (RFC 9116).

• Technical specs

  How the agent machine, gateway, vault, sandbox, safety controls and activity records work.

Need a security questionnaire answered, or more detail on anything here? Email info@tacy.io.

Compliance roadmap

We'd rather show you proof you can check today than a badge. These come next, without dates we can't promise.

• SOC 2

  Not started. Type 1, then Type 2, with an independent auditor, once a firm needs it.

  Planned

• Independent security audit

  A third-party review of our code and setup.

  Planned

• HIPAA

  Not offered. Please don't put protected health information into Tacy yet; we don't sign business associate agreements (see Terms).

  Later