Private Mode verification

Private Mode is a distinct transport and assurance level. A provider-side TEE route is not automatically a client-to-enclave private route.

Route guarantees

  • Standard routes: NanoGPT and the selected provider can receive request and response plaintext.
  • Provider-side TEE routes: NanoGPT can receive plaintext before forwarding it into provider-protected transport. Verification is provider-specific.
  • Private Mode: your browser or local proxy verifies the Tinfoil enclave and encrypts before NanoGPT receives the body. NanoGPT still sees account, route, timing, size, status, and usage metadata.

Verification contract

The public status endpoints expose an assurance object. A configured server reports not_checked until the browser or local proxy performs attestation. Only fresh verified evidence is eligible. Other states include unavailable, stale, measurement_mismatch, verification_failed, and unsupported.

Evidence is fresh for five minutes. Stale evidence triggers re-attestation; failed, malformed, or mismatched evidence fails closed. There is no automatic plaintext fallback to a standard or ordinary TEE route.

Verification receipts

Completed browser requests include a version 2 receipt with the model and enclave identity, expected and observed measurements, release digest, HPKE key fingerprint, freshness timestamps, an opaque request-ID hash, and verifier step statuses. Receipts exclude prompts, completions, API keys, and signed URLs.

Copy or download a receipt from the message shield, then independently re-fetch and compare current attestation evidence with:

npx @nanogpt/private-mode verify receipt.json

Receipts are browser-generated and unsigned. They do not prove response authenticity, usage correctness, prompt non-retention, or provider retention behavior. The request-ID hash is for opaque correlation, not proof of server issuance.

Storage and remaining limits

Conversation history stays local by default. Private Mode messages are blocked from ordinary cloud sync; passphrase or passkey end-to-end sync is required. Provider-reported Tinfoil usage remains trusted for billing and is not currently end-to-end signed. NanoGPT does not implement attestation-gated KMS release of upstream provider credentials.

See the broader privacy explainer and privacy controls guide for storage, identity, payment, and provider-specific boundaries.