What Maple can't see
Your prompts and responses. They are encrypted on your device and decrypted only inside the enclave, so no one at Maple can read them.
Maple cannot see your chats.
Your messages are decrypted only inside a hardware-isolated enclave, and you can check that yourself.
A faint outline of a phone connected by a dotted line to a server with a sealed room inside it. Below, a fingerprint with a check mark beside it. The Maple wordmark is at the top left.
How you can check
Before sending anything, Maple's app asks the enclave for a signed fingerprint of its software and compares it with values Maple approved. You can run that same check in your browser.
What the proof rests on
With most AI services you rely on a company's policy and everyone who has access. Here it comes down to four things, and we name them.
- Amazon's Nitro hardware Signs the proof. Amazon publishes the certificate, so anyone can check the signature.
- The published code Open source. Anyone can read the code Maple publishes for the enclave.
- Maple's signing key Every approved release is signed and listed publicly. Rebuild the image to check it yourself.
- The model's enclave Also attested. Maple's enclave verifies it before any prompt is forwarded, and that step is part of the code you can check.
Frequently Asked Questions
Can anyone at Maple read my chats?
No. Your chats are decrypted only inside the enclave, and no one at Maple can see inside it. A secure enclave is a hardware-isolated part of a server that the people who run the server cannot look inside, and an attestation is a signed document stating exactly which software is running there. Maple’s enclave is an AWS Nitro Enclave running open-source code. Your chat history is stored encrypted, and you can delete your account and your chats.
What does the check not prove?
The model runs in its own attested enclave. Maple’s enclave verifies that enclave before forwarding a prompt, and the code that does this is part of the image you check. It works like certificate chains on the web: you check Maple’s enclave, and Maple’s enclave checks the model’s. You do not attest the model’s enclave directly. A fingerprint match means Maple approved that software, not that it was built from the public source. Rebuilding the image ties the two together: the repository documents the Nix command that rebuilds the image and prints its PCR values, so you can compare them yourself. In a browser, the code that runs the check is served by Maple each time the page loads. If that matters for your work, use the desktop app or build Maple Proxy from source.
Does the check run for my own chats?
Yes. Before Maple’s app sends anything, it asks the enclave for an attestation document and checks four things: a fresh random nonce came back inside the document; the certificate chain ends at Amazon’s published Nitro root certificate; the signature over the document is valid; and the fingerprint of the enclave image, called PCR0, is one Maple approved. The app compares PCR0 with a short list built into the app and with a public, signed history file in Maple’s GitHub repository. If any check fails, no encrypted session is created and nothing is sent. The app runs this check at the start of every session. The check on this site makes its own request, so you can watch it happen. The check loads Maple's signed history from GitHub and verifies the matching entry's signature in your browser. A fingerprint already in the list built into this page skips that step.
Has Maple been audited?
Not yet. Maple is working toward a SOC 2 audit. The code and the attestation are public, so you can start checking before an audit exists. Questions about the architecture or the deployment: [email protected].
Check it, then use it.
