Request early access
Home / Security
Security & assurance

Your data stays in the building. We can prove how.

Security is the product, so it is documented, not asserted. This is the model we publish in full: the encryption design, the key-custody rules, and the threat model behind every claim.

End-to-end encrypted

Every hop between enrolled machines, and through the relay, is sealed with per-session keys. Plaintext exists only inside the machine that produced it.

No inbound ports

Desktops never listen for connections. Every machine dials out to the head, so there is no attack surface to expose on the LAN or the internet.

Relay sees only ciphertext

The relay forwards sealed frames it cannot read. U4x holds no keys and can decrypt nothing. Run the relay yourself under your own domain if policy requires it.

Data residency

Prompts, documents, embeddings, and answers are processed only on machines you own, inside your network boundary. Nothing is retained off-site.

Published architecture & threat modelTrust boundaries, data flows, and adversary assumptions, versioned in the open.
Doc
Self-hostable relayCarry your own ciphertext under your own domain; sever the dependency on U4x entirely.
Your domain
Admin-approved enrollmentNo machine joins the fleet without an explicit one-time approval you control.
Policy
Audit log of every turnWho asked what, on which machines, retained on hardware you own for your own review.
On-prem
Independent cryptographic reviewThird-party assessment of the design; report to be published on completion.
Roadmap

What is not on this page is the internal design of how the fleet coordinates work. That is shared with design partners under NDA, not published, so the security posture is verifiable without handing competitors a blueprint.