Trust model

Conclave's central claim is operator-blindness: the people who run the service can't casually read your data. This page is how that claim is enforced.

The posture (shipped and load-bearing)

These are the guarantees the architecture delivers today:

• LLM only at ingest. The one place an LLM sees content is enrichment at ingest time. The read path is pure SQL + local embeddings, with no model call and no egress. Ask (RAG) is the single deliberate exception, and it runs inside the TEE.
• Raw transcript is never serialized across the API boundary unless the caller is authorized; raw diarization is write-once.
• Telemetry is kill-switched in code (LangChain/LangSmith disabled before env is even read).
• No external database. A single SQLite file (FTS5 full-text + sqlite-vec vectors) lives inside the TEE.
• Audio is AES-256 encrypted at rest; voiceprints are AES-256 sealed with keys TEE-sealed via dstack (they exist only inside the enclave); deletions are Ed25519-signed and offline-verifiable.

The enclave & attestation

All three services run in Phala dstack CVMs on Intel TDX, and each exposes GET /attestation?nonce= returning a signed TDX quote.

• Origin is cryptographic. The sealing / signing key is generated inside Intel TDX and bound into the hardware attestation quote. A record can therefore be shown to have been produced in a genuine sealed enclave — cryptographic evidence, not a promise, that it was born in the enclave rather than on our servers.
• Records verify offline. Deletion receipts, sealed transcript versions, and regulated-data redaction completeness receipts are all Ed25519-signed and checkable on your own machine against the published key.

Consent is separate from access

Three distinct gates. Do not conflate them:

• Workspace membership — a login/key. Decides who can reach a workspace.
• Sharing — the host's per-artifact call on their own data (transcript / insights / audio).
• Voice consent — the subject's control over being recognized (allow / anonymous / denied), owned by the consent plane.

Being a member of a workspace (has a key) is not the same as being recognized in it (has a voiceprint on file). Consent governs only the second.

Operator-blindness by design

• Today — LLM-at-ingest-only, sealed keys, identity-free capture, and pure-SQL reads make content operator-blind by construction, and every record carries offline-verifiable proof of its enclave origin.
• On the roadmap — content keyed to non-operator keys plus attested reads, with a per-binding real-time consent callback as the upgrade path. This is the stated end-state moat, built on the same substrate.