← Back to chat
prmptcloak Privacy architecture

Where your secrets can exist,
and where they can't.

A prompt's round trip through PromptCloak. Plaintext secrets exist in exactly two places: your browser, and a sealed hardware enclave that even its own host can't open. Everyone else — the servers in the middle, the frontier model at the end — sees only decoys and pooled, anonymous traffic.

YOUR DEVICE GENERIC SERVERS FRONTIER PROVIDER Your browser "Acme pays Priya $4.2M" real names, real figures plaintext — visible only to you E2EE GENERIC SERVER · UNTRUSTED HOST TEE ENCLAVE · ATTESTED Open-source scrub model gpt-oss-120b — inspectable weights decrypted only inside — the host can't read enclave memory decoys swapped in "Zenith pays Anika $5.1M" SCRUBBED SHARED EGRESS · ANONYMIZED other users' traffic + your request, indistinguishable one pooled stream Frontier model receives: decoy entities origin: shared pool your identity · secrets: never reply returns still wearing the decoys — "Zenith… Anika… $5.1M" Your browser, again decoy → real map · never leaves "Acme pays Priya $4.2M" restored locally — the real answer
Your browser "Acme pays Priya $4.2M" plaintext — visible only to you E2EE GENERIC SERVER · UNTRUSTED HOST TEE ENCLAVE · ATTESTED Open-source scrub model gpt-oss-120b — inspectable weights decrypted only inside — host can't read enclave memory decoys swapped in SCRUBBED "Zenith pays Anika $5.1M" SHARED EGRESS · ANONYMIZED other users' traffic + your request, indistinguishable one pooled, anonymous stream Frontier model receives: decoy entities origin: shared pool your identity · secrets: never reply returns still wearing the decoys Your browser, again decoy → real map · never leaves your device "Acme pays Priya $4.2M" restored locally — the real answer
The round trip. Your prompt is end-to-end encrypted to an attested hardware enclave, where an open-source model swaps every sensitive entity for a decoy. The decoy prompt leaves through a shared pool of many users' traffic, so the frontier provider sees one anonymous stream. The reply comes back still wearing its decoys, and your browser — the only holder of the mapping — restores the real terms.
plaintext secrets can exist here encrypted / sealed boundary decoys only

What each party can see

You

your device
  • Everything — the real prompt and the real answer
  • The decoy map, held only in your browser
  • Every swap, reviewable before sending

Server operators

generic infrastructure
  • Encrypted blobs entering and leaving the enclave
  • A sealed enclave they host but cannot open
  • Your plaintext — never decryptable by the host
  • Which request in the pool is yours

Frontier provider

the big model
  • A fluent prompt about Zenith and Anika — decoys
  • One shared traffic pool, thousands of users wide
  • Real names, figures, or proprietary terms
  • Who asked — no account, no identity, no device