AI2TH/Security

Security,
without snake oil.

Encrypted, license-gated software delivery with an honest threat model, and apps that keep your data on your device.

Apps

cryptship

Software delivery

Ship encrypted, license-gated application code inside Docker images. The image is ciphertext; a small loader runs your app only with a valid license.

  • AES-256-GCM payloads, Ed25519 licenses
  • Air-gapped, on-prem and cloud modes
  • Instant revocation via license server
  • Hardening and per-license watermarks
v0.1.0 · Go · GPLv3
Details → GitHub

How cryptship works

The image on disk is ciphertext. Only a valid license turns it back into your app.

Build time · vendor

Your app
Source or compiled build output
↓
cryptship pack
Random content key; AES-256-GCM into payload.enc
↓
cryptship issue
Ed25519-signed license that wraps the content key
↓
Container image
Loader + payload.enc + license + public key

Run time · customer

Loader starts
Verifies the license signature, expiry and revocation
↓
Key provider
offline · online license server · attested hardware
↓
Decrypt to tmpfs
Wrong license or machine means the AEAD tag fails
↓
exec your app
Runs with the license ID and customer as a watermark

Local-first by design

📵
No tracking
AI2TH apps ship no analytics or crash reporting that sends data off the device
🤖
Offline AI
Miktam Bible’s study assistant runs a local model; conversations stay on the phone
🔌
Loopback by default
Linxr binds port forwards to 127.0.0.1; LAN access is an explicit opt-in
Read the privacy policy