How it works
An ordinary cloud service, homomorphic encryption and a closed machine: who can read your data while it is processed. One sentence per frame; the details below.
The lock is there on the way, not while the data is processed.
1 Locked on the way.
2 Opened on the server, so the software can work on it.
3 The provider can read it, and the cloud operator is not kept out.
The data is never opened on the service: it computes on the encrypted form.
1 Your browser locks the data.
2 The service computes on it without unlocking it.
3 Only your browser unlocks the answer.
The code that locks the data runs in your browser but comes from TAIA's server; a published hash of that code lets you compare what your browser received. Code fingerprint
Opened, but inside a closed machine whose memory the processor encrypts against the host. In TAIA Confidential Ask, TAIA’s own process reads it there; the cloud operator is a trusted part of the set-up.
1 The data goes into a closed machine.
2 It is opened inside; the processor encrypts the memory against the host it runs on.
3 The answer comes back to you.
TAIA's administrators and the platform operator hold access that could make a question readable; TAIA's design does not use it, and you cannot verify this yourself today.
Not the same thing
It cannot be turned back into the data, and it can be compared for an exact match. Nothing can be computed on it, and a short input such as a name can be guessed by hashing a word list.
The service computes on the encrypted data and returns an encrypted answer. Only the holder of the key, here your browser, can open it.
In more detail
Your browser makes a fresh key for each check, turns the name into a number and encrypts it with homomorphic encryption (BFV). The key never leaves the browser tab. TAIA’s service computes on the encrypted number with the lists and sends back an encrypted answer; it holds no key that could open the name or the answer. Your browser opens the answer and then discards the key. Live in TAIA Confidential Screening; the same idea runs in VaultSearch and BlindScreen, two research demos.
TAIA Confidential Ask runs its model on AMD SEV machines, whose memory the processor encrypts, per GKE’s node label. The data is opened inside that machine, and TAIA’s own process reads it there to answer; it is not homomorphic encryption. The processor encrypts the machine’s memory against the host it runs on; Google operates the control plane and the machine’s operating system and is a trusted part of this set-up. The badge the service shows reads a node label from Google’s Kubernetes service; it is not a remote attestation, and AMD SEV does not claim memory integrity as the newer SEV-SNP does.
The connection is encrypted on the way (TLS). On the server the data is decrypted so the software can work on it: the provider’s software reads it, and the machine’s memory is not encrypted against the cloud operator.
No outside cryptography review has been made. That TAIA’s service does not see a name holds for the page’s code as TAIA publishes it; TAIA serves both the page and the service. The service still sees that a request arrived, when, its size and your network address. VaultSearch hides the search terms, not the index’s vocabulary, which someone holding a word list could guess. TAIA is not supervised by FINMA.
Parameter check, done by TAIA. TAIA Confidential Screening uses the BFV scheme with a polynomial degree of 4096 and a total coefficient modulus of 109 bits, which is Microsoft SEAL's default for 128-bit security at this degree; ciphertexts are sent at the 72-bit data level. The total of 109 bits equals the upper limit of the 128-bit classical security row for this degree in the public parameter table of the Homomorphic Encryption Security Standard (HomomorphicEncryption.org, v1.1, November 2018, Table 1, ternary secret). The same table's post-quantum row allows at most 101 bits for this degree, which these parameters exceed; TAIA makes no post-quantum claim. SEAL itself refuses to create these parameters unless they meet its 128-bit classical limit. TAIA made this comparison itself, against the published table and the library's own check; it is not a certificate, not a proof, and not an outside review. No outside cryptography review has been made.
TAIA Confidential Screening is built on Microsoft SEAL 4.1.2 (MIT licence), compiled to WebAssembly via node-seal 7.0.0 (the service: SEAL 4.7.2, from 2 November 2026), with the BFV scheme.
Microsoft SEAL is a trademark of its owner; TAIA is not affiliated with Microsoft.
TAIA Confidential Screening runs on Google Cloud in the europe-west6 region (Zürich). According to Google's compliance pages, as read on 1 November 2026, Google Cloud holds an accredited ISO/IEC 27001 certification and ISO/IEC 27017 and ISO/IEC 27018 certifications for its platform, undergoes SOC 2 Type II audits by Ernst & Young LLP and Coalfire, and holds a C5:2020 attestation (BSI, Germany); the Google services TAIA uses, Google Kubernetes Engine and Compute Engine, are listed in their scope. These are Google's certifications of Google's platform. TAIA is not certified against any of these standards, and Google's certifications say nothing about TAIA's software or about the way TAIA runs it.
Who can read what
Three ways your data can be processed, by a service or while AI works on it. For each one: who can read it while that happens.
Your data travels encrypted, then is opened so the AI can work on it.
A name check, not an AI. The service computes on the name while it stays encrypted.
An AI model in a closed machine. Not computation on encrypted data.
TAIA Confidential Screening: this holds for the page’s code as TAIA publishes it; TAIA serves both the page and the service. TAIA Confidential Ask runs on AMD SEV machines, per GKE’s node label. No outside cryptography review has been made.
Research
Follow one AI question: where homomorphic encryption and a trusted execution environment change what the server sees. An animated, simplified illustration.
Lock a name in your browser and send it: the free demo behind TAIA Confidential Screening.
Research discipline around AI preparation: Quality Control (a metric-gated quality loop), Blind Coordination (privacy-bounded matching research) and Agent Orchestration (decision authority stays human).
Not a current product capability, endpoint or runtime.