MAWARIPrivate AI
TEE + CONFIDENTIAL COMPUTING · INTERACTIVE

Follow your prompt
into the vault.

Your device challenges the server, checks what the Intel CPU and eight NVIDIA B300 GPUs sign, and only then sends the prompt, sealed so only the vault can open it. Play the run step by step, then try to break in yourself. Hover anything in the scene to see what it does and what it can see.

Simulation built from the MAWARI Private AI proposal (v1, 30 Oct 2026) and the AI-in-TEE engineering specification (v0.3.3). Hashes, sizes and timings are illustrative; this page contacts no inference server.

Vault Run

NO SOCKET
Lvl 1 · Curious0 XP
0/12checks passed
0/8breaches blocked
0 Bnetwork saw (ciphertext)
0 Boperator saw (plaintext)
OPERATOR’S EYE This is everything root on the host can read: encrypted VM pages, encrypted GPU buffers, packet sizes and token counts. The vaults show noise.
plaintext ciphertext signed evidence grant / key attack
Drag to orbit · scroll to zoom · click anything
EVIDENCE LOG checked on your device
    WHAT WE CAN AND CANNOT SEE

    We never see content.

    Only what is needed to bill you and keep the service running.

    DataDoes MAWARI see it?Why
    Your requests and answersNoDecrypted only inside the protected chips
    Files and imagesNoParsed inside the vault, never written to disk
    Chat historyNoStored on your device
    Search and tool resultsNoProcessed inside the vault; tools run on your machine
    Training on your dataNoWe have no data to train on
    Token count and request timeYesNeeded for billing; no content attached
    IP addressStandard mode: yes · Max-privacy: noMax-privacy mode routes through an independent relay
    WHAT YOU STILL TRUST

    The chips prove a lot. Not everything.

    A sealed vault proves which chip signed and what booted. These limits stay outside the cryptography.

    Physical access

    Memory-bus interposers, voltage glitching and chip probing are outside the Intel and NVIDIA threat models. They are covered by data-centre controls: cages, cameras, seals.

    Side channels

    Timing and microarchitectural leaks are published platform exclusions. Firmware TCB updates are enforced through the attestation check.

    Metadata

    Network observers and the edge see your IP, timing, packet sizes and the hostname. Max-privacy mode hides the IP through an independent relay.

    Your own device

    Plaintext lives on your device. Malware there, or a compromised OS, sits outside what any server-side vault can protect.

    Stopping a paused vault

    Grants expire within 120 s and your device stops on its own clock. A hostile host that freezes a vault mid-request can delay when GPU work physically stops.

    Model answers

    Attestation proves which model runs, not that its answers are right. Tool calls are validated and executed by your client.

    VERIFY IT YOURSELF

    Same check, every client.

    One open module, mawari-verify, runs the checks from this page in the browser, mobile app, terminal and SDK. Security teams can add it to their monitoring.

    $ mawari-verify api.mawari.ai --model glm-5.3   # illustrative output
✓ challenge     fresh ticket · authority key pinned
✓ cpu           Intel TDX quote · TCB up to date · REPORTDATA = transcript
✓ gpus          8/8 NVIDIA B300 · CC on · OCSP good · RIMs signed
✓ release       mawari-vault 1.0.0 · weights hash published (TUF)
✓ grant         broker + authority countersigned · 118 s left
✓ socket        exporter-bound · AUTHORIZED
→ safe to send. The operator cannot read this connection.