Privacy tiers — what each Space protects, and what you choose

Every Space is private by default. On top of that you make one choice per room — which tier runs its turns — and can switch on a few more protections. This page lists each one: what it hides, from whom, and its status today.

Check the claims yourself: Verify it yourself. The full status map: Status.

Every Space, always

Nothing to configure; these hold for every room.

Protection	What it means
Sealed storage	The store holds only ciphertext sealed to the room key. There is no operator recovery key, so nothing on the platform can read it.
Keys in a worker	Room cryptography runs in a key worker on the user's device; in the hosted app it runs in the vault, so the frame that draws the screen never holds a key. See the app as an operating system.
Locked egress	The app in the browser can reach only a published list of hosts; the browser refuses everything else.
Signed, reproducible build	Each deployed origin publishes a signed `/cert.json` binding its exact bytes to published source that rebuilds to the same hash.

The choice per room: Confidential or Standard

	Confidential	Standard
Where a turn runs	A measured AWS Nitro enclave. Your app verifies it before sealing the room key to it.	Our server-side render.
Who can read a turn while it runs	No one outside the enclave — not us, not AWS.	Our render, while a member is active.
The model	Open-source models on confidential-compute inference, reached only through an attested no-log gateway; refused if the gateway does not attest.	Frontier models. The turn goes to the model's vendor.
Storage at rest	Sealed	Sealed
Status	Production, always on	Production

Choose Confidential unless the room needs a frontier model. Choose Standard for a frontier model, and tell the room's members what that trade is. The tier is set per room by the app builder. How the confidential room works, link by link: the trust model and the attested tier.

Protections you can switch on

Protection	What it hides or prevents	From whom	Status
Verified membership	Reading or posting with only the link — every read and write needs an allow-listed sign-in (email or `@username`).	Anyone holding the link	Production, per room
Hide my IP	Which IP address is using which room. Requests go through an attested relay (OHTTP): the relay sees your IP but only ciphertext; our servers see the room but not your IP.	Witbitz's servers and the network path	Production, a user setting
No notifications	That, and when, you received a message.	Apple, Google and the push service	Production — push is off until the user turns it on
Device protection	Keys and cached messages at rest on the device: everything is sealed under a passkey and opened only after an unlock.	Someone, or malware, reading the device's storage	Production — required on computers, optional on phones
Attested room	A modified or unreleased app taking part: every read and turn must come from a release in the public log (the chain).	A tampered client	In the browser: the Witbitz-served level (proves the version, not the device). Hardware-attested phone apps: Design
Client verification	A swapped or leaky app in your own browser: a verifier checks the release and enforces its locks.	Whoever serves the app	Implemented, not on by default

"Hide my IP" cannot hide your address from the companies that deliver the app itself — Cloudflare when the page loads, Apple or Google for push and sign-in. Only a device-wide VPN or Tor hides it from them, and it works alongside the relay.

Not built yet

Traffic shaping (Design). Message sizes, timing and access patterns remain visible to the network path, in both directions. Hiding them takes a client half (fixed-size writes, constant cadence) and a server half (fixed-size replies).
Hardware-attested phone apps (Design). The server's verifiers for Apple App Attest and Android key attestation are built; the native apps are not released.

What no setting hides

The endpoint. Plaintext has to exist on a device for a person to read it. A compromised device — a keylogger, a screenshot, malware — is outside every software guarantee.
The frontier model's vendor, in a Standard room. That is the trade the tier names.
Availability. We can refuse service. Sealed storage is a claim about reading, not about access forever.

Running it in your own boundary, or with no outside network at all: deployment options and air-gap. What the Spaces app turns on, and where its settings are: privacy in the Spaces app.

Machine-readable source: privacy-tiers.md · Generated 2026-10-27T07:05:42Z · build f301388c · every doc in one fetch: llms-full.txt (HTML)