/// VectorBlack
Your AI agent can search it. Nobody else can read it.
VectorBlack lets your AI agent search encrypted files without decrypting them. The files stay encrypted on the server. The questions stay encrypted on the wire. The only key that opens anything stays with you.
See how it works- Your GovCloud accountSDK encrypts · key stays here
- Search serverany GovCloud instance · reads nothing
- Your AI agentClaude on Bedrock · any model
The whole path
Readable on your side. Encrypted on theirs.
The server gets encrypted files and encrypted questions, does its work on them, and sends back encrypted answers. Nothing readable ever crosses the line, and neither does the key.
- READABLE
- ENCRYPTED
- YOUR KEY
SWIPE TO SEE THE HOST SIDE →
Ingest. Your files become search vectors on your machines. Files and vectors both get encrypted with your key and written to the host. Nothing readable ever crosses the wire.
Search. Your AI agent's question leaves your side already encrypted. The server scores every record against it without decrypting a thing and sends the scores back, still encrypted. It never sees the question. It never sees the answer.
Answer. Your side decrypts the scores, fetches the top matches hidden inside a batch of decoys, and opens only those. Your model gets plaintext in exactly one place: yours.
Where we are
A prototype that works. Here's exactly which parts.
Built
The client software that encrypts everything before it leaves your side. The server that searches without ever holding a key. The integrity checks that catch a host that misbehaves. All of it runs in our lab today.
Tested
Million-file searches over encrypted data, on ordinary hardware, returning the same matches as a plaintext search. Every time.
Next
Outside review of the cryptography, networked deployments at larger scale, and a first partner running the prototype on their own files in their own account.
What the host holds
The host stores everything. The host reads nothing.
The host keeps your data in encrypted form, plus special math keys that let it calculate on that data without ever reading it. The one key that opens anything stays with you. VectorBlack is a small piece of software on your side that encrypts and decrypts, and a search server on the host's side that works blind. Your AI agent setup doesn't change.
On the host
- your filesencrypted, unreadable
- your search indexencrypted, unreadable
- math keyscalculate yes, decrypt never
- a map of which server holds what
- basic factshow many files, when you search, which encrypted blocks it served, blurred by decoys
Never on the host
Same data, twice. What you see, and what the host sees.
- your secret keysk_2f91…stays on your machines, always
- your documentsmerger agreement v79f3a c01e 44b7 2d88
- your search index in the clear[0.118, -0.402, 0.077, …]e19c 7b02 5a6d f3e1
- your questions"who signed the side letter?"0c7e 91ab 66d4 b3f0
- the resultstop 10 → doc 4127, 88, 9020c41d 08ef 2a75 d9c3
Design, as built in the prototype
What a security reviewer will ask.
Encryption
CKKS, 128-bit classical
Parameters from OpenFHE's standard 128-bit table. Ciphertext-ciphertext multiplication throughout; the host never holds a plaintext vector.
Lattice basis
Ring-LWE, the family behind ML-KEM and ML-DSA
FIPS 203 and 204, adopted by CNSA 2.0. CKKS itself is on no approved-algorithm list, and we do not claim otherwise.
Transport
TLS 1.3, OpenSSL FIPS Provider 3.1.2 (CMVP #4985)
The server refuses to start unless OpenSSL reports FIPS mode. The build is vendor-affirmed on this platform, not a tested-platform certificate. FIPS covers transport only.
SDKs
Python and Node.js
One key-store format, one index format, written by both SDKs and cross-tested against each other. Runs wherever your agent runs: on-prem, VPC, or workstation.
Tenants and auth
Bearer tokens, mutual TLS
Tokens stored as SHA-256 digests, compared in constant time. Per-tenant contexts and keys; no cross-tenant mixing.
Sharding
Shards behind a router
Each shard serves a block range; the router fans out and merges. The router holds context, keys, and manifest only. Ordinary Linux instances. Sharding is tested on one machine, not yet across a network.
Response integrity
Client-held canaries and a nonce
Catches a host that skips blocks, replays, or corrupts a full response; the 1 MiB sketch carries only the nonce. Threat model: honest-but-curious. A lying host is caught, not prevented.
Document payloads
AES-256-GCM, fetched with decoys
Client-encrypted, document id bound as associated data, so a swapped file fails authentication. Fetches hide the wanted ids inside a padded batch of decoys.
Key store
PBKDF2-HMAC-SHA256, AES-256-GCM
Secret key, placement, and payload key sealed under a passphrase-derived key. A wrong passphrase fails the tag; there is no silent wrong key.
Prior art
SANNS, HERS, HyDia
Packing layouts follow published work. The measured numbers on this page are ours.
Objections
Short questions. Straight answers.
No. The software runs inside your account and encrypts them right where they are, writing the encrypted copy back to S3. From then on, search only ever touches that copy. Keep the readable originals or delete them. Your call.
Next
Be the first agency to run it.
We want one federal partner to put this prototype up against real files, in their own GovCloud account, with keys that never leave their side. Tell us what your AI agent needs to search and which model you run. We'll bring the software and the full test record.
// what crosses the wire, TLS 1.3
- POST /t/agency/searchone encrypted question, plus a nonce
- 200encrypted scores, or a compact encrypted sketch
- POST /t/agency/payloadsthe wanted ids, hidden in a batch of decoys
- 200AES-256-GCM payloads, opened only by your key
GET /t/agency/audit · what the host holds for your tenant: protocol, cipher, FIPS mode, auth mode