---
title: "About The Blind Machine"
description: "What it isThe Blind Machine is governed, content-addressed computation on encrypted data. Data owners encrypt on their own machines. The server computes on ciphertext only. A researcher decrypts a..."
last_updated: 2026-07-09
canonical: "https://blindmachine.org/about"
---

# About The Blind Machine

## What it is

The Blind Machine is governed, content-addressed computation on encrypted data. Data owners encrypt on their own machines. The server computes on ciphertext only. A researcher decrypts a single aggregate. Every artifact is addressed by SHA-256, so the result re-verifies offline, without us.

The machine can compute, but it cannot see.

## Why it exists

Population-scale science is stuck on a problem that isn't scientific — it's legal. Five hospitals each holding forty rare-disease patients won't sign a mutual data-use agreement in under eighteen months, so the per-allele frequency that needs all two hundred never gets computed. The data exists. The math is trivial. The pooling is what's forbidden.

The Blind Machine removes the pooling. Each cohort encrypts locally, the server sums only ciphertext, and one decryptable answer comes out the other side.

## How it works

1. **Encrypt local.** Each data owner runs the open `blind` CLI on their own machine. Raw, encoded, and private artifacts never leave it. Only ciphertext is uploaded.
2. **Compute on ciphertext.** The server runs one pinned, signed application directly on the encrypted contributions, in a network-isolated sandbox. It computes without decrypting.
3. **Decrypt the aggregate.** The researcher decrypts only the final result with their own key. Individual contributions are never decrypted.
4. **Verify offline.** Every run emits a Computation Certificate binding the application, cohort, data, and result hashes. Anyone can recompute those hashes with no network and no trust in us.

## Trust classes

The CLI prints a trust class at every boundary crossing. The web app surfaces the same vocabulary.

- **LOCAL ONLY** — Raw, Encoded, and Private artifacts (your data, your secret key). Never leave the machine.
- **UPLOADABLE** — Encrypted ciphertext. The only class that goes up.
- **SHAREABLE** — Public context, published applications.
- **verified ✔** — a recomputed hash matches.
- **mismatch ✗** — a hash disagrees, or a secret would leak.

## Kerckhoffs, applied to a product

No guarantee rests on the secrecy — or the honesty — of the server. The server sits outside the trusted computing base by design. The CLI is open source and auditable; the closed code is exclusively the hosting layer. We sell the hosting convenience, never the guarantee. If you have to take our word for it, we built it wrong.

## What it does not claim

The threat model is written down and scoped honestly.

- Re-execution proves **determinism**, not zero-knowledge. Same ciphertexts in, same result digest out.
- The server is trusted for **availability**, and **metadata leaks** — who, when, how many contributors, which application.
- v1 uses a **single keyholder**, trusted not to target individuals. Aggregate-only release, cohort-freeze, and a minimum cohort size (≥20 for the demo) mitigate differencing; they do not solve it. A malicious keyholder is a v2 concern (threshold FHE).
- Encrypted is not unregulated. v1 runs on synthetic vectors, not real patient data.

## Contact

Questions or corrections: [support@blindmachine.org](mailto:support@blindmachine.org).