How we keep your family's data locked.
This page is for anyone who wants the detail: who can read what, how the encryption works, how to check our builds yourself, and exactly where our guarantees end.
v1.hh_7f3a.G6uPujrytj0oVSjNz4zvhv6DRDHXqhYKXtlhki6m9dVAuTC1JYKNOdugVHKa2fSiwYzBBrqYI8yP6EZT6Zd32a59xMFd1hS10HGLxsczVimV/O2XqVmBb
Follow one message through Wasavi.
A parent asks for a reminder. Here's everywhere that message goes, and what each place can see along the way. 74 seconds, captioned.
Who can read your family's messages?
Every part of Wasavi, and exactly what it can see. Orange: can read your messages. Ring: reads one request to answer it, then forgets. Dark: never sees them unlocked.
| Where | What it holds | Can it read your messages? |
|---|---|---|
| Your family's phones and laptops | Your messages, unlocked on the device | Yes. That's the point. |
| Wasavi's servers, queues, database and backups | Sealed envelopes, plus counts with no names attached | No. A full copy of our database would be unreadable. |
| The sealed enclave (AWS Nitro Enclaves) | One household at a time, with no disk and no operator login | Only while answering you, and only if its code matches our published build. Wiped when the session ends. |
| The AI model (Claude on Amazon Bedrock) | The request it's answering | Reads it to answer, keeps nothing, never trains on it. |
| Wasavi employees, including the founder | No household keys. Keys are released to code, not people | No. Changing that would mean publicly shipping a new enclave core. |
| Advertisers, data brokers and other companies | Nothing | No. Ever. |
How a message stays sealed
- 01
Sealed on your device
Your phone encrypts each message with your household's key before it's sent, and signs it so the other adults can see who really wrote it.
- 02
Carried as ciphertext
Wasavi's servers only store and move sealed envelopes. Logs and metrics hold counts and pseudonymous IDs, never what you said.
- 03
Opened only by verified code
AWS releases your household's key only to an enclave whose fingerprint matches a build we've published. One household at a time, no disk, no operator access.
- 04
Sealed again, then forgotten
The answer is encrypted back to your family's devices. Each session runs in a fresh process that holds one household, and it's wiped when the session ends.
No ads. Not as a policy, as a property of the system.
Ad businesses run on reading what you say. Wasavi's servers can't. The only code that can open your family's data is the small, published core inside the enclave, and it decides where anything may go: back to your devices, to the AI model, and to services you connect yourself. There is no path to an ad network, a data broker or another company.
Could we change that? Only by shipping a new core, and every core is published with its fingerprint. If we ever tried, you'd be able to see it.
We will never sell ads or your data. Wasavi is paid for by families, never by advertisers.
Your family is not training data.
Wasavi uses AI models such as Claude through Amazon Bedrock, inside AWS. Bedrock doesn't store these requests, doesn't use them to train models, and doesn't share them with the companies that make the models.
Some models on Bedrock keep data for abuse checks. Wasavi's enclave code refuses to call them, and our AWS account is set to keep no request data, so AWS itself turns those models away.
Not by us, not by Amazon, not by any AI company. Never.
Don't trust us. Check.
Every company says it cares about privacy. We'd rather show you. The security code that guards your family's data is public, and so is a fingerprint of every version we've run.
The fingerprint log
See the full logEvery enclave release, in order. Lines are only ever added. AWS gives your household's key only to an enclave reporting a fingerprint from this log.
| release | commit | pcr0 (first 32 of 96) | date |
|---|---|---|---|
| 0.6.0 | eba71ad | 613cc6711a6341a8aebef55c20989b99 | 2026-10-09 |
| 0.4.0 | cd00659 | fb7e810f6ffe379815fec5e6eb30404b | 2026-10-08 |
| 0.3.0 | f27a530 | 248658c133dd401117dd858abc580fe5 | 2026-10-07 |
| 0.2.0 | 2c9abf9 | 26a010ddcb085acdbcba3751b307e331 | 2026-10-06 |
| 0.1.0 | bb79a14 | 6720679653838157aa917a06682bbdfd | 2026-10-05 |
Rebuild it yourself
Same source, same fingerprint. Our builds are reproducible, so anyone can rebuild a release and compare. Step-by-step guide
git clone https://github.com/Wasavi-AI/wasavi-verifiable cd wasavi-verifiable enclave/build/verify.sh enclave-core-v0.6.0
Your own receipts
- An activity log of every step. What Wasavi read, decided and did, written before it happens. Each entry is chained to the one before, so a missing or edited entry shows.
- Signed messages. Every message from an adult is signed by the device that wrote it. Signed replies from the enclave are coming.
- Which code answered you. The fingerprint of the feature code that ran is recorded in your log, every time.
The fine print, up front.
A security promise is only worth something if it's precise. Here's where ours end.
- Forwarded email will pass through Amazon's mail service
- When email forwarding arrives, Amazon SES will read each email to deliver it, as every mail service must, then seal it under a key only the enclave can use before it's stored.
- Messages to people outside Wasavi will be ordinary email or text
- Wasavi can't message anyone outside your household today. When it can, each message will need an adult's approval and will arrive as normal email or text that the recipient and their provider can read.
- The AI promise is a contract, not math
- The model has to read your request to answer it. That it keeps nothing and never trains on it rests on Amazon Bedrock's terms, which we link to rather than paraphrase: data protection and abuse detection. One exception: AWS may keep, review and report photos it flags as child sexual abuse material.
- Timing isn't secret
- Our systems can see when a household is active and how much. Never what about.
- We can ship new enclave code
- That's exactly why every build is published with its fingerprint. A change to what can read your data can't be made quietly.
- We can't rescue a lost household
- If every adult loses every device and the recovery kit, nobody can recover your data, including us. That's the cost of us not holding a key.
Your keys. Your way out.
Recovery without us
Another adult in your household, or the recovery kit you print at setup, restores access. We never hold a copy of your key.
Delete means gone Coming
Deleting your household will destroy its key, so every copy of your data, backups included, becomes unreadable. Ready before we open beyond our first families.
Take it with you Coming
Export everything in a standard format, encrypted to your own device. Ready before we open beyond our first families.
Questions we haven't answered?
Email privacy@wasavi.ai. If you find a security issue, we want to hear about it first.