alwyse

Trust roadmap

Here is exactly what we can prove about your privacy today, per hosting option, and what we can't yet. We'd rather show you the gap than word around it.

Last reviewed 10 July 2026

How to read this

This is the trust-claim ladder we hold ourselves to internally, published in full. Every privacy claim alwyse makes, the hosting option it applies to, and whether it has shipped. The rule behind it is one line: no sentence on this site may run ahead of what's actually shipped on the tier it describes. Publishing the ladder is how we keep that rule, because public copy can't quietly outrun a public table. You'll see gaps below. Showing them is the point.

The boundary is the promise

Everything alwyse captures, and everything it works out about you, lives inside a trust boundary. What crosses that boundary is your choice, on every hosting option. Crossing buys capability: a frontier model, a web search, a calendar. Not crossing keeps everything in, and costs you features. Both are legitimate, and the second is not a lesser mode.

So we will never tell you "your data never leaves." That sentence would be false the moment you asked alwyse to search the web, and it would make your own choice look like our broken promise. What we owe you instead is threefold: draw the boundary hard, record every crossing, and hand you the levers. Below is exactly how much of that is built.

Two tables, two jobs

The first table says what is true today. It is the only one that grants anything: every sentence we publish is checked against it, row by row, and nothing else. The second says where each claim is headed. It is a roadmap, not a permission, and you should rely on none of it.

Statuses, not dates

We don't publish target quarters or version numbers. A slipped date on a trust page is just a broken promise, which costs a trust brand more than never promising. In the first table, each cell says where the guarantee actually is:

  • Shipped Real today. Rely on it now.
  • Building Part of it is real; the rest is named below.
  • Not offered Not part of this tier, by design or because the tier doesn't exist.
  • Not applicable The question doesn't arise here. The cell says why.

The three hosting options

Self-host

You run alwyse on your own machine or server. Your data and your models stay on your box, and there is no alwyse operator in the path at all: you are both. Today your devices reach it over your own network.

Cloud

The managed service we operate. Today this is the beta most people use during early access. It has standard isolation, which is a real protection but not operator-blindness. What it does promise is that running it never requires reading you.

Cloud Confidential

The operator-blind managed tier: sealed inside confidential-computing hardware, with attestation your own device can check, and models that run inside the seal. It does not exist. The approach is designed, no build is scheduled, so nothing here claims it in the present tense.

As shipped today

A point-in-time snapshot, last reviewed 10 July 2026. This is what is true now, on the tiers as they exist now. The plain-language detail, and where each guarantee stops, is spelled out claim by claim below.

Claim Self-hostYou run it; no operator in the path CloudStandard isolation; today, the beta Cloud ConfidentialDoes not exist yet
No alwyse employee or cloud admin can read your content Not applicableNo alwyse operator is in the path. You are both operator and user Not offeredStandard isolation, by design. See the next row for what Cloud does promise Not offeredTier not available
Your device can cryptographically verify that blindness Not applicableNothing to attest; you hold the keys Not offeredNothing to attest Not offeredTier not available
Running the service never requires reading your content Not applicableWe run nothing ShippedYour own cell and database; a content-free control plane; logs that never capture content Not offeredTier not available
You can run alwyse entirely inside the boundary ShippedLocal models. Nothing crosses, and no crossing is even recorded BuildingThe beta's model is a key you bring, so ordinary inference crosses Not offeredTier not available
Nothing crosses the boundary unless you choose it, and every crossing is recorded BuildingRecording and the destination guard ship; the consent dial does not BuildingRecording and the destination guard ship; the consent dial does not Not offeredTier not available
You can reach your own instance remotely without alwyse seeing your traffic Not offeredThere is no remote reach yet. Your devices reach it over your own network Not applicableYour cell is reached directly; no relay in the path Not offeredTier not available
You can take everything out (export) ShippedFull local takeout ShippedServed by your own cell, never our control plane Not offeredTier not available
You can delete anything (deletion) BuildingRemoval shipped in every app; physical erasure pending BuildingRemoval shipped in every app; physical erasure pending Not offeredTier not available

We never blur the tiers. A sentence that is true only on self-host names self-host. "Provably private" with no tier attached is a violation of our own rule, and Cloud Confidential does not exist, so nothing here claims it in the present tense.

Where each claim is headed

This table grants nothing. It is the roadmap, not the permission, and only the table above describes what you can rely on today. Where a claim has a target, it is the moment it becomes real, never a date. Where it has none, we say so.

Claim Self-host Cloud Cloud Confidential
Operator-blindness Not applicableNo operator in the path NeverBy design; standard isolation is the tier No targetDesigned, not scheduled
Attestation Not applicableYou hold the keys NeverNothing to attest No targetDesigned, not scheduled
Content-blind operation Not applicableWe run nothing Shipped Arrives with the tierSuperseded by operator-blindness
In-boundary models ShippedLocal models Before broad launchA shared model host inside the boundary Arrives with the tierInference inside the seal
Recorded crossings, and the levers over them No targetRecording and the destination guard ship; the consent dial is designed, not scheduled No targetRecording and the destination guard ship; the consent dial is designed, not scheduled Arrives with the tier
Remote reach without alwyse seeing it Before broad launchThe relay, and its blind transport, land together Not applicableReached directly Not applicableReached directly
Export Shipped Shipped Arrives with the tier
Deletion Before broad launchRemoval shipped in every app; physical erasure completes it Before broad launchRemoval shipped in every app; physical erasure completes it Arrives with the tier

Two rows say Never, and we'd rather write that than leave them looking merely unfinished. Cloud will not become operator-blind, because standard isolation is what that tier is. There are also no commitments beyond broad launch: the claims that would sit there belong to Cloud Confidential and to the consent dial, and both are designed with no build scheduled. When one is scheduled, this table will say so.

Claim by claim

No alwyse employee or cloud admin can read your content

  • Self-host Not applicable
  • Cloud Not offered
  • Cloud Confidential Not offered

On self-host, this question doesn't arise. There is no alwyse operator to be blind: the person who installs it is both the operator and the user, and that is you. The sentence is trivially true, which is exactly why we won't sell it to you as something we provide. The moment an operator does enter the path on self-host — when you reach your box from your phone, over our relay — it becomes a real question, and it has its own row below.

On Cloud it is not true, and we won't pretend otherwise. Cloud uses standard isolation, the same kind most software you already rely on uses. That's a reasonable protection, but a determined administrator with infrastructure access could reach your data. This is not a gap we are racing to close on that tier: standard isolation is the tier, by design. What we built instead is the next claim, and it is a real one.

Cloud Confidential is the tier that would close it without asking you to run anything, by sealing your content inside confidential-computing hardware. It does not exist. The approach is designed, no build is scheduled, and so we make no present-tense claim about it anywhere.

Your device can cryptographically verify that blindness

  • Self-host Not applicable
  • Cloud Not offered
  • Cloud Confidential Not offered

A promise you can't check is just a promise. Attestation is the proof: your device asks the hardware to show it's running the exact sealed software we published, before it trusts anything to it. On self-host there is nothing to attest, since you already hold the keys and run the code. On Cloud there is nothing to attest either, because Cloud is not operator-blind to begin with, and it never will be. Attestation is the defining feature of Cloud Confidential, and it arrives when that tier does. No build is scheduled, so until then we don't claim it.

Running the service never requires reading your content

  • Self-host Not applicable
  • Cloud Shipped
  • Cloud Confidential Not offered

"We don't offer operator-blindness" is a non-answer for the tier nearly everyone is actually on. So here is what Cloud does promise, and it is built, not planned. Your cognition lives in a cell of its own: its own instance, its own database, not a row in a shared table. The control plane that handles your account, your payment, and finding your cell holds only account records, content-free meters, and key fingerprints. It never receives your content. When alwyse thinks, your cell calls the model vendor directly on your key; that traffic never passes through us. Your export is served by your cell, never by our control plane. Each cell holds only its own keys, so a compromise of one is an event confined to one.

And our logs cannot contain your content, because the content is never captured to begin with. Where a log could be read by an operator, alwyse doesn't build the payload rather than building it and filtering it. A filter is a leak waiting to be misconfigured. What the crossing log records is that a request went to a given host, never the path, the query, or a word of what was in it.

Here is the limit, stated in the same breath. We operate that cell. An administrator with access to the underlying infrastructure could reach the data at rest inside it. That is precisely why this is not operator-blindness and why we never call it that. This claim says running the service does not require reading you, and that we built it so it doesn't. It does not say we cannot.

You can run alwyse entirely inside the boundary

  • Self-host Shipped
  • Cloud Building
  • Cloud Confidential Not offered

AI needs a model to run, and where that model runs decides who sees your content. A model inside your boundary sees it and tells no one. A model outside it is a vendor, under their terms. On self-host you can run entirely on local models, and then nothing crosses at all: there isn't even a crossing to record.

On Cloud today you bring your own key, so ordinary inference goes out to that vendor, and we say so plainly rather than blur it. A shared model host inside the boundary, so that a Cloud instance can think without anything leaving, lands before broad launch.

A sealed enclave does not by itself stop your content reaching a model vendor. Those are separate questions, and conflating them is how a privacy claim quietly becomes false. What would keep content inside Cloud Confidential is that its models run inside the seal too, and that arrives with the tier. Even then, you may still choose to reach out to a frontier model from inside it. That choice stays yours.

Nothing crosses the boundary unless you choose it, and every crossing is recorded

  • Self-host Building
  • Cloud Building
  • Cloud Confidential Not offered

The transparency half is real. Every crossing of your boundary is recorded, content-free, from the service and from the app alike. Model calls can only reach a closed set of endpoints you have configured; anything else is refused before a byte leaves, and the refusal is recorded too. When alwyse fetches a link you shared, it checks the address it is about to connect to rather than the name, so a hostname can't quietly redirect it somewhere private.

The levers are partly real. You choose local or cloud models, per task, and can change it while running. You bring your own key. You decide which sources feed in, and can cut any of them at any time. What does not exist yet is the consent dial: standing rules you set once, per compartment, that alwyse then enforces on the crossings it would otherwise make on its own. Today a crossing you initiate is its own consent, and crossings alwyse might make by itself are the question that dial answers. It is designed. It is not scheduled. Until it is built, "you control what crosses" is true, and "alwyse enforces the rules you set about what may cross" is not.

You can reach your own instance remotely without alwyse seeing your traffic

  • Self-host Not offered
  • Cloud Not applicable
  • Cloud Confidential Not offered

Self-host is the one place where alwyse has no operator in your path, and the relay is the one thing that would put us there. Reaching the box in your home from a phone on a train means passing through something of ours. So this is a claim in its own right, and today the answer is that we don't offer it: there is no remote reach yet. Your devices reach your instance across your own network.

When it lands, before broad launch, it lands blind: the relay carries traffic it cannot read. We are stating that as a design commitment, not as a shipped fact, and the two will ship together or the claim waits. An earlier version of alwyse had a relay that looked encrypted, with per-device keys nothing ever used and certificates no client ever checked. We keep it in our own notes as the example of how this goes wrong. Cryptography nothing consumes is theatre, and we would rather show you an empty cell than a reassuring one.

You can take everything out

  • Self-host Shipped
  • Cloud Shipped
  • Cloud Confidential Not offered

Ownership means you can leave with everything. Full export ships today: a complete takeout of your observations, the cognition alwyse derived from them, your media, and your preferences. It is served directly by your own instance and never passes through our control plane, so it is content-blind on both offered tiers. On self-host and on Cloud you can do this now. On Cloud Confidential it arrives with the tier, whenever that is.

You can delete anything

  • Self-host Building
  • Cloud Building
  • Cloud Confidential Not offered

Ownership also means you can erase, and most of this is real today. In every alwyse app — on the web, on iOS, on macOS, and on Android — you can delete a single entry, or everything derived from a connected source, from your settings. It is gone from every live read immediately, cascading through whatever alwyse inferred from it, and any copy sitting in a backup expires within thirty days.

This is the standard we hold ourselves to, in the words alwyse uses with you:

Deleted means gone — removed from everything I show you right away, and then erased for real. Not hidden.

One part of that is still being finished, and we would rather name it than let the promise outrun it. When you delete, it leaves everything alwyse shows you at once, on every device, and its backups expire within thirty days. What is not yet automatic is compacting the deleted content out of the underlying store — erasing the bytes, not only dropping them from every view. That is the one reason this row reads building and not shipped, and finishing it is a commitment we have made for before broad launch.

None of this is in tension with alwyse keeping a faithful record of your life. Append-only is a promise about integrity, not a refusal to forget: it means your history is never quietly rewritten, and that corrections supersede rather than falsify. You decide what alwyse holds; alwyse decides only that it won't rewrite the past behind your back.

What these guarantees don't cover

Operator-blindness is a strong claim, so here is exactly where it stops. Stating the edges is the point, not fine print hidden at the bottom. Even where alwyse is operator-blind, the guarantee is about software and administrative access to your content. It does not defeat a valid legal order for data you hold; it does not claim immunity from someone with your unlocked hardware in hand; and it rests on the limits of the secure-enclave hardware we build on, which has documented failure modes of its own.

Some metadata stays visible so the service can run, even on tiers where its content is not: that a request happened, and its rough size and timing. We'd rather you know the shape of the guarantee than discover its edges later.

None of it covers what you decide to send out. If you ask alwyse to use a frontier model, or search the web, or read your calendar, then that thing crosses the boundary and lives under someone else's terms. That is not a hole in the guarantee. It is the guarantee working: the boundary held until you chose to cross it, and alwyse recorded the crossing. What we owe you is that the choice is yours, that it is visible, and that staying inside is always a real option.

Deletion has an edge worth naming too. Removing an original takes it out of everything alwyse shows you, and anything alwyse derived from it updates in turn: a note that stood only on what you deleted goes with it, and a note that also drew on other things stays, with the deleted piece taken out. Such a derived note can hold a trace of the deleted content until alwyse next recomputes it. We say that plainly rather than imply a reach we don't have.

Why publish the gaps at all?

Because a transparency page that only shows the wins isn't transparent. Putting the whole ladder in public makes it self-enforcing: no marketing sentence can quietly claim more than this table admits. If you ever catch one that does, it's a bug. Tell us.

Where this is going

The destination is simple to state and hard to earn: a version of alwyse where you can have an instance nobody but you can read, without having to run it yourself, and where you can take it all out or delete it whenever you want. Note what that sentence does not say. It does not promise operator-blindness on Cloud, because standard isolation is what that tier is, and pretending otherwise later would cost more than admitting it now. It says you will be able to choose a tier where the guarantee holds.

We're not there yet. This page is the honest scoreboard of how far we've gotten, and it changes in the same breath the product does.