Privacy that is measured, not promised.

Every number on this page came out of a script in our repository. Each one can be re-run — and disagreed with.

Hardware: Intel Core i5-5250U, 1.6 GHz — a 2015 two-core laptop. Deliberately unflattering.
Chain: Solana devnet, program 7nRKg…BLcHZ, 100 receipts written one at a time.
Crypto: PBKDF2-SHA256 at 600,000 rounds; AES-GCM-256 per memory; AES-KW key wrap.
Harnesses: scripts/bench-client.mjs · scripts/bench-chain.mjs · canary-sweep.ts

The privacy invariant

We hid 30 secrets, then searched everywhere they could leak.

Whole database244 KB pg_dump, every table0found
Object storage806 objects, 46 KB0found
API logs34 KB of captured output0found

backend/api/scripts/canary-sweep.ts. A control decrypts memory 1 and asserts the marker is there, so an empty search cannot pass by accident.

Where the time goes

Encryption is under 1% of saving.

Encryption · 1.6 msNetwork + database · 169.4 ms

171 ms

full save, median · p95 203 ms

Client seals → ciphertext to object storage → metadata to the API. n=30, median, local infrastructure.

Encryption cost

Sealing a memory takes milliseconds — even a 10 MB voice note.

1 KB

0.5 ms

10 KB

0.5 ms

100 KB

0.9 ms

1 MB

6.3 ms

10 MB

83.4 ms

AES-GCM-256 per memory, key wrapped with AES-KW. Median of 20 runs (5 at ≥1 MB). 2015 laptop.

On Solana

98 of 100 receipts confirmed, median 1.1 s.

1.1 smedian

2.8 sp95

fastest 685 msslowest 4.6 s

Receipt size: 212 B
Of a transaction: 17.2%

Devnet, written one at a time. Both failures were the free public endpoint's WebSocket dropping, not the program rejecting anything.

Unit economics

Receipts cost real money today. Batching makes them a rounding error.

Todaymeasured

$0.64

$2.56

$7.68

5 / mo20 / mo60 / mo

Batchedprojected

$0.03

$0.13

$0.38

5 / mo20 / mo60 / mo

Per user per month, by reflections per month, against an $8 plan (axis top). Today: one rent-exempt account per receipt at $73.85/SOL (22 Jun 2026 quote). Batched: one Merkle root per period, ~20× cheaper — not yet built.

Prior art

Each piece exists somewhere. Nobody binds all three, per access, in public.

Consumer AI chatbots
- Encrypted storage—No
- Attested AI—No
- Public per-access receipt—No
End-to-end encrypted note apps
- Encrypted storageYes
- Attested AI—No
- Public per-access receipt—No
Confidential-cloud AI (e.g. Apple PCC)
- Encrypted storage—No
- Attested AIYes
- Public per-access receipt—No
UNSAID
- Encrypted storageYes
- Attested AIYes
- Public per-access receiptYes

Approach	Encrypted storage	Attested AI	Public per-access receipt
Consumer AI chatbots	—No	—No	—No
End-to-end encrypted note apps	Yes	—No	—No
Confidential-cloud AI (e.g. Apple PCC)	—No	Yes	—No
UNSAID	Yes	Yes	Yes

Our contribution, from docs/paper/research-notes.md: binding attestation, consent version and a content-free receipt — per access, on a public ledger — over end-to-end encrypted personal data.

Not measured yet

What we have not shown, said plainly

Attested-inference round tripIntegration and gated live test are written; waiting on inference credit to run.
Mobile key derivationNo device harness yet. The 2015 laptop is the conservative stand-in.
Anything from real usersThe pilot has not run. It is the dataset for the second paper.

The paper

One build, three outputs.

12 Oct 2026Colosseum submission
Late Oct 2026arXiv preprint
Feb 2027Peer-reviewed paper, with pilot data