The Blind Machine creates an encrypted computation platform where our servers can never see the raw data.
Mathematically guaranteed.
Already have an account? Sign in
Mission
Enable all population-level science that cannot be done today due to concerns with sharing sensitive data.
Population-scale science is stuck on a problem that isn't scientific — it's legal. The cohort that would answer the question can't pool its data.
How
We use homomorphic encryption. Data is encrypted on the local machine of the data owner. Then we collect all encrypted data and compute directly on the ciphertext — the server only ever touches encrypted data. One decryptable aggregate comes out the other side, and only the researcher, on their own machine, holds the key to decrypt it. Every artifact is content-addressed by SHA-256, so the result re-verifies offline, without us.
$ blind data encrypt cohort.csv Raw → LOCAL ONLY Encoded → LOCAL ONLY Private → LOCAL ONLY Encrypted → UPLOADABLE ─ ─ ─ your machine ─ ─ ─ ─ ─ ─ ─ ─ the network ─ ─ ─ $ blind contribute --project rare-disease-af Encrypted → uploaded · sha256:9f3a…c41e ✔
Values
-
01
Fully obey Kerckhoffs' Principle.
The security of the system never depends on the secrecy of the system. Open CLI, public protocols, offline verifier — the server sits outside the trusted computing base, by design.
-
02
No data leaves the user's computer unencrypted.
Raw, encoded, and private artifacts are LOCAL ONLY. Encrypted is the only class that ever goes up.
Usage
-
01
Create a project.
The researcher creates a project picking the protocol and name — can be done on CLI/desktop or webapp/mobile. The project pins one signed, SHA-256-addressed protocol bundle.
-
02
Contribute encrypted.
Each data owner opens a link, installs blind, and encrypts locally on their own machine. Only ciphertext is uploaded — no account, no plaintext, ever.
-
03
Freeze the cohort.
Once at least 20 encrypted contributions arrive (min-N ≥ 20), the researcher freezes the cohort — a cohort commitment is recorded, runs are capped, and no compute happens before this.
-
04
Compute on ciphertext.
The server runs the pinned protocol directly on encrypted data, in a sealed, network-isolated sandbox. It computes, but it cannot see.
-
05
Decrypt only the aggregate.
The researcher downloads the encrypted result and decrypts it locally with their own key. Only the final aggregate is ever decrypted — never any individual contribution.
-
06
Verify it, offline.
Every run emits a Computation Certificate binding protocol, project, cohort, data, and result hashes. blind certificates verify re-checks every hash with no network and no trust in us.
You don't trust Blind Machine. You verify it.