Evane

Privacy & security

Evane splits what each party learns. Your machine strips personal data, an Intel TDX VM relays the rest without seeing who you are, and the provider sees a prompt from Evane. Here is exactly who can see what, and how to check it.

Who sees what

Pick who is looking. Inside the VM, the gateway sees each redacted request while it relays it, but neither Evane nor Phala can read the VM’s memory.

Evane runs the gateway, but inside an Intel TDX VM whose memory it cannot read. The gateway logs no request content; its ledger keeps one row per account: the running total charged, the latest receipt and when they changed.

Learns 3 of 7

  • Prompts and responsesDoesn’tHandled only inside the VM, whose memory Evane cannot read, and never logged.
  • Personal data in promptsDoesn’tReplaced with placeholders on your machine, before anything is sent.
  • Your IP addressDoesn’tConnections reach the VM through Phala’s relay, and the gateway neither logs nor forwards addresses.
  • Your wallet addressSees itFrom the public chain: the vault records which wallet funded each account.
  • Which account paidSees itIts ledger keeps each account’s running total and latest receipt.
  • Model and token countsDoesn’tThe ledger holds amounts only; which model a request used stays in the VM.
  • What you spentSees itRunning totals per account, as charges land.

Phala Cloud hosts the VM. Intel TDX encrypts the VM’s memory against its host, and the gateway’s TLS ends inside the VM, so Phala relays ciphertext.

Learns 1 of 7

  • Prompts and responsesDoesn’tTLS ends inside the VM; Phala relays ciphertext it cannot read.
  • Personal data in promptsDoesn’tReplaced on your machine; never sent at all.
  • Your IP addressSees itIt relays your connection, so it sees which address connects and when. Set a SOCKS proxy such as Tor in clientd.toml to hide it.
  • Your wallet addressDoesn’tNot in anything it handles.
  • Which account paidDoesn’tOnly inside the encrypted channel.
  • Model and token countsDoesn’tOnly inside the encrypted channel.
  • What you spentDoesn’tOnly inside the encrypted channel.

Anthropic, OpenAI or OpenRouter answers the request. It is called by the gateway, with Evane’s API key, so to the provider every user looks the same.

Learns 2 of 7

  • Prompts and responsesSees itThe redacted prompt and its response: it needs them to answer.
  • Personal data in promptsDoesn’tReplaced before the request left your machine.
  • Your IP addressDoesn’tIt sees the gateway’s address, not yours.
  • Your wallet addressDoesn’tNothing in the request names it.
  • Which account paidDoesn’tIt sees Evane’s API key, shared by every user. Fields such as user and metadata are stripped.
  • Model and token countsSees itThe model you asked for and the tokens it bills Evane for.
  • What you spentDoesn’tIt bills Evane, not you.

Robinhood Chain is public. The vault’s records are readable by anyone, which is what lets you check every settlement yourself.

Learns 3 of 7

  • Prompts and responsesDoesn’tNothing about requests goes on-chain.
  • Personal data in promptsDoesn’tNever on-chain.
  • Your IP addressDoesn’tNot on-chain. Your wallet’s own RPC provider sees it when you send a transaction.
  • Your wallet addressSees itFunding an account is a transaction from your wallet.
  • Which account paidSees itThe vault links each account to the wallet that funded it.
  • Model and token countsDoesn’tSettlements carry amounts only.
  • What you spentSees itSettled totals per account, in batches every 100 requests or 5 minutes.

Try the redaction

These are evane-clientd’s own rules, run in your browser: what the daemon replaces before a request is signed, and what it leaves alone, such as dates, versions and order numbers.

173 of 4,000 characters. It never leaves this page.

What leaves your machine

Summarize the invoice from [email] and call [phone] if it's over $5k. The server at [ip] billed card [card] on 2026-10-01 for order 12345.

Replaced 1 email address, 1 IP address, 1 card number, 1 phone number.

What was replaced
  • priya@example.com became [email]
  • +1 555 0142 became [phone]
  • 203.0.113.42 became [ip]
  • 4111 1111 1111 1111 became [card]

The enclave, checked live

The gateway proves what it runs with a quote signed by Intel: which OS image booted, and which app and configuration dstack started. Your daemon accepts only the values pinned below.

Asking the gateway for a fresh attestation…

This page checks what can be checked from a web server: the measurements in the quote against the pins, the event log against the quote, and the quote against a nonce it just chose. It does not verify Intel’s signature over the quote. evane-clientd does, along with the platform’s security level, before it sends the gateway anything, and then talks only to the TLS key the VM attests.

What the vault guarantees

The EscrowVault on Robinhood Chain enforces these in code. On top of them, the gateway’s attested code settles only what your daemon signed receipts for.

  • Settlement never pays the caller

    Settled wei moves from an account into protocol fees, which can only be sent to the treasury.

  • Never more than an account holds

    Each settlement moves at most what is left in the account, and settling the same total twice changes nothing.

  • Accounts cannot be hijacked

    An account’s address is derived from your wallet and its session key by the vault itself, so nobody can claim or overwrite yours.

  • Funds are never stranded

    After expiry and the settlement window, anyone can move an account’s remaining budget back to its owner’s balance in the vault. Withdrawals keep working even while the vault is paused.

What it doesn’t do

Worth knowing before you route anything sensitive.

  • Redaction matches patterns: email addresses, phone numbers, IP addresses and card numbers. Names, street addresses and free-form identifiers pass through unless you add your own patterns to clientd.toml.
  • The provider reads the redacted prompt and writes the response. Evane hides who is asking, not what is asked.
  • The chain is public: anyone can link an account to the wallet that funded it, and see what it settled and when.
  • The vault is new and has not been audited. Its owner is a single key today: a compromised owner key could register a rogue validator and settle the budgets of accounts that are live or still settling into the treasury. It cannot touch unallocated balances or anything already reclaimed. Keep budgets small.

The full protocol is in the docs, and the vault’s live state on the vault explorer.