Every claim, and where you check it
Four claims worth making, each with the file or the command that settles it. A claim without one is marketing.
Her mind runs on hardware the operator controls. The process refuses to start against a public AI endpoint, and that is a boot-time check rather than a policy.
Check
src/config.ts:191-239
No message a member writes is ever sent to an external AI. One deliberate exception exists, and it is not an AI: when a member explicitly asks her to look something up, that one question, their own words with the trigger phrase removed, at most 300 characters, goes to the configured search provider, and to nothing else.
Check
src/plugins/web-search/service.ts:330
The Assembled Word page renders each prompt with the reply path's own function: it is not a description of the prompt, it is the assembler run again, over the live rule registry.
Check
npm run verify:prompt-identity
The model writes words. Identity, permissions, consent and execution stay in deterministic code, and every sentence of that boundary has a check that goes red if it moves.
Check
npm run verify:memory && npm run verify:search
LOCAL_AI_BASE_URL must use localhost or a private IP address. Public AI endpoints are disabled.
so archived member text cannot be sent to a public service by a configuration typo
No AI cloud is not no outbound traffic
The difference between those two is where a page like this would normally trade. Here is the whole outbound list instead.
Everything that leaves the machine
The claim is no AI cloud. It is not no outbound traffic, and a page that let the first be read as the second would be trading on the difference. Here is everything that leaves the machine, which a sweep of the source produces rather than a promise.
- the SimpleX relays themselves, which are the transport, end-to-end per protocol
- the opt-in search providers, the query only
- the opt-in price providers, the ticker only
- a one-time video thumbnail fetch when SimpleX delivered none, stored and served locally after
- an operator-configured security webhook, empty by default
Nothing else.
It is passed to the provider and to nothing else.
The model writes words, and nothing else
Identity, permissions, consent and execution are deterministic code, and every sentence of that boundary has a check that goes red if it moves.
What she may, and what she may never
She may word a reply. She may claim an intent, which is then re-validated against a closed catalog. She may declare which results she used, which can remove a source and can never add one.
She may never execute anything, touch consent, claim a lookup nobody asked for, reach a capability that is off for her bot, act as a different bot, put a message on a bridge or a music send, write the application's own lines, or obey text that arrived inside a search result or a memory.
A model error never executes an action; the deterministic resolver handles that message instead.
a model that invents an intent must be treated as having said UNKNOWN
There is no code path that can move a result into the instruction section
THE REPLY PATH'S OWN FUNCTION, not a second assembly that agrees with it today
Where the attestation gap actually lives
It is a security fact before it is a commercial one, and it belongs to one tier rather than to the product.
The attestation gap is a security fact before it is a commercial one, which is why the tiers are on this page. It does not apply to the product. It applies to exactly one of the three, and it is named there and nowhere else.
1Self-hostedbuilt
The customer's hardware, the customer's keys, the source in their hands. Nothing to trust: they can look, and the attestation gap does not exist here because there is nobody to attest to
The complete runbook path, and the licence. Customer keys is literal: the at-rest media key with no key history, so rotation destroys the archive and it is unambiguously theirs; the session secret; their own passkeys; and the identity database on their own disk
2Hosted by usstarted
Our hardware, and no third-party AI service. The protection is contractual and physical rather than mathematical: we can technically read what passes through, and we say so plainly
A contract; source they can read; and access that leaves a trace. Admin logins and failed ones are audited with method and address, step-up re-auth is audited, viewing a media original writes an audit row, every rule edit records both sides, and consent has its own append-only journal. What is unbuilt is multi-tenancy: hosting a customer today means running a separate deployment
This is where the attestation gap lives: a member of a hosted deployment ultimately trusts its operator, as on every hosted service ever run
the audit covers console actions - root shell access on the host is beneath the application and cannot be logged by it
3Hosted with an external modeldeclined
Cheaper, and faster at some things, and the members' messages reach a third party. Today the code refuses this tier at boot, so it is not a setting that can be turned on
Offering it requires a deliberate code change, which is exactly the posture to print. Partial machinery exists for the declaration it would need: she already states her model as a live given fact, and a dormant per-profile flag pair exists that nothing consumes today
IMPLEMENTED BY ABSENCE — there is no cloud path to disable
She thinks on silicon I can put my hand on, in a building I hold the keys to.
The current schema is single-tenant — no tenant key exists in any table yet.
Self-hosting gets you the complete product, and nothing in this section is a feature gate.
The strongest claims a reader cannot verify
Answered for a hostile, competent reader, because they are the ones who matter and they will find these anyway.
Everything above is checkable. These are not, and they are the ones a hostile, competent reader asks about. Each is stated with what is deterministic underneath it, and with the part that is measured rather than guaranteed.
1The conversational ceiling is held by the modelinference
The four hard-limit sentences are in every conversation prompt and nothing deterministic filters an explicit reply on the way out. A reader can verify the sentences, their position and the checks. Nobody can verify the model's compliance on the next request
The deterministic layers are guarantees; conduct under them is a measured, re-measurable property. The recorded refusals exist and the instrument re-runs them
2She never reveals a withheld lawinference
Selection is deterministic and mutation-proven: no question can select a withheld rule, and the gates answer the probing shapes before any model runs. But the model reads every rule, so volunteering one in free prose is only measured
Both recorded leaks are in the tree and each was closed in code afterwards. The standing instruction on the live check says the rest
3The deployment you are talking to runs the code you can readinference
The licence obliges source availability; it is not remote attestation. The tree is silent on reproducible builds and runtime attestation, and the gap is structural: it is the same gap every hosted chat service has. It applies to the hosted tier, not to the product
You can read every line she runs on, and an operator can verify their own deployment end to end; a member of somebody else's deployment ultimately trusts that operator. We do not pretend otherwise
the flag hides nothing from the model
Read its output rather than its exit code: two defects in this work passed every check and were only visible in the answer.
5 of 6 said the results do not cover it and 4 of 6 still attached an invented provenance… it is the reason this decision rests on the floor rather than on the rules.
The stage that is missing, and the address for faults
One part of the safety story is designed and not connected. It is described here as what it is rather than as a feature.
CSAM & content screening (in development)started
This is where CIND3R3LLA is going, and it is not there yet. The design: every image and video is hashed at receipt, independently of consent, and compared against databases of known abuse material. A match is quarantined, encrypted, withheld from every public path and preserved for the authorities, never quietly deleted, because deleting a match destroys the evidence that makes a prosecution possible. Today the storage and quarantine machinery is built and no detection provider is connected, so no screening runs. Note the limit that will remain even once it does: hash matching detects known material only. It cannot detect new material, and a no-match result is not a statement that anything is safe.
Reporting & takedown
A second line after screening: anyone can report published content. The operator reviews and removes it, and every action is audit-logged.
Found a vulnerability?
Report it privately via the security contact in the repository. We credit responsible disclosure and take every report seriously.