AI that can't read your conversations.
And you can check.

aea runs open models inside hardware enclaves that even we can't open, and stores your history end-to-end encrypted. Every session verifies the enclave before a single word leaves your device.

Open the app Install the CLI

Verified, not promised

Your device checks a hardware attestation report against a public transparency log before it sends anything. If the code running isn't the published code, nothing is sent.

Encrypted before it leaves

Prompts are sealed to the enclave's key on your device. Our servers relay ciphertext and count tokens. That is all they can do.

History only you hold

Conversations are encrypted with keys that never leave your devices. Link a phone or a laptop with a code; recover with a 24-word phrase. We can't read them, and we can't reset them.

Two models, one guarantee

aeaEveryday chat, writing, questions. Fast, with vision. Built on GLM-5.3-Flash.

aea-codeReasoning and agentic coding. Built on GLM-5.3, 1M-token context.

How a message travels

Attest. Your app fetches the enclave's hardware report and the published measurement from Sigstore's log, and confirms they match and that the TLS key is bound to that report.
Seal. The request body is encrypted to the attested key. Our relay adds the upstream credential and meters tokens from headers only.
Answer. The model runs inside AMD SEV-SNP or Intel TDX with NVIDIA confidential GPUs. The reply streams back sealed the same way.
Store. Both messages are encrypted with a per-conversation key derived from your account key, then synced as ciphertext to every device you've linked.

Any coding tool, privately

The aea-ai CLI runs a local OpenAI-compatible endpoint that does the attestation and sealing for you. Point OpenCode, Cursor, Cline or aider at it. aea-code ships as a ready-made OpenCode distribution.

aea-ai login --api-key aea_sk_…
aea-ai serve                       # http://127.0.0.1:4321/v1
aea-code                        # OpenCode, routed through the enclave