Sealed the whole way.
Here’s what happens when you send Mum a message, and who can read it at each step. The answer is always the same: you and your Mum.
You message Mum in Signal. Signal encrypts the message on your phone before it goes anywhere.
Mum’s Signal account lives in its own sealed computer. Its key is created inside and never leaves, so Signal’s encryption ends inside hardware we can’t read, not on our servers.
Your private Mum runs in its own confidential computer, with memory encrypted by the processor itself. We run the machine, but nobody can log in, open a shell or read its logs. There are none.
The model that writes Mum’s replies runs on verified private hardware, so the company hosting it can’t read your conversation either.
Mum’s reply comes back the same way, encrypted end to end.
Every visit Mum makes is anonymized, and its browser uses a standard 1920×1080 window, the most common screen size in the world. To a website, it looks like one more ordinary visitor.
Your keys only open for public code.
Each person’s Mum runs in its own confidential computer, with memory encrypted by the processor itself, using technology from AMD. We operate the hardware, but nobody can log in, open a shell or read its logs. There are none.
The chip also proves exactly which code is running. Your keys are released only to that exact build, the one published for anyone to read. Any other code, even a slightly changed version, doesn’t get them.
One character different is a different build, so the chip keeps the keys locked.
Every change waits a week in public.
Every new version of Mum goes into a public log and waits 7 days before it can touch anyone’s keys. Anyone can read the code, and anyone can see a change coming.
The new version and its code are added to the public log, where anyone can inspect them.
The new version can’t touch anyone’s keys yet. Anyone can read it and see exactly what’s changing.
Only now can it be given keys, and only if the chip confirms it’s the exact build in the log.
Don’t trust us. Check.
You can check that your chat is sealed whenever you like. It takes one message and the open verifier.
- 01Ask Mum for proof
Send “prove it” in your chat with Mum, or “@mum prove it” in a group.
- 02Get a signed file
Mum replies with a file signed by the chip itself, naming the public code that holds your chat’s keys.
- 03Run the open verifier
The verifier checks the chip’s signature and confirms the code matches a build published in the public log.
- 04Watch the safety number
Signal shows a safety number for every chat. If Mum’s key ever changes, the number changes too, and Signal tells you.
What we can’t do.
Nobody can log in to your Mum’s sealed computer, open a shell or read its logs. There are none.
Signal’s encryption ends inside a sealed computer whose key never leaves it, not on our servers.
Every new version waits 7 days in a public log before it can touch anyone’s keys.
The model runs on verified private hardware, so the company hosting it can’t see your conversation.
Mum doesn’t store metadata, so there’s no record of who, when or where from.
Accounts are random numbers with no name or email attached, so we don’t know whose is whose.