How it works
An ordinary cloud service, homomorphic encryption and a closed machine: who can read your data while it is processed. One sentence per frame; the details below.
The lock is there on the way, not while the data is processed.
1 Locked on the way.
2 Opened on the server, so the software can work on it.
3 The provider can read it, and the cloud operator is not kept out.
The data is never opened on the service: it computes on the encrypted form.
1 Your browser locks the data.
2 The service computes on it without unlocking it.
3 Only your browser unlocks the answer.
Opened, but inside a closed machine designed to keep the cloud operator out. In TAIA Confidential Ask, TAIA’s own process will read it there.
1 The data goes into a closed machine.
2 It is opened inside; the processor encrypts the memory against the outside.
3 The answer comes back to you.
Not the same thing
It cannot be turned back into the data, and it can be compared for an exact match. Nothing can be computed on it, and a short input such as a name can be guessed by hashing a word list.
The service computes on the encrypted data and returns an encrypted answer. Only the holder of the key, here your browser, can open it.
In more detail
Your browser makes a fresh key for each check, turns the name into a number and encrypts it with homomorphic encryption (BFV). The key never leaves the browser tab. TAIA’s service computes on the encrypted number with the lists and sends back an encrypted answer; it holds no key that could open the name or the answer. Your browser opens the answer and then discards the key. Live in TAIA Confidential Screening; the same idea runs in VaultSearch, a pilot, and in the BlindScreen demo.
TAIA Confidential Ask will run its model on AMD SEV machines, whose memory the processor encrypts, per GKE’s node label. The data will be opened inside that machine, and TAIA’s own process will read it there to answer; it is not homomorphic encryption. The memory encryption is designed to keep the host and the cloud operator out. The badge the service will show reads a node label from Google’s Kubernetes service; it is not a remote attestation, and AMD SEV does not claim memory integrity as the newer SEV-SNP does.
The connection is encrypted on the way (TLS). On the server the data is decrypted so the software can work on it: the provider’s software reads it, and the machine’s memory is not encrypted against the cloud operator.
No outside cryptography review yet. That TAIA’s service does not see a name holds for the page’s code as TAIA publishes it; TAIA serves both the page and the service. The service still sees that a request arrived, when, its size and your network address. VaultSearch hides the search terms, not the index’s vocabulary, which someone holding a word list could guess. TAIA is not supervised by FINMA.
TAIA Confidential Screening is built on Microsoft SEAL 4.1.2 (MIT licence), compiled to WebAssembly via node-seal 7.0.0, with the BFV scheme.
Microsoft SEAL is a trademark of its owner; TAIA is not affiliated with Microsoft.
Who can read what
Three ways your data can be processed, by a service or while AI works on it. For each one: who can read it while that happens.
Your data travels encrypted, then is opened so the AI can work on it.
A name check, not an AI. The service computes on the name while it stays encrypted.
An AI model in a closed machine. Not computation on encrypted data.
TAIA Confidential Screening: this holds for the page’s code as TAIA publishes it; TAIA serves both the page and the service. TAIA Confidential Ask is coming, with no date yet; it will run on AMD SEV machines, per GKE’s node label. No outside cryptography review yet.
Research
Follow one AI question: where homomorphic encryption and a trusted execution environment change what the server sees. An animated, simplified illustration.
Lock a name in your browser and send it: the free demo behind TAIA Confidential Screening.
Research discipline around AI preparation: Quality Control (a metric-gated quality loop), Blind Coordination (privacy-bounded matching research) and Agent Orchestration (decision authority stays human).
Not a current product capability, endpoint or runtime.