The internet was built for users and applications. The next generation needs a runtime where people, apps, and autonomous AI agents work together safely — under explicit permissions. Build your app as a static website with a verifiable privacy policy; Witbitz provides the identity, permissions, agents, storage, payments, and secure execution underneath.
Because the app talks only to Witbitz, its entire data footprint is declared — which is what makes its privacy verifiable.
Everything happens in a Space — a self-authenticated room that carries its own identity, members, and permissions. Around it, Witbitz is three layers.
How humans and AI meet. Today Witbitz supports live calls and async spaces — with more modes to come.
A general-purpose app backend: all of your app's flow, plus the AI that runs inside the app. It provides the runtime services every collaborative app needs.
A static page with no backend of its own, connecting only to Witbitz. Not "no backend" — Witbitz is the backend (layer 2); you trade an arbitrary per-app server for one constrained, inspectable platform. One auditable trust surface is what makes privacy verifiable.
Two guarantees make collaboration safe, and they sit at different stages — so we lead with the one that's done. First: no agent action runs without a human's approval, enforced in the runtime and unit-tested — an enterprise can build on it now. Second: privacy you can verify — the gate, the egress, the sealed store, and a reproducible build are checkable today, with only the in-use tier still trusted.
Agents never own authority — they receive it. An agent proposes an action, the runtime evaluates policy, an authorized human approves or edits, and only then does it execute. The no-run-without-approval rule lives in the runtime, not the model, and is unit-tested against both deny and double-run; approval routes through the same tool executor a live call uses, and the audit trail is sealed to the room key like the ledger itself. Authority is explicit, limited, revocable, and recorded at every step — nothing here is roadmap, and it's the one guarantee a buyer can act on today. How it works →
Apps are static, signed, egress-locked pages with no backend of their own — nothing to quietly do something else with your data. Witbitz is the backend, but it's a single constrained platform you can audit, not an arbitrary per-app server. You consolidate the trust surface to one inspectable thing; you don't remove it.
Witbitz derives and signs the app's true data footprint from ground truth — a pinned,
reproducible build plus a locked egress allowlist, published at /cert.json
and rebuildable to the hash AWS runs. Shipped and checkable today (seven
tests) — and the render is open:
read the ~600 lines that touch your
plaintext. The one rung left is unobservable-in-use — the attested tier.
State is sealed as ciphertext; the platform holds no key, and there is no operator recovery key. At rest, neither Witbitz nor the app's own owner can read it. Plaintext opens in one place — the certified render — which runs on the AI's turn and on every changed read. Closing that one door is the attested tier.
The first app built on Witbitz is Spaces: a shared room where you and other people work with an AI together. Not a private one-on-one with a bot — many humans and an AI in one space, with tools that render as live widgets and a room that persists.
The demo runs the whole thing in your browser — a shared room, an AI that searches and builds live widgets, turns that persist. No install, no account.
Everything a device-side “trusted runtime” was meant to add — notifications, durable keys, local decryption — an installed web app now does, on the same reproducibly-built, egress-locked page you can verify. No download, no app store, nothing to trust that you can't check.
Add a Space to your home screen and it reaches you with a content-free push — the device decrypts locally; the server learns only that something happened.
A hardware-backed passkey (synced by your provider) holds the secret, with an encrypted recovery you control — lose a link, still get back in.
The page decrypts in your own tab today; Sealed Spaces is the path to the key never reaching the server at all.
Still on the roadmap: an optional native Companion — more reliable background notifications and a Secure-Enclave keystore, for people who want it. A convenience, not a requirement. Read the design →
Spaces connect in different shapes — one room, two sides, a hub, a crowd, a traveling agent. The valuable apps are the ones where the shape itself is the point.
Many humans and an AI in one shared room — the multiplayer ChatGPT above.
An AI with tools into the company's systems, talking under company governance — designed so the org can't read individual sessions at rest.
A professional and an AI both serve the client in a shared room — and strategize or evaluate in a private back room.
Each side keeps a private room with its own data and agent, then meets in a shared room, revealing only what's approved.
One subject's Space that several orgs connect into, each keeping its own data, the person owning the through-line.
A personal Space + agent that knows you and joins other interactions with scoped, revocable permissions.
Everything is JSON in, JSON out, over HTTPS, tenant-keyed. The contract is open and machine-readable; access is invite-only during private beta.
| Endpoint | What it does | Auth |
|---|---|---|
| GET /catalog | The public agent catalog | publishable |
| POST /collections | Create a collection — items, curation, artifacts, a keyless render page | secret |
| POST /sessions | Launch (or re-summon) an agent — metered, idempotent | secret |
| POST /wallets/grant | Fund an agent session from a wallet | secret |
| GET /collections/{id}/render | Keyless share page for published content | public |
Access. Invite-only during private beta — a server-side secret key and a browser-safe publishable key, plus per-collection capability tokens. Email [email protected]. · Connecting Spaces across organizations is an early Bridge protocol → preview.