Security and guarantees

Version 0.1 · Updated 16 September 2026 · Applies to superintel.com and every Super product that asks it

SuperIntelligence is the AI system behind Sup. Sup is the agent; SuperIntelligence is the intelligence. This page is the whole of what we promise, stated precisely enough to check. Each guarantee says what it means, how it is done, whether it is live today, and how you can verify it without trusting us. Where something is not built yet, it says so.

01Ephemeral keys, zero retention

What it means

No question you ask exists on our side after it is answered. There is no log of prompts, no transcript, no cache. The key that protected the question is destroyed by the same code path that produced the answer.

How it is done

• Your device generates a fresh ECDH P-256 key pair per question and posts the public key to POST /v1/session. The relay answers with its own fresh public key and a random salt. A session may be used once and expires after five minutes.
• Both sides derive the same AES-256-GCM key: HKDF-SHA256 over the ECDH shared secret, the salt, and the info string superintel:v1.
• Your SuperID subject is bound in as authenticated data on the AES-GCM envelope, so a sealed question cannot be replayed as someone else.
• After the answer is sealed, the relay overwrites the key bytes with zeros, deletes the session, and clears the alias map from memory.

Verify it

Open a second question on the same session: it is refused. Sessions and keys are visible in the source of src/server.ts and src/crypto.ts; the zeroing happens in the /v1/ask handler. Independent audit of the relay is welcome; write to [email protected].

02Alias-first prompting (SuperLang)

What it means

The model never reads a name, an email address, a phone number, a card number or an exact amount of money. It reasons over placeholders; the real values are put back on the way out, on the relay, after the model is done.

How it is done

Before the prompt reaches the model, the relay replaces every literal it recognises with a typed alias and turns money into a bucket. The alias map lives only in memory for that one answer. This is the actual transformation the relay performed for the sentence below, run while this page was built:

Rules: people and email addresses become <person_n>, capitalised names <name_n>, phone numbers <phone_n>, long numbers (cards, accounts) <number_n>, and amounts become order-of-magnitude buckets such as [$1k–10k]. Short numbers such as an invoice number are left alone, because the model often needs them and they identify nothing on their own.

Verify it

Every receipt (§4) carries alias_map_sha256, the hash of the map used for that answer, and prompt_sha256, the hash of the aliased prompt. Sup shows you the aliased prompt on request, and the hashes match the receipt.

03Non-materialised compute

What it would mean

No single process, and no single machine, ever holds a whole prompt. Inference runs over fragments so that even a live memory dump of one node shows a piece of nothing.

Where it stands

This is research-grade. It needs the model runtime to accept fragmented input, which the runtime we use (llama.cpp on our own NVIDIA hardware) does not do today. Until it ships, §1 and §2 are the protection: the whole prompt exists on one machine we own, aliased, for the seconds it takes to answer.

04Proof-carrying answers

What it means

Every answer arrives with a receipt signed by SuperIntelligence. Anyone holding the receipt can prove which model answered, what (aliased) prompt it saw, what it said, and that retention was none, without asking us.

How it is done

{
  "v": 1, "id": "…", "ts": "2026-09-16T17:31:02.114Z", "session": "…",
  "model": "gpt-oss-120b",
  "prompt_sha256": "…", "answer_sha256": "…", "alias_map_sha256": "…",
  "schema": "superlang/v1", "retention": "none",
  "kid": "f98eee90b83d076a", "sig": "…"
}

Drop sig and kid, serialise the remaining fields as JSON with the keys sorted, and verify the Ed25519 signature with the key whose kid matches at /.well-known/superintel-keys.json. That is the entire algorithm; the verifier below is forty lines of browser code.

Verify it

What is next: zero-knowledge receipts that prove the aliasing rules were applied to the prompt without revealing the prompt.

05A privacy budget

What it would mean

When SuperIntel answers aggregate questions over your own memory and files, an (ε, δ) differential-privacy accountant limits how much any sequence of questions can reveal about a single item, and stops answering when the budget is spent.

Where it stands

Not built. It belongs with per-user memory and the personal model, which are the next things after §3. Until then, SuperIntelligence does not answer aggregate questions over stored data; it answers from the text you send with each question.

06Memory you own

What it means

If you let SuperIntelligence remember things, the memory is yours: sealed on your device, synced to your SuperID, listable and erasable by you, unreadable by us.

How it is done

Memory rows are ciphertext ({kind, source, iv, ct}) sealed with a key that never leaves your devices. The relay stores them and returns them; a list never includes ct. DELETE /v1/memory/:id erases one row and DELETE /v1/memory erases all of them, immediately, with no soft-delete.

Verify it

List your memory from any client and confirm each row is ciphertext. Erase, list again, and confirm it is gone.

07Threat model: what we can and cannot see

The model runs on hardware SuperFile Inc. owns and operates in the United States. No prompt leaves that hardware. A lawful request reaches metadata and receipts, never a prompt, because prompts do not exist once answered.

08Verify anything