# Privacy tiers — what each Space protects, and what you choose Every Space is private by default. On top of that you make one choice per room — which tier runs its turns — and can switch on a few more protections. This page lists each one: what it hides, from whom, and its status today. Check the claims yourself: [Verify it yourself](./verify.md). The full status map: [Status](./status.md). --- ## Every Space, always Nothing to configure; these hold for every room. | Protection | What it means | |---|---| | **Sealed storage** | The store holds only ciphertext sealed to the room key. There is no operator recovery key, so nothing on the platform can read it. | | **Keys in a worker** | Room cryptography runs in a key worker on the user's device; in the hosted app it runs in the vault, so the frame that draws the screen never holds a key. See [the app as an operating system](./app-os.md). | | **Locked egress** | The app in the browser can reach only a published list of hosts; the browser refuses everything else. | | **Signed, reproducible build** | Each deployed origin publishes a signed `/cert.json` binding its exact bytes to published source that rebuilds to the same hash. | --- ## The choice per room: Confidential or Standard | | **Confidential** | **Standard** | |---|---|---| | **Where a turn runs** | A measured AWS Nitro enclave. Your app verifies it before sealing the room key to it. | Our server-side render. | | **Who can read a turn while it runs** | No one outside the enclave — not us, not AWS. | Our render, while a member is active. | | **The model** | Open-source models on confidential-compute inference, reached only through an attested no-log gateway; refused if the gateway does not attest. | Frontier models. The turn goes to the model's vendor. | | **Storage at rest** | Sealed | Sealed | | **Status** | Production, always on | Production | **Choose Confidential** unless the room needs a frontier model. **Choose Standard** for a frontier model, and tell the room's members what that trade is. The tier is set per room by the app builder. How the confidential room works, link by link: [the trust model](./trust-model.md#the-confidential-room-plaintext-only-inside-the-enclave) and [the attested tier](./the-attested-tier.md). --- ## Protections you can switch on | Protection | What it hides or prevents | From whom | Status | |---|---|---|---| | **Verified membership** | Reading or posting with only the link — every read and write needs an allow-listed sign-in (email or `@username`). | Anyone holding the link | Production, per room | | **Hide my IP** | Which IP address is using which room. Requests go through an attested relay ([OHTTP](./verify.md)): the relay sees your IP but only ciphertext; our servers see the room but not your IP. | Witbitz's servers and the network path | Production, a user setting | | **No notifications** | That, and when, you received a message. | Apple, Google and the push service | Production — push is off until the user turns it on | | **Device protection** | Keys and cached messages at rest on the device: everything is sealed under a passkey and opened only after an unlock. | Someone, or malware, reading the device's storage | Production — required on computers, optional on phones | | **Attested room** | A modified or unreleased app taking part: every read and turn must come from a release in the public log ([the chain](./trust-model.md#the-chain-each-side-checks-the-other)). | A tampered client | In the browser: the Witbitz-served level (proves the version, not the device). Hardware-attested phone apps: Design | | **Client verification** | A swapped or leaky app in your own browser: a verifier checks the release and enforces its locks. | Whoever serves the app | Implemented, not on by default | "Hide my IP" cannot hide your address from the companies that deliver the app itself — Cloudflare when the page loads, Apple or Google for push and sign-in. Only a device-wide VPN or Tor hides it from them, and it works alongside the relay. --- ## Not built yet - **Traffic shaping** (Design). Message sizes, timing and access patterns remain visible to the network path, in both directions. Hiding them takes a client half (fixed-size writes, constant cadence) and a server half (fixed-size replies). - **Hardware-attested phone apps** (Design). The server's verifiers for Apple App Attest and Android key attestation are built; the native apps are not released. --- ## What no setting hides - **The endpoint.** Plaintext has to exist on a device for a person to read it. A compromised device — a keylogger, a screenshot, malware — is outside every software guarantee. - **The frontier model's vendor**, in a Standard room. That is the trade the tier names. - **Availability.** We can refuse service. Sealed storage is a claim about reading, not about access forever. Running it in your own boundary, or with no outside network at all: [deployment options](./deployment-options.md#your-boundary) and [air-gap](./deployment-options.md#air-gap-zero-egress). What the Spaces app turns on, and where its settings are: [privacy in the Spaces app](https://witbitz.chat/spaces/privacy).