Choose who can read your text.

Claims and limits

What this protects — and what it does not

• The Simple Unmark web backend receives counts, timings, token use, cost, status, and credit activity — not submitted text or cleaned output — in Confidential mode.
• A digest allowlist makes the browser reject an unapproved workload image. Open-source code and a signed GitHub build attestation let reviewers confirm which commit produced that digest, but attestation alone does not prove source code quality.
• The workload's request key is created in memory, used once, and not retained after the request completes. It is never written to disk and cannot be recovered from the container image.
• HTTPS terminates on Google's load balancer, outside the protected workload. Confidential mode is safe because the payload is separately encrypted to the workload's own key, so the load balancer sees ciphertext in both directions — the transport itself does not reach inside the TEE. In Private mode, that same load-balancer path handles plaintext.
• The website operator still controls the JavaScript delivered to the browser. An independently distributed verifier would be needed to remove that operator from the frontend trust boundary.
• Traffic endpoints, timing, and ciphertext sizes remain observable. Vulnerable approved code can still expose content.
• Confidential AI is coming soon. Choosing it in the cleaner records a content-free interest signal; it does not change your active cleaning mode, upload text, or spend credits.