001
Hardware-sealed inference
Your prompt is decrypted only inside a secure hardware enclave. The node operator, the host OS, even Enclave itself — nobody can read it. It's not that we won't. We can't.
Closed beta — live on Base
[ENCLAVE]
scroll ↓
see it run
A conversation that leaves no trace.
Prompt sealed in your browser, run inside a hardware enclave, answered — and forgotten. Nothing is stored, because nothing can be.
[ENCLAVE] chat
TEE session
llama-4-70b
12.40 USDC · -30%
Ask anything. Nobody will know.
browser client · no history exists
No account/
No logs/
No permission/
Pay per query/
Hardware-enforced privacy/
Verifiable on-chain/
No account/
No logs/
No permission/
Pay per query/
Hardware-enforced privacy/
Verifiable on-chain/
what is enclave
An AI you can talk to.
That no one can listen to.
Enclave is private access to open-weight language models, executed inside hardware-secured enclaves (TEE), paid per query in crypto. No email. No credit card. No conversation history stored anywhere — not by us, not by anyone. Privacy isn't our policy. It's our architecture.
◧
◨
002
Pay per query, in crypto
One wallet signature covers a budget of queries. Stablecoin pricing, discount when paying in $ENCLAVE. No subscription, no account, no identity attached to your usage.
◩
003
Proof, not promises
Every inference produces a cryptographic attestation posted on-chain — verifiable proof the computation ran inside a certified enclave. Trust the math, not the marketing.
◪
004
Governed by holders
Every existing AI platform decides its content policy behind closed doors. Enclave's moderation baseline is voted on-chain by $ENCLAVE holders. Transparent, contestable, yours.
how it works
Three layers. Zero trust required.
L-01
Client — local encryption
Your prompt is encrypted in your browser before anything leaves it. The session key derives from your wallet signature (EIP-712) and never exists anywhere else. One signature approves a budget of N queries — no popup hell, no gas hell.
L-02
Inference — trusted execution environment
Computation runs inside hardware enclaves (Intel TDX + AMD SEV-SNP, multi-vendor by design). Decryption happens only inside the enclave, isolated from the host. Each run posts an on-chain attestation with the firmware hash — a node running a known-vulnerable version gets slashed automatically.
L-03
Payment — native micropayments
Settlement per query via HTTP 402 micropayments on Base. Priced in stablecoin for predictability, -30% when paid in $ENCLAVE. Routing metadata is covered by lightweight ZK proofs, so even network-level correlation fails.
the token
$ENCLAVE
Not a payment gimmick. The token is the access key, the collateral, and the vote — the structural asset of the protocol.
[→]
Priority access
Holders and stakers skip the beta waitlist. Utility on day one, not a roadmap promise.
[▤]
Node collateral — phase 2
Running an inference node requires staked $ENCLAVE, slashable on failed attestation or verified misbehavior.
[%]
Payment discount
-30% on every query when paying in $ENCLAVE. Power users and autonomous agents have a rational reason to hold.
[✓]
Governance
Vote on the model's moderation baseline, treasury spending, and economic parameters. 20% of every fee is bought back and burned.
Supply — 0
Fair launch / LP25%
Phase 2 node reserve 🔒30%
Protocol treasury20%
Team — 12m cliff / 24m linear10%
Privacy community airdrop10%
Buffer5%
The 30% node reserve is contract-locked and cannot be minted until the decentralized network exists — enforced by a coded revenue threshold, not a team decision. Verifiable on-chain by anyone.
roadmap
Honest scope. Coded triggers.
Enclave doesn't claim to be a decentralized network on day one. Phase 1 runs on rented TEE infrastructure — real, verifiable, and clearly labeled. Phase 2 unlocks when the protocol earns it.
Phase 1 — live
The private relay
- Closed beta on rented TEE (Intel TDX + AMD SEV-SNP)
- On-chain waitlist — wallet signatures, publicly auditable
- Per-query attestation, verifiable in the UI
- $ENCLAVE fair launch on Base + Aerodrome LP
- HTTP 402 micropayments + session keys
- First governance vote — the moderation baseline
Phase 2 — locked
The permissionless network
- Node registration open — staked, slashable
- NVIDIA Confidential Computing (H100) support
- ZK-protected routing at network scale
- Community fine-tunes — voted, rewarded by usage
- Multi-region node distribution
Phase 2 trigger — coded, not discretionary: protocol revenue ≥ 15,000 USDC/month sustained for 3 consecutive months, plus a governance vote at 10% quorum. Then and only then does the first tranche of the node reserve unlock. The contract enforces it. We couldn't cheat it if we wanted to.
request access
The beta is closed.
The list is open.
Access opens in waves. We ask for a wallet, not an identity — the waitlist itself is on-chain. $ENCLAVE stakers skip the queue.
Requests in queue: 0 — accepted so far: 412