Encrypted Token Factory

Run inference on fully encrypted data. Nobody can read it: not us, not the model, not the cloud underneath. You hold the only key. An OpenAI-compatible API for open-weight models. Change one base URL and every token comes back encrypted.

Post-quantum-safeYou hold the keysRegion pinnedAttested every reply
Try now →

The Film

Watch the token factory run.

80 seconds inside the factory: encrypted inference, and ETF local proxy.

Public AI security incidents, classified by the boundary that failed

  1. Microsoft confirmed that M365 Copilot processed confidential emails despite sensitivity labels and DLP policy configured to exclude them.Coverage

    PLAINTEXT

  2. A stolen npm publishing token shipped cline@2.3.0, which silently installed a second application and remained live for roughly eight hours.Post-mortem

    PLAINTEXT

  3. Check Point disclosed a ChatGPT flaw combining prompt injection with a hidden outbound channel capable of exfiltrating conversation content.Research

    PLAINTEXT

  4. Unit 42 observed indirect prompt-injection payloads in production telemetry: attempts at access restriction, unauthorized transactions, manipulation, and destruction.Research

    PLAINTEXT

  5. OpenAI reported a compromised TanStack package reaching two employee devices, with credential-focused exfiltration touching internal repositories.Response

    PLAINTEXT

  6. Cereblab reported Grok Build transferring complete Git repositories, including history, during a test that instructed the tool not to open files.Report

    PLAINTEXT

  7. During a cyber-capability evaluation, an autonomous agent escaped its environment and compromised Hugging Face infrastructure across roughly 17,600 reconstructed actions.Timeline

    AUTHORITY

The first six are one failure wearing different clothes: sensitive material existed in readable form somewhere it should not have been readable. Encryption at rest and in transit did not help when exposure happened while the data was in use.

The seventh is the other failure: a system's output was treated as its own authorization. The agent proposed actions and the surrounding infrastructure executed them.

Two boundaries, then: where plaintext exists, and who authorizes the action.

Encrypted Everything

Inference, memory, and guardrails. All encrypted.

Three services share one boundary. Nothing runs in plain text.

FHE / TEEATTESTED

Encrypted inference

Your prompt goes in sealed, the model executes inside the boundary, and a verifiable receipt comes back. Every other token factory sees your data. This one can't.

AnthropicOpenAIGoogleMetaMistralDeepSeekQwenMiniMax
PQ-SAFESCOPEDPORTABLE

Encrypted memory Coming soon

Your AI remembers your preferences, corrections, and decisions without ever storing them in plain text. Change models and the memory comes with you.

NO PLAINTEXTIN-LINE

Encrypted guardrails Coming soon

Mirror AgentIQ checks for policy risks inside the same protection: on ciphertext in the FHE lane, inside the enclave on the TEE lane. The receipt proves they ran.

PIIPrompt injectionJailbreakContent safetyBias and toxicityHallucinationCustom checks

The ownership shift

Use any model. Own your learning loop.

Models are replaceable inputs. Your memory, corrections, decisions, and evaluations are the durable asset.

01 · Control

Keep memory, traces, and evals

02 · Capability

Use the best model inside your boundary

03 · Choice

Change models without losing context

04 · Cost

Route each task by capability and price

05 · Compound

Turn corrections into private capability

06 · Compliance

Prove region and policy on every run

Protected Run

Your learning stays inside the boundary.

Every prompt, safety decision, memory recall, correction, and trace adds to your institutional intelligence. Encrypted Token Factory protects that complete loop and returns evidence for every run.

MIRROR ETF · RUN RECEIPT
etf.mirrorsecurity.io
receipt_idetf_04117
modelzai-org/GLM-5.2
lanefhe_e2e
seal24ms
Prompt encrypted inside the client boundary
guardrails18ms
PII + injection checks inside protection
memory31ms
Encrypted semantic recall · workspace scoped
inference918ms
Model executes inside the selected boundary
reveal6ms
Authorized client decrypts the response
receipt2ms
Guardrails, memory, inference, and trace verified
guardrailsprotected
memoryencrypted
contractsatisfied ✓
signature0x9f3a…c41d
etf.mirrorsecurity.io/v/04117
SIGNED ✓

Local Mode

Encrypted tokens from the tools you already use.

Run the ETF node on your own machine and point any OpenAI-compatible tool at it. Prompts are sealed inside your machine's boundary before a single byte leaves, then routed down the same protected lanes with the same receipts.

LOCAL MODE NODE · http://127.0.0.1:8790

The local node is the sealing point. Your editor talks to localhost in plaintext; everything past the node travels encrypted. Change one base URL and your coding agents, chat clients, and scripts inherit encrypted guardrails, encrypted memory, and run receipts.

$ export OPENAI_BASE_URL=http://127.0.0.1:8790/v1

Claude CodeClaude CodeANTHROPIC_BASE_URL
CursorCursorOpenAI override
ClineClineOpenAI compatible
Codex CLICodex CLImodel_provider
ZedZedopenai_compatible
ContinueContinueapiBase

Protected Model Capacity

Large open-weight model families.

Pick the model that fits each task. Encryption, memory, and receipts work exactly the same on every family.

Moonshot AIMoonshot AIOPEN WEIGHT · FHE

Kimi K3

2.8T total
1M contextLong-horizon agentsVision and video
Z.aiZ.aiOPEN WEIGHT · FHE

GLM 5.2

753B total
1M contextLong-horizon tasksAgentic coding
GoogleGoogleOPEN WEIGHT · FHE

Gemma 4

26B / 4B active · 31B dense
ReasoningCodingMultimodal
QwenQwenOPEN WEIGHT · FHE

Qwen 3.6

35B total · 3B active
CodingAgentsVision
QwenQwenOPEN WEIGHT · FHE

Qwen 3 235B

235B total · 22B active
Thinking modeMultilingualTool use
MetaMetaOPEN WEIGHT · FHE

Llama

70B dense · Maverick 400B / 17B active
General inferenceMultimodalEnterprise adaptation
DeepSeekDeepSeekOPEN WEIGHT · FHE

DeepSeek R1

671B total · 37B active
Deep reasoningMathCode
Mistral AIMistral AIOPEN WEIGHT · FHE

Mistral Large / Medium 3.5

Large: 675B total · 41B active
Enterprise agentsMultilingualMultimodal
OpenAIOpenAIOPEN WEIGHT · FHE

GPT-OSS 120B

117B total · 5.1B active
ReasoningTool useStructured output

Supported families are curated here for clarity. Exact variants, pricing, and current availability live in the signed-in catalog.

Regions

Compute lands in your jurisdiction.

NVIDIA has ~180 Cloud Partners worldwide. Mirror can partner with any of them, so your compute lands in the jurisdiction you pick.

Featured Protection · PQC

Post-quantum protection for AI in use.

FHE protects prompts, memory, and inference on post-quantum-resistant lattice assumptions.

Lattice-based FHE

AI computes on ciphertext using CKKS and ring-LWE.

Harvest-now defense

Captured prompts and memory remain protected for the future.

PQ-ready receipts

Evidence can adopt post-quantum signing without changing your API.

Hybrid ML-KEM

Post-quantum key exchange where the deployment supports it.

Questions

FAQ

What happens to what my AI learns?+
It stays yours. The memory, corrections, evaluations, and traces that build up as your team works are encrypted with your key, stored in the jurisdiction you pick, and move with you when you change models. Your model vendor never owns your learning.
How is it actually encrypted?+
Two lanes, never conflated. The FHE lane runs open-weight models on Mirror-run inference, computing directly on ciphertext with lattice-based FHE. There is no decryption point in the pipeline. TheTEE lane runs closed models inside sealed, attested hardware enclaves. Every run's receipt states which lane executed it.
What is the latency overhead?+
On supported FHE configurations the overhead is roughly 2–5% over plaintext inference for the same model. Every receipt itemizes per-stage timing (seal, guardrails, memory, inference, reveal, receipt) so you can see exactly where time goes.
What proof do I get?+
Every reply ships with a signed run receipt: a signed record confirming the prompt was sealed, guardrails ran inside protection, memory recall stayed encrypted, inference executed inside the selected boundary, and the trace was verified. Receipts are exportable for audit.
What does it cost?+
Pricing is usage-based per token, per model family, so you can route each task by capability and price. Current rates live in the signed-in catalog.
Do I have to rewrite my app?+
No. The factory exposes an OpenAI-compatible API. Change one base URL and your existing SDKs, agents, and tools keep working. Encryption, memory, guardrails, and receipts are applied by the platform.

Get started

Try it on your real workload.

Sign up and change one base URL. Nothing else about your app has to change.

try now →