⬡

THREAT MODEL.

subrosa · v0 · closed beta · 2026-08-30

How to read this document. Every claim here is scoped to what is running right now. Anything not yet true is marked PLANNED and stays marked until it ships. We would rather publish an unflattering fact than an aspirational one: a privacy service that overclaims once is done. When this document and our marketing disagree, this document wins.

01WHAT SUBROSA IS TODAY

Subrosa will be private GPU rendering for ComfyUI creators. During closed beta, what exists is the account layer: numbered accounts, credentials, a prepaid credit ledger, and invite codes. No rendering jobs flow yet. This document will grow a full execution section when they do — see §07 for the architecture we are building and its honest limits.

02WHAT WE STORE

The complete list. There are no other tables.

Data	Contents	Why
Account record	Random account number, created-at, active/frozen flag	The account is the number
Credentials	Your public keys only: Ed25519 master public key; passkey credential id + public key + signature counter	Verifying that it's you
Ledger	Append-only credit entries: kind, amount, timestamp, reference, note	Your balance is its sum
Optional contact	One nullable field you can set and clear yourself; empty unless you add it	Balance-low notices, if you want them
API tokens	SHA-256 hashes of extension tokens you mint (never the tokens)	Headless client auth
Invite codes	SHA-256 hashes, batch label, used flag	Beta gating without identity
Admin audit log	Every action our operators take: who, what, when	We watch us, so you can

03WHAT WE DO NOT STORE

No names, emails, or phone numbers. The schema has no columns for them. Sign-up asks for an invite code and a public key; nothing else exists to leak. (The one exception is the contact field you may set in §02.)
No IP addresses. We write no request logs and run no analytics or telemetry of any kind. Our infrastructure provider observes connections in transit — that is §05, and it is different from us keeping them.
No recovery codes or private keys, ever. Your recovery code is generated in your browser and never transmitted. We could not reset or recover your account if you begged us. This is a feature with a sharp edge: lose the code and every passkey, and the account is gone.
No authenticator fingerprints. Passkey registration requests attestation: "none" — we decline to learn your security key's make and model.

04KEYS AND SIGN-IN

The recovery code is the root. It derives an Ed25519 keypair client-side; the server stores the public half and verifies signatures.
Passkeys are everyday convenience. Held in your device's secure hardware. Know the trade-off: a platform passkey may sync through your Apple or Google account (end-to-end encrypted, but that fabric is their account system); a hardware security key never leaves the key. We support both and choose neither for you.
Sessions are short-lived signed tokens (hours). Extension tokens are revocable bearer secrets shown to you exactly once.

05WHAT OUR INFRASTRUCTURE PROVIDER SEES

The control plane runs on Cloudflare (Workers, Durable Objects, D1, R2). We chose a large provider deliberately — availability and DDoS survival are also security properties — and we name the cost precisely:

Cloudflare terminates TLS and can observe connection metadata: your IP address, timing, and request sizes — and, at the account layer today, request contents as they transit its edge, as with any Workers-hosted application.
Cloudflare is a US company; legal process against it is outside our control and could yield metadata we ourselves never retain.
Mitigations: accounts are numbers, so edge metadata joins to no identity held by us; use a VPN if IP privacy matters to you — this service is designed to work fine behind one; job content will be end-to-end encrypted before rendering launches (§07), which is what makes the edge a router rather than a reader where it matters most.

06LEGAL PROCESS

Subrosa is operated from Canada; formal entity details will be published before public launch. Served with valid legal process, we can produce what §02 lists: a numbered account's balance history, credential public keys, token hashes, and the optional contact field if you set one. We cannot produce names, browsing history, IPs, or content, because they were never collected. We will contest overbroad demands, and we designed the system so the truthful answer to most demands is that the data does not exist.

07PLANNED — PRIVATE EXECUTION

Nothing in this section is running yet. It is the architecture under construction, published now so you can hold us to it — and so the limits are on record before the marketing exists.

End-to-end encrypted jobs. Workflow inputs, prompts, and outputs encrypted under keys generated on your machine; the relay routes ciphertext it cannot read. Until the envelope layer ships, beta rendering traffic will be TLS-protected but relay-readable — and this document will say so in plain words for as long as that is true.
Sealed personal weights. Your LoRAs and finetunes encrypted client-side, decrypted only inside the executing worker process, memory-only, never written to disk on our side.
The honest limit: jobs run on rented GPUs. The operator of a rented machine could technically observe a running worker's memory. Open-source workers and audits shrink that trust gap; only attested confidential-GPU execution closes it, and we will sell that as a distinct thing when the hardware economics permit — never imply it before.
No job history. Billing will keep GPU-seconds and a balance. Not prompts, not outputs, not workflow graphs.

08THE FLOOR

Subrosa is content-neutral about lawful work and architecturally unable to inspect it. Two categories are prohibited absolutely and enforced at the account and catalogue layer: CSAM and non-consensual intimate imagery of real people, including sexual deepfakes. A no-inspection service still has a spine: accounts violating the floor are terminated, prepaid balances and all, and we cooperate with lawful process as §06 describes.

09RETENTION

Data	Lifetime
Auth challenges	10 minutes
Portal sessions	4 hours
Ledger & account record	Life of the account (it is your balance)
Invite hashes	Deleted at public launch, with this line updated
Request logs / analytics	Never existed
Job content	N/A today; designed never to be stored (§07)

10VERIFICATION

The ComfyUI extension and GPU worker are being built in the open on a shared open-source core. The control plane is small and private during beta; what of it becomes public is a pre-launch decision we will make in writing. Independent audit of the no-retention claims is a launch commitment, not a beta one — until then, this document is the contract and your skepticism is appropriate.

subrosa threat model v0 · 2026-08-30 · changes are dated and kept honest
⬡ sub rosa: under the rose