Proof model

Don't Trust. Verify.

Most AI services ask you to trust that your conversations are private. We'd rather prove what can be proven, and be honest about exactly how far the proof goes.

The mode shown on each answer is the mode that actually happened. If a turn cannot complete in a stronger privacy mode, Conclave must show the weaker resolved mode for that turn. Fallback honesty is part of the privacy guarantee.

Trust-minimized

TEE Mode

Your browser sends your message to Conclave over HTTPS, and Conclave relays it to Chutes for processing inside verified secure hardware. In this mode, Conclave's server can transiently see the plaintext request, so privacy depends on HTTPS, our no-logging commitment, and Chutes' hardware isolation.

TEE mode is private, but it is not browser-verifiable per message the way E2EE is. There is no receipt proving "Conclave only ever saw scrambled text," because in this mode that is not what happens.

Verify, don't trust

Verified E2EE Beta

Your message is encrypted in your browser before it is sent. Conclave's servers and the network only see scrambled text. Your message is decrypted only inside verified secure hardware, and the reply is encrypted again before it leaves.

This is the mode you can check yourself. Every E2EE message produces a receipt.

What You Can Verify In E2EE Mode

The hardware is genuine. Intel TDX and NVIDIA GPU evidence are checked against roots not controlled by Conclave.
The key was not swapped. A nonce + public-key binding proves the key your browser encrypted to was inside the attested hardware.
The receipt matches this exact message. A ciphertext fingerprint ties the proof to the encrypted request for that turn.
You can check it without us. Copy the raw receipt and verify it offline or with the Chutes-documented Intel/NVIDIA attestation path.

What This Does And Does Not Prove

The model has to read your message to answer it. In E2EE mode, that happens inside the sealed hardware. This is hardware-protected privacy, not magic.
Web Research cannot be private. A search query must leave the secure boundary to reach the search provider. Conclave treats that as a separate web-exposed turn: it shows the outbound Brave query before it leaves, and the answer footer records that boundary crossing.
The receipt tells the truth for the resolved turn. A TEE turn does not get the E2EE "Conclave saw ciphertext only" claim.
Frontend provenance is not fully independent yet. The page publishes fingerprints of its own code, and a public source mirror is prepared so those hashes can be compared outside Conclave. Until that public repo is live and hash-matched, treat this as transparency, not full independence.
Open source proves "this is the code running," not "the code is safe." Anyone can inspect public source, but human review still matters.

See The Proof For A Message

Open an E2EE answer's Verify this E2EE turn panel, then copy its raw evidence JSON. Normal users can paste it into the receipt checker and stop when the checks pass.

Open receipt checker

For developers and auditors

The receipt is a self-contained artifact. You can verify it without trusting Conclave's page or servers.

Copy raw evidence JSON: raw TDX quote, GPU evidence, nonce, ML-KEM-768 public key, ciphertext hash, and observed measurements.
Check it offline: run python scripts/verify-conclave-receipt.py receipt.json --full from the verification repo or local checkout.
Verify against Chutes directly: Chutes documents the Intel DCAP and NVIDIA NRAS attestation flow that checks the same evidence.
Inspect the page source: compare the browser asset hashes against a public release once the public verification repo is live.

What the receipt proves: your browser encrypted to a key bound by hardware attestation to a genuine Chutes TDX + NVIDIA instance, and the ciphertext fingerprint matches the message that was relayed. What it does not prove: that the frontend code was honest before encrypting. That requires comparing the page against public source.