Trust model
Operator-blindness, TEE + TDX attestation, and "verify, don't trust".
Conclave's central claim is operator-blindness: the people who run the service cannot read your data. This page is how that claim is actually enforced.
The posture
- LLM only at ingest. The one place an LLM sees content is enrichment at ingest time. The read path is pure SQL + local embeddings — no model call, no egress. Ask (RAG) is the single deliberate exception, and it runs inside the TEE.
- Raw transcript is never serialized across the API boundary unless the caller is authorized; raw diarization is write-once.
- Telemetry is kill-switched in code (LangChain/LangSmith disabled before env is even read).
- No external database — a single SQLite file lives inside the TEE.
- Audio is AES-256 encrypted at rest; voiceprints are AES-256 sealed; deletions are Ed25519-signed and offline-verifiable.
The enclave: TEE + TDX attestation
All three services run in Phala dstack CVMs on Intel TDX. Each exposes
GET /attestation?nonce= returning a TDX quote that binds the running code (a measured enclave) to
its keys. Keys are TEE-sealed via dstack — they exist only inside a correctly-measured enclave.
Verify, don't trust. Operator-blindness isn't a promise in a policy document — it's an attestation you can check. The quote proves which code is running before you decide to trust it with audio.
Consent is separate from access
Three distinct gates — do not conflate them:
- Workspace membership — a login/key. Decides who can reach a workspace.
- Sharing — the host's per-artifact call on their own data (
transcript/insights/audio). - Voice consent — the subject's control over being recognized (
allow/anonymous/denied), owned by the consent plane.
Being a member of a workspace (has a key) is not the same as being recognized in it (has a voiceprint on file). Consent governs only the second.
Operator-blindness levels
The design names a maturity ladder (full detail in PERMISSION-LAYER.md):
- Today — LLM-at-ingest-only, sealed keys, attested reads, identity-free capture.
- Level 2 (deferred) — content keyed to non-operator keys + attested, with a per-binding real-time consent callback as the upgrade path. This is the stated end-state moat, not yet built.
Source: FEATURE-SPEC.md §1 & §9, PERMISSION-LAYER.md, discoveries/WORKSPACES-AND-VFT-GRAMMAR.md.