The team behind Tresor.

A therapist's notes from this morning's session. A lawyer testing a defence before it exists. A consultant's first read of a client's numbers. None of this was shared with an AI company. It was shared with one person, in confidence, often by someone who will never know an assistant was involved.

Every time that work goes into a public AI tool, the circle of people who can read it quietly grows. Not just the practitioner, but the provider, its staff, its contractors, and whoever they answer to next. A handful of companies end up holding the ability to look into an extraordinary number of private conversations at once. Whether they use it today is beside the point. The ability exists, it is concentrated, and it is protected only by a policy that can be rewritten.

We didn't think the people who never consented should have to hope. So we asked a narrower question: can you run frontier models somewhere nobody can look, including the people operating the service? It turns out you can. Hardware enclaves encrypt memory at the chip level, so cloud operators, administrators, and Tresor staff all see the same thing: ciphertext. Every response carries a signed receipt proving it ran where we say it did.

That's Tresor. A workspace and an API for the documents, conversations, and decisions that can't go near a public chatbot. Built in Luxembourg under EU law, by people who would rather show you the proof than ask for your trust.