"Encrypted AI chat": what it protects, and what you still have to trust

Most AI privacy promises come down to a sentence in a policy: we don't log your chats, we don't train on them, we delete them after 30 days. They may all be true. You still can't check any of them, so you're taking the company's word for it.

Brave is trying something different. The Register reports that the browser maker now encrypts conversations with the GLM model in its Leo assistant so that, by design, only a sealed-off piece of hardware can read them. Brave's own write-up goes into the detail. You probably won't use Leo at work, and this isn't a recommendation. But "encrypted AI chat" is a phrase you'll hear more often, and Brave's post is unusually clear about what it covers and what it doesn't. That makes it a good place to learn which questions to ask.

What "encrypted" usually means, and what's different here

Your data can sit in three places: stored on a disk (at rest), moving across the internet (in transit), or being worked on by a computer (in use). Most online services already encrypt the first two. The gap is the third. To answer your question, the AI has to read your words, and whoever runs that server could, in principle, read them too.

Brave's setup is aimed at that gap. The browser encrypts each prompt, and any web page you share with the assistant, before it leaves your machine. The key that unlocks it exists only inside a trusted execution environment (TEE), a walled-off area of the processor and graphics chips that the rest of the server can't look into. Brave's message passes through its own relay, which sees where the request came from but not what it says. The TEE sees what it says but not where it came from.

Before handing over the key, the TEE has to prove what it is: genuine hardware, running known code and the model that was asked for. That proof is called attestation.

What it doesn't cover (yet)

Brave is open about the gaps, which is part of why this is worth reading:

• Someone else still checks the proof. For now, your browser relies on Brave's server to confirm the TEE is genuine. Brave says checking in the browser itself comes later. Until then, you're trusting Brave on that step.
• More is on the to-do list. The Register lists a public log of TEE keys and proof of the exact model weights loaded into memory as still to come.
• The trust doesn't go to zero. Brave lists where its chain of checks ends: Intel and Nvidia, the enclave's operating system, the build records, GitHub, Hugging Face and public DNS. That's fewer parties than "trust us", but it isn't none.
• It covers one model. The protection Brave describes applies to chats with the GLM model in Leo, not to every model or feature in the product.

And encryption only protects the conversation. It doesn't make the model's answer correct, and it doesn't change what the model does with whatever you paste in.

Brave makes a point in its post that's useful well beyond its own product: "whoever runs it could still read your conversations." An open model on its own isn't private. What matters is who operates the machine it runs on.

A prompt for any "private" or "encrypted" AI tool

Whether your team is picking an AI service or building on one, this prompt turns a vague promise into something you can check. Paste it into your AI assistant along with the vendor's privacy or security page:

Below is an AI vendor's privacy or security page. Using only that page, answer these four questions about its "private" or "encrypted" claim:

1. Encrypted where? Is my data protected at rest, in transit and while it's being processed? If it's protected while being processed, how?

2. Policy or proof? Is the protection a promise in a policy, or a proof I can check, such as hardware attestation?

3. Who does the checking? If there's a proof, who confirms the secure hardware is genuine: the vendor's own server, or something else?

4. Which models, plans and features does it cover?

If the page doesn't answer a question, write "not stated". Don't guess, and don't fill gaps from general knowledge.

[Paste the vendor's page here]

If none of those answers satisfy you for a particular kind of data, the other route is to run an open model on hardware you control. That has its own costs and risks, so it's a separate decision.

The takeaway

"Encrypted AI" can mean a lot or very little. The useful version protects your data while it's being processed, lets you check that protection rather than take it on faith, and says plainly what you still have to trust. Ask for all three before your team pastes anything sensitive into a tool.