Privacy

The short version: Private is trust-minimized TEE inference, Encrypted is receipt-verifiable browser E2EE, and Auto is an assistant mode that may use web search automatically. Any web search sends your query to Brave — Private asks first; Auto does not.

Private mode

• Your browser sends your message to Conclave over HTTPS, and Conclave relays it to Chutes for processing inside verified secure hardware.
• In Private mode, Conclave's server can transiently see the plaintext request.
• Privacy depends on HTTPS, our no-logging commitment, and Chutes' hardware isolation.
• We do not store chat prompts or replies on the server.
• Private mode is confidential, but it is not browser-verifiable per message the way Encrypted mode is.

Encrypted mode

• Your browser encrypts the request before sending it to Conclave.
• Conclave relays ciphertext only for that turn.
• The encrypted request is sent to a key bound to Intel TDX and NVIDIA GPU attestation evidence.
• Every encrypted message can produce a receipt with raw evidence, nonce, public key, and ciphertext hash.
• The receipt can be checked in the browser or offline against the Chutes-documented Intel/NVIDIA attestation path.
• Web search is not available in Encrypted mode. Conclave will not switch modes automatically.

Auto mode

• Auto mode starts with a direct answer on Chutes confidential TEE. If the model indicates live sources are needed, Conclave searches Brave automatically in the same turn.
• When Auto does search, there is no confirmation step before the Brave query leaves.
• Inference and synthesis use the same Chutes confidential TEE path as Private mode.
• Only web-backed Auto turns send a search query to Brave. Private chat history is not attached to the Brave request.
• Auto differs from Private mainly in UX: it chooses direct answer vs. web search automatically instead of asking you to confirm a proposed query.

Web research in Private mode

When Private chat needs current external sources, Conclave may propose a web research plan. Before a query leaves, you see the exact Brave Search query and can edit or cancel it.

• The outbound query crosses to Brave — the same search provider used in Auto mode.
• Private chat history is not sent to Brave. A model-drafted query may reflect the conversation, but the outbound query is shown before it leaves.
• The Brave API key stays on the server.
• If search fails, Conclave does not present the answer as web-sourced.

History

• Saved history is optional.
• If enabled, conversations are stored in this browser only.
• History is not synced and is not stored by Conclave.
• Clearing site data removes local history.

What We Do Not Claim Yet

• Private mode is not zero knowledge to Conclave. Conclave can transiently see plaintext in Private mode.
• Encrypted mode is not magic. The model must decrypt the prompt inside the verified hardware to answer it.
• Web search is a separate step. Brave receives your search query in cleartext for any web-backed turn (Private confirmed or Auto automatic). That is different from keeping the full chat inside the TEE boundary.
• Frontend provenance is not fully independent yet. The app publishes frontend hashes, but the public source mirror must be live and hash-matched before this becomes independent proof.
• Software provenance is consistency-checked, not source-proven. Full source provenance for enclave measurements requires independent reproduction of the runtime build.

Proof and Receipts

For the plain-language proof model, see Don't Trust. Verify.. For a copied encrypted receipt, use the receipt checker.

Infrastructure

• Nginx access logs record request metadata, not POST bodies or invitation request headers.
• Application logs do not intentionally record prompts, replies, or API keys.
• Operator telemetry uses fixed benchmark prompts only, never user chat.
• Per-IP request counts are used to enforce free-trial limits, including the daily web search allowance. These are counts and dates keyed by IP hash only. They contain no prompt, reply, or chat content.
• Web search has a shared monthly budget cap with the search provider. When it is reached, web search returns temporarily unavailable rather than answering without sources.
• The operator and pilot testers may have elevated rate limits via server-side invitation tokens stored as server-side hashes. Invitations may expire. This affects rate limits only; no chat content is recorded.
• A daily spend cap protects the operator from runaway API cost. It is not a privacy control.

If this page does not match what you observe in the app, treat that as a bug.