FUEL COMPUTER

Private AI chat,
encrypted by design.

Fuel Computer keeps conversations in your browser and encrypts every prompt before it crosses Fuel Computer infrastructure. Inference defaults to GLM 5.3 Flash, with a curated selection of NEAR AI direct TEE models available per conversation.

Local history

Chats remain in browser storage and can be deleted at any time.

Encrypted relay

The Cloudflare Worker receives ciphertext, adds authentication, and relays it.

TEE inference

NEAR AI serves the selected private model from Intel TDX and NVIDIA confidential hardware.

Is it encrypted from the browser to NEAR and back?

Yes during normal operation. Prompt content is encrypted in the browser to the model’s advertised Ed25519 key, remains ciphertext through the Fuel Computer Worker, is decrypted inside NEAR’s model environment, and the response is encrypted to an ephemeral browser key before returning. The browser alone decrypts the answer. The qualification is authenticity: until full TDX/GPU/TLS attestation verification runs client-side, a compromised app or relay could substitute the advertised model key.

Verification boundary

Encryption interoperability is live. Full Intel TDX, NVIDIA GPU, container-measurement, response-signature, and same-connection TLS-SPKI verification is not yet performed independently inside the browser. Do not treat the current web indicator as a complete hardware attestation verdict.

ARCHITECTURE

What happens to a prompt

Local compositionThe plaintext prompt and prior conversation exist in the browser only.
Fresh model metadataThe client requests NEAR’s GLM 5.3 Flash attestation with a random nonce and checks the returned model name, nonce, and Ed25519 key shape.
Client encryptionEach message is independently encrypted to the model key using a fresh ephemeral key.
Ciphertext relayCloudflare validates the encrypted envelope, rate-limits it, adds the server-held NEAR credential, and forwards ciphertext. Request bodies are not logged.
Confidential inferenceThe NEAR model environment decrypts and processes the request, then encrypts the answer to the browser’s ephemeral client key.
Local decryptionThe browser authenticates and decrypts the response, renders Markdown, and saves it only in local history.

Browser (plaintext) → E2EE ciphertext → Cloudflare relay → NEAR model TEE
Browser (plaintext) ← local decrypt  ← encrypted response ← NEAR model TEE

E2EE V2

Encryption protocol

Fuel Computer implements NEAR AI’s Ed25519 E2EE v2 wire protocol using audited Noble JavaScript primitives.

Key agreement	Ed25519 keys converted to X25519; ephemeral X25519 ECDH per encrypted field
Key derivation	HKDF-SHA256 with `ed25519_encryption` context
Authenticated cipher	XChaCha20-Poly1305 with a random 24-byte nonce
Wire format	`ephemeral_public[32] \|\| nonce[24] \|\| ciphertext+tag`, hex encoded
Client keys	Generated in-browser and retained in memory only

The Worker rejects plaintext message content and malformed E2EE headers with no fallback. Responses use NEAR’s E2EE streaming format: each content delta is independently encrypted, relayed unchanged, decrypted in-browser, and committed to local history only when complete. Encrypted reasoning remains hidden.

NEAR E2EE specification ↗

CONFIDENTIAL COMPUTING

TEE-hosted inference

NEAR AI documents a defense-in-depth environment combining Intel TDX confidential virtual machines and NVIDIA confidential GPUs. TLS is designed to terminate inside the model environment, and inference responses can be cryptographically signed there.

Each available model is pinned to a server-side allowlisted NEAR direct endpoint. GLM 5.3 Flash is the default; DeepSeek V4 Flash is also available after attestation and encrypted-completion interoperability testing. Arbitrary models and endpoint URLs are rejected.

Claims and evidence

TEE privacy is a property to verify, not merely a provider label. NEAR provides Intel quotes, NVIDIA evidence, deployment composition, signing keys, and TLS fingerprints for independent validation.

NEAR private inference architecture ↗

VERIFICATION

Attestation and TLS

A complete verifier must perform every check below and fail closed:

Generate and bind a fresh 32-byte nonce.
Validate the Intel TDX quote with Intel DCAP collateral and accepted TCB status.
Verify report data binds the model signing key, nonce, and TLS fingerprint.
Submit NVIDIA evidence to NRAS and validate its nonce and verdict.
Match the attested compose manifest to mr_config_id and expected pinned images.
Compare the live TLS certificate SPKI from the same connection with the attested fingerprint.
Verify request and response signatures against the attested model key.

Why the browser is not a full verifier yet

Normal browser JavaScript cannot inspect the live TLS peer certificate/SPKI, while NEAR’s reference TDX verification uses native DCAP tooling. Fuel Computer currently retrieves evidence but does not present it as a verified verdict. A native helper, browser extension, or audited browser-compatible verifier is required for strict verification.

TLS attestation guide ↗ Reference verifier ↗

THREAT MODEL

Guarantees and limits

Protected during normal operation

Fuel Computer application databases and analytics do not receive plaintext prompts or completions.
Network and relay infrastructure carry authenticated ciphertext.
Conversation history remains on the user’s device.
Modified ciphertext fails authenticated decryption.

Not yet protected or independently proven

A compromised web origin or relay could substitute an encryption key until client-side quote verification is complete.
Local history is plaintext at rest and inherits the security of the browser profile and device.
Metadata such as timing, payload size, route, and IP-level network information is not hidden by message encryption.
Fuel payments are public blockchain activity and are not anonymous.

See the maintained NEAR AI security plan for rollout gates.

API

Encrypted completions

Base URL: https://api.fuel.computer/v1. The chat route requires NEAR E2EE v2 ciphertext and these headers:

X-Signing-Algo: ed25519
X-Client-Pub-Key: <32-byte Ed25519 public key, hex>
X-Model-Pub-Key: <attested model public key, hex>
X-Encryption-Version: 2

Fetch public model evidence from GET /v1/private/attestation?nonce=<64 hex characters>&model=<allowlisted model id>. Use GET /v1/models for the current private-model allowlist.

Compatibility

Ordinary OpenAI SDKs and the current Pi provider cannot send plaintext to this endpoint. They require an E2EE wrapper that encrypts before transport and decrypts responses locally.

Requests receive a small immediate burst allowance, then refill continuously. A 429 response includes Retry-After.

DATA PRACTICES

Privacy-preserving analytics

Cloudflare Analytics Engine receives operational metadata only: model identifier, broad success/error category, duration, trial/account class, HTTP status, and route. This supports availability and abuse monitoring without conversation surveillance.

Analytics and logs must never contain prompts, completions, ciphertext, wallet addresses, API keys, encryption keys, headers, attestation payloads, or raw error strings. Worker request-body logging is disabled.

FUEL

Payments

Staging can issue Fuel Sepolia invoices using testnet FUEL. Testnet assets have no monetary value. Mainnet payment acceptance remains disabled pending treasury, pricing, finality, and security review.

On-chain payment activity is public. Prepaid service credit is custodial after receipt.

Fuel testnet faucet ↗

Private AI chat,encrypted by design.