Free plans are paid for with data.
Ours is not, so ours is not.
Confidential hardware is scarcer than commodity hardware, slower to schedule, and priced accordingly — an attested turn genuinely costs more to serve than an unattested one. And there is no second revenue line here: no advertising, no training corpus, no data partnerships. The subscription is the entire business model, which is exactly why it has to cover the whole cost.
Ember
For one person with things worth protecting.
billed monthly, cancel any time
- 1,500 attested turns a month
- Unlimited local vault
- The whole desktop app — nothing held back for a higher tier
- Encrypted vault: unlimited conversations, documents and notes
- Every burn mode, every one of them signed
- Attested inference on the Fast and Thinking tiers
- On-device meeting transcription and dictation
- Zero-knowledge sync across your own devices
- Receipt verification, on-device and on the web
Wildfire
For the person whose work is the sensitive part.
billed monthly, cancel any time
- 6,000 attested turns a month
- 40 agent-hours a month
- Everything in Ember
- Cowork — the autonomous agent, with parallel sub-agents
- Priority enclave capacity when the hardware is contended
- Cockpit dashboards, scheduled runs and live widgets
- Skill Forge — research, draft, evaluate, publish your own skills
- Deliverables: reports with charts, spreadsheets, decks
- Insurance file with conditional release
Scorched Earth
For newsrooms, clinics and chambers.
billed monthly, cancel any time · 5 seats minimum
- Pooled allowance across seats
- Volume beyond that, invoiced
- Everything in Wildfire, for every seat
- Your own relay — we help you run it, or run a dedicated one for you
- Group threads, shared spaces and dead-drop addresses
- Support for verifying the reproducible relay build yourself
- Invoiced, not card-charged
- No SSO. Deliberately — see the FAQ
Prices in USD, excluding any tax your jurisdiction adds. Fourteen days to change your mind, no questions and no exit interview. Cancel from inside the app — your vault stays readable offline forever; only attested inference stops. More in the FAQ.
Safety is not an upsell.
Anti-coercion features exist for the worst day someone has. Putting one behind an upgrade prompt would mean the person being made to unlock their laptop is the person who did not pay enough — so all of them ship at every tier, and always will.
The absent features.
Ordinarily this list lives in a competitor’s privacy policy, in six-point type, under a heading nobody reads. Here it is at the same size as everything else.
- A retention policy with an asterisk in it
- A “we may share with trusted partners” clause
- An account tied to your phone number
- A model that quietly got better at being you
- Advertising. Obviously — but it is worth saying out loud, given the year
- A recovery link that also works for anyone holding a warrant
Yes, it is more than $20.
A twenty-dollar subscription buys inference subsidised by something. Sometimes the something is venture capital; sometimes it is you. This buys inference on hardware that costs more, and nothing else — which is why the number is the number.
Metered honestly.
An attested turn is one request served inside a verified enclave with a signed envelope returned. When capacity is contended you will see a queued note rather than a silent stall — the app tells you it is waiting instead of pretending it is thinking.
Two doors.
Buy a plan, or take an invite from someone already inside. Invites are unlimited and registered nowhere — counting them would mean our relay learning who invited whom, and a social graph is precisely the artefact this product exists to not have.
Read what we can't prove first.
It is the shortest route to working out whether this is the product you want. We would rather lose the sale to a clear-eyed no than win it on a sentence we had to shade.