This is the technical version. It names the hardware and the protocols, and says what each part of the system can and cannot see. The design itself is not redacted. Only your messages are.
You message Mum in Signal. Signal encrypts the message on your phone before it goes anywhere.
Mum’s Signal account runs inside its own sealed computer. Its identity key is created inside and never leaves sealed hardware, so Signal’s end-to-end encryption ends inside hardware we cannot read.
Before the line hands anything on, it and your Mum verify each other’s hardware attestation. The message then crosses our relay encrypted to your Mum’s key. The relay learns which Mum it is for and when it arrived, and deletes that within minutes of delivery.
Each person’s Mum runs in its own confidential computer, holding their memory, tasks and keys. The processor encrypts its memory with a key that never leaves the chip. Nobody can log in, open a shell or read its logs, including us. There are none.
The open-weight model that writes Mum’s replies runs inside a secure enclave on the GPU. Your Mum verifies the enclave’s attestation before it sends anything, so nobody outside the enclave can read along.
The reply takes the same route in reverse: encrypted to Mum’s Signal line across the relay, then end to end to your phone.
The chip in a sealed computer can prove exactly which software it is running. This is remote attestation: a signed measurement from the processor itself.
Your key is held in a hardware security module. It is released only to a sealed computer whose attestation matches a version recorded in the public log. Any other software, even one character different, does not get it.
A version that is not in the public log cannot receive anyone’s keys, so nothing changes without a public record.
Each new version gets a fingerprint of exactly what may run inside the sealed computer: the software, its commands and its settings. Change one character and the fingerprint changes.
We sign that fingerprint with a key that never leaves a hardware security module, and add it to a public transparency log built so entries cannot be quietly changed or removed.
A sealed computer gets a key or a message only when its chip’s attestation matches a fingerprint in the log. Anything else stays locked.
At every handover, hardware checks hardware. You do not have to take our word for any of it.
Before Mum’s Signal line hands your Mum anything, the two sealed computers verify each other’s attestation.
Your key leaves its hardware security module only for a sealed computer whose chip proves it is running a version in the public log.
Before your Mum sends anything to the GPU, it verifies the enclave’s attestation and that its software is published.
Signal shows a safety number for your chat with Mum and warns you if it changes. Mum’s Signal key never leaves sealed hardware, so a change you did not expect is worth telling us about at hi@mum.ai.
When Mum researches, compares or books, its visits go out through residential proxies, so they arrive from ordinary home connections in your area. Its browser uses a standard 1920×1080 window, the most common screen size there is.
To a website it is one more ordinary visitor. Every visit is anonymous unless you have asked Mum to sign in as you, and the model that steers the browser is not told who you are.
Nobody can log in to your Mum’s sealed computer, open a shell or read its logs. There are none.
Signal’s encryption ends inside a sealed computer whose key never leaves it, not on servers we can read.
Every new version is recorded in a public log before it can receive anyone’s keys.
Mum’s replies, reading and sorting run inside hardware-sealed enclaves, so nobody outside them sees your conversation.
Mum does not store metadata, so there is no record of who, when or where from.
The link between your Signal account and your Mum stays inside the Signal line’s sealed computer. Our other systems see only a stand-in.