Confidential AI

What is confidential AI?

DeepJournal's AI features send encrypted request and response bodies to models running inside hardware-isolated trusted execution environments (TEEs).

The goal is to reduce plaintext exposure during model inference. This protection complements local database encryption and end-to-end encryption for synchronized fields; it is not a claim that every piece of service metadata is end-to-end encrypted.

Request path

1. The desktop client selects an allowed confidential model endpoint.
2. It verifies hardware-backed attestation for the expected enclave.
3. The client encrypts the AI request body for that enclave using the Encrypted HTTP Body Protocol (EHBP).
4. DeepJournal's proxy authenticates the account, applies budget and rate-limit policy, validates the selected model, and forwards the opaque encrypted body.
5. The body is decrypted and processed inside the attested enclave.
6. The response body is encrypted back to the client.

DeepJournal's proxy does not parse or reshape the normal AI request body.

Trusted execution environments

A TEE is a hardware-isolated execution environment designed to protect code and data from the host operating system and infrastructure administrators while the workload is running.

The properties DeepJournal relies on include:

• isolated and encrypted execution memory
• an enclave identity that can be checked before sending plaintext
• hardware-backed attestation of the deployed environment

Attestation reduces the amount of blind trust placed in the infrastructure, but users must still trust the verified enclave code, client application, cryptography, hardware implementation, and model behavior.

Encrypted HTTP Body Protocol

EHBP encrypts HTTP request and response bodies between the desktop client and enclave. It uses hybrid public-key encryption so the client and attested enclave can derive keys that intermediaries do not possess.

HTTP headers are not part of the encrypted body. The service can still see information required to operate the request path, including authentication, routing, selected endpoint, request identifiers, rate-limit state, approximate request size, timing, and usage or billing metadata.

What Confidential AI protects

• Prompt and response bodies while they travel through the DeepJournal proxy.
• Plaintext inference data from the host environment outside the enclave.
• Requests from being sent when the client cannot verify the expected enclave identity.