Free · open source · no accounts, no backend, no subscription.
A desktop app that turns your files — notes, journals, PDFs, exports — into structured, traceable insight. No backend, no accounts, no telemetry.
Run it locally, or bring your own API key for a third-party, hardware-attested enclave. Either way, your machine verifies what's running before a byte leaves it — you don't trust the privacy story, you check it.
Local is free and offline. TEE uses your own API key — we never see it, and we never bill you.
Local inference is the cleanest privacy posture, but your laptop can't run a frontier model at speed. Hosted inference can — at the cost of handing your prompts to an operator who could read, log, or train on them.
TEE inference is the bridge. The model runs in a hardware-isolated enclave (AMD-SEV-SNP or Intel TDX) the chip keeps sealed from the cloud operator. Every call returns a cryptographic attestation that is verified before data is sent — so the privacy guarantee is rooted in silicon, not reputation.
And it isn't chat-on-top-of-embeddings. BaseVault builds a typed DAG of facts, patterns, and insights, each ref'd back to the byte its quote came from — so it scales past any single context window, and you read your data's structure instead of querying it.
Pipeline runs on the left. The run's vault — inputs, facts, entities, patterns, insights, actions — in the middle. The markdown render on the right, with provenance trees that chain every claim back to the byte where its source quote lives. The "Attested" indicator at the top right verifies the TEE chain before any prompt leaves the machine.
Whitelisted formats: txt, markdown, PDF, docx, json, zip, images. Zips are recursively extracted. Images are transcribed via a vision model that matches the pipeline mode — they never cross trust boundaries.
Per-document metadata + per-chunk extraction into typed items (fact, decision, event, emotion, signal, open-loop). Each evidence span carries absolute byte offsets back into the original file.
Mentions across facts are grouped by normalized name and type; a tiered resolver picks a single subject per run. Bundle inputs scrub the subject and synthesize per-file narrators so cross-file contexts don't collapse.
Within-theme patterns (mechanistic, with source facts), cross-domain insights (with source patterns), actionable recommendations with a harm-gate filter. Every layer carries refs back to the previous one. A walker traverses the DAG on demand.
A prompt-hash cache makes the same input + model produce the same output bit-for-bit. Golden-hash regression tests fail at CI time if anyone slips non-determinism in. Pipeline changes are measured against held-out evaluation cases before they ship.
Detects the latest checkpoint and re-runs only what's missing. Pause / cancel / resume map to subprocess control. Local + TEE can run side-by-side for latency and quality comparison.
Staying local costs more than speed — it caps the model class you can run, and with it the structure that model can extract. Same corpus, same pipeline, run twice: local Ollama vs a TEE-attested frontier model.
Same code ran both times — TEE didn't improve the pipeline, it just gave it a frontier-class model without giving up privacy. The delta you'd otherwise forfeit by ruling hosted inference too risky: 99% of items dated vs 42%, 50% more patterns, no overconfident claims, half as much landing in "other" — and ~16x faster.
Inference runs in Ollama on your machine. Nothing leaves your laptop. Trust surface is your hardware, your OS, the open-source inference binary, the published model weights, and the bundled Python pipeline.
Inference runs in a Tinfoil-hosted hardware enclave (AMD-SEV-SNP or Intel TDX). The chip enforces that the compute stays sealed even from the cloud operator. Every call returns a cryptographic attestation that is verified before data is sent.
tinfoilsh/confidential-<model>
repository.
Every verification — including raw quote bytes, the Sigstore bundle,
and the Rekor inclusion proof — is logged to
~/.basevault/attestations.jsonl.
You can grep it, audit it, and pipe it into other tools. The app also
renders an exact gh attestation verify
command per call so you can independently re-verify against
GitHub's CLI.
Tinfoil is the provider today. Others will be added only as each clears a strict audit: attestation API surface, per-model manifest discipline, public build provenance, and SDK enforcement that refuses inference unless the chain verifies.
Read the full walk-through → — worked example with byte values, copy-paste verify recipes, and the in-app trust panel.
Attestation and transparency logs give auditability, not a unilateral guarantee of safety. Every measurement chains to a specific public commit in Sigstore's append-only log — anyone can fetch that source, diff it against prior releases, and judge it.
What still rests on trust is that the provider ships only code it's willing to defend in public — a narrower ask than "trust us not to read your data," and one that shrinks as reproducible builds mature.
The chain above covers the enclave, where you have no local access.
The .dmg is simpler — you
have the bytes. Hash your download and match it to the SHA-256 on this
page; the
source is public,
so you can read exactly what you're running instead of taking our word.
Beyond that you're trusting Apple Developer ID + notarization + this page's SHA — the same posture as any signed, notarized macOS app.
Personal data should stay where the person can see it. Most software does the opposite: your files feed someone else's cloud. BaseVault flips that — your machine is the engine, and the cloud, when used, has to prove what it's running before it gets your data.
When work has to leave your machine, proof should replace reputation. Not "trust us, we're a good company," but show me evidence I can verify without trusting you. Attestation, transparency logs, and reproducible builds are that evidence.
And every claim the model makes traces back to its source — insights to patterns, patterns to facts, facts to the byte their quote came from. No orphan synthesis: if it doesn't chain back to evidence, the pipeline doesn't emit it. That's enforced in the data model, and the code that touches your data is open source.
Latest signed and notarized build. Apple Developer ID verified by Gatekeeper on launch.
Release history → — what changed in each version.
# Before mounting:
shasum -a 256 BaseVault.dmg
# After mounting (double-click the .dmg first):
spctl -a -t exec -vv /Volumes/BaseVault/BaseVault.app
codesign -dv --verbose=4 /Volumes/BaseVault/BaseVault.app
The first command should match the SHA-256 above. The second should
report accepted, source=Notarized Developer ID.
The third shows the signing identity — verify the team identifier
matches GB5PZY2Q63.
Questions, feedback, or a security report: security@basevault.ai (disclosure details in security.txt). Source and issues: github.com/basevault-ai/basevault.