Karui encrypts every message in your browser and runs the model in a verified hardware enclave. Our servers only ever see ciphertext.
Phala enclave
You see
Ask anything, privately…
Leaves your browser
POST /api/phala/v1/chat
…
enclave.attestation
…
← stream (encrypted)
…
Inference runs inside
How it works
Three steps run on every message, and none of them asks you to trust us.
message
Your key is locked with your password and never leaves your device. Every message is sealed with AES-256-GCM before a single byte goes out.
Before sending, your browser checks hardware attestation for NEAR AI's gateway and model, or Phala's gateway. Phala checks onward hosts, including Tinfoil for Light and Heavy. If browser verification fails, nothing is sent.
role user
encrypted_content AmZ1x9…Q7k=
key not on this server
Our servers relay encrypted traffic and store encrypted history. We hold no key to read it.
What we can see
Most AI chats store your conversations as plain text. Here is the same message at rest.
SELECT * FROM messages1 row
Readable by staff, subpoenas, breaches and training pipelines.
SELECT * FROM messages1 row
We know whose account it is. Only you can read what it says.
Features
Memory, projects, documents and search, all working on encrypted data.
Money
Work
Home
enclave picked 2 of 6 files for this message · index never leaves encrypted
Karui remembers what matters, in categories and files instead of one long note. A model inside the enclave picks what to read, so the server never sees an index.
Group chats with their own instructions and shared memory, encrypted like everything else.
Lisbon trip plan
Ask for a report, a note or a page and get a standalone document in Markdown or HTML, with numbered versions. Export it as HTML or PDF, or to Google Docs once you connect Google.
Only the search query and the address of a page Karui reads leave your browser. Your conversation stays sealed, and answers that use the web end with a list of sources.
Powered by Brave Search
DeepSeek V4.1 Flash · fast · fallback ready
Light for quick questions, Heavy for deep work. Your message only goes to the provider that runs it.
Connect your own tools through the Model Context Protocol. Your browser reaches them directly where the service allows it, and otherwise through our server, which holds each call in memory for one request and stores nothing. Actions that change something wait for your OK.
how should Karui answer?
Be concise. Metric units.
Answer in Polish unless I write in English.
Set your tone, length, language and format once. Stored encrypted, applied everywhere.
On the roadmap
Every new feature ships under the same rule: if it can't work on encrypted data, it doesn't ship.
Models
Open-weight models, served from hardware enclaves by independent providers. Pick the model for each chat. In Settings you choose which provider runs memory and summaries.
Every message is encrypted in your browser. At Phala it reaches an Intel TDX enclave that runs the model, at NEAR AI a TDX enclave on NVIDIA GPUs. Phala can also pass a message on to Tinfoil's enclaves. Every enclave is verified before it sees your message.
Pricing
Both plans get the same encryption and the same guarantees. Pro gives you the newest features and more usage.
To try Karui and ask the occasional question.
€forever
30,000 tokens a day, roughly 5 messages
For everyday use.
€per month + VAT
800,000 tokens per 5 hours, up to 3.2 million a week, by model cost
No. Your chats, memory and notes are encrypted in your browser with a key only your password or recovery phrase unlocks. Our servers store ciphertext and never get the key.
ChatGPT keeps your conversations on OpenAI's servers in a form OpenAI can read. Karui encrypts them in your browser and stores only ciphertext. Messages are processed inside hardware enclaves; the Models section and security page explain which checks happen in your browser and which happen at the provider. You get memory, projects and web search like in ChatGPT, but the models are open-weight ones (DeepSeek and GLM) from independent providers, not OpenAI's.
An isolated part of a processor where code runs out of reach of the rest of the machine, including the cloud operator.
A report signed by the hardware about what runs inside the enclave. Your browser checks it before using the enclave's encryption key: NEAR AI's gateway and model, or Phala's gateway. Phala checks onward hosts, including Tinfoil for Light and Heavy. The browser check proves genuine Intel TDX hardware, but doesn't yet pin the provider's code release.
The model writes a short query, and only that query goes to the search provider. When it reads a page, only the page's address goes out: our server fetches the page, so the site sees us, not you. Your conversation stays encrypted.
By what the model costs us. Every model has its own price for input (the conversation it reads), output (the answer it writes) and cache (the part of the conversation it has already read), and we count each at that price. On Light, an output token counts as about three tokens, an input token as one and a half and a cached token as a third of one. On Heavy, an output token counts as about nine, an input token as three and a cached token as half of one, so the same allowance runs out sooner on Heavy.
Use your 12-word recovery phrase to set a new password and keep everything. Without it, your old chats can't be recovered, not even by us.
You see an error and your message goes nowhere else. Karui never switches providers on its own. On Pro, you can start a new chat with a model that runs elsewhere.
Yes. Turn it on in Settings with any authenticator app.