Confidential AI

DeepJournal's AI features send encrypted request and response bodies to models running inside hardware-isolated trusted execution environments (TEEs).

The goal is to reduce plaintext exposure during model inference. This protection complements local database encryption and selective E2EE for synchronized fields; it is not a claim that every piece of service metadata is end-to-end encrypted.

Request path

1. The desktop client selects an allowed confidential model endpoint.
2. It verifies hardware-backed attestation for the expected enclave.
3. The client encrypts the AI request body for that enclave using the Encrypted HTTP Body Protocol (EHBP).
4. DeepJournal's proxy authenticates the account, applies budget and rate-limit policy, validates the selected model, and forwards the opaque encrypted body.
5. The body is decrypted and processed inside the attested enclave.
6. The response body is encrypted back to the client.

DeepJournal's proxy does not parse or reshape the normal AI request body.

Trusted execution environments

A TEE is a hardware-isolated execution environment designed to protect code and data from the host operating system and infrastructure administrators while the workload is running.

The properties DeepJournal relies on include:

• isolated and encrypted execution memory
• an enclave identity that can be checked before sending plaintext
• hardware-backed attestation of the deployed environment

Attestation reduces the amount of blind trust placed in the infrastructure, but users must still trust the verified enclave code, client application, cryptography, hardware implementation, and model behavior.

Current model allowlist

The current confidential analysis registry includes:

• Kimi K2.6
• GLM 5.2
• Gemma 4 31B
• GPT-OSS 120B

The active model and availability can change as model quality, deployment, pricing, and security requirements evolve. The backend registry is the source of truth.

Embedding requests use a separately configured confidential embedding model.

Encrypted HTTP Body Protocol

EHBP encrypts HTTP request and response bodies between the desktop client and enclave. It uses hybrid public-key encryption so the client and attested enclave can derive keys that intermediaries do not possess.

HTTP headers are not part of the encrypted body. The service can still see information required to operate the request path, including authentication, routing, selected endpoint, request identifiers, rate-limit state, approximate request size, timing, and usage or billing metadata.

What Confidential AI protects

• Prompt and response bodies while they travel through the DeepJournal proxy.
• Plaintext inference data from the host environment outside the enclave.
• Requests from being sent when the client cannot verify the expected enclave identity.

What it does not guarantee

Confidential AI does not protect against:

• malware or another attacker controlling an unlocked local device
• sensitive text intentionally copied or exported elsewhere
• incorrect, biased, or unsafe model output
• vulnerabilities in the verified enclave code, client, protocol, or hardware
• metadata contained outside the encrypted request and response bodies

DeepJournal's AI is a reflection and organization tool. It is not medical, therapeutic, legal, or financial advice.