Is Your AI Chat Encrypted? ChatGPT, Lumo, and DentroChat
A while back, a DentroChat user reached out to us:
Lumo states it encrypts all the conversations. Is DentroChat doing the same or does it have a different approach?
That question triggered me a bit, because I wrote my bachelor’s thesis on cryptography back in the day, and I wanted to write down my thoughts properly for once. My answer became rather long and technical, so if any of it gets too dense, perhaps it’s best if you paste this article into Lumo or DentroChat and let an AI explain it in simpler terms :-)
To give a proper answer on how encrypted AI chat works, let’s look at how Proton’s encryption works first, then Lumo, then how DentroChat and ChatGPT do it.
How Proton’s zero-knowledge encryption works
We’re big fans of the Proton ecosystem and have been using it actively for years for VPN, emails, video calls, and more.
The big appeal of Proton is its zero-knowledge setup. Public-private key pairs are derived from your account password and are unique per user. This private key is used to encrypt our emails, Drive content, etc. Only the user, us, can decrypt our own data on our local device. Proton employees cannot decrypt our data because they never get access to our private key.
The upside is that even if the NSA is “sitting” inside a Proton server, they won’t be able to get our data (at least as long as all other security assumptions hold). The downside is that if we ever lose our Proton password, backup codes, and have no recovery method set up, Proton won’t be able to restore our data.
If you want to understand how public-private key encryption works from the ground up, this YouTube video on public key cryptography is amazing. When I watched it during my first year of university, it really blew my mind!
Lumo: why an LLM changes the picture
Lumo is inherently different from other Proton services because of the way Large Language Models (LLMs) work. In order to get a response from an AI / LLM model, you need to feed the input into the model in plaintext, meaning decrypted. (There are approaches to doing this in a more encrypted fashion, more on this below.)
If you ran an LLM locally on your own computer, the classic Proton encryption approach above would still work: decrypt the data locally on your machine, feed it into your local LLM, get an answer, and encrypt the data again locally. That is the approach when you run local models with tools like Ollama.
The issue is that the best LLMs need very strong machines to run, which simply isn’t feasible on the average consumer computer. So the LLM has to run on a Proton server, and your data has to be decrypted before it’s fed into the Proton LLM.
What happens when you send Lumo a message
When you use Lumo, it works like this (as documented in Proton’s Lumo security model):
- You decrypt your chat message history locally on your device.
- You add a new user message.
- The whole message history, together with your new message, is encrypted with the public key of the Proton server where the LLM runs.
- Your encrypted data arrives at the Proton server and gets decrypted with their server’s private key. The decrypted data is fed into the LLM, and an answer is generated.
- The generated answer is encrypted again and sent back to you.
- You decrypt it on your device and read the answer.
This is a very solid approach given the constraints.
The only thing is: the approach is not zero-knowledge anymore during inference. If the Swiss police, the NSA, or a rogue Proton employee is listening inside the Proton server where your data is decrypted before being fed into the LLM, they can read your data. Lumo doesn’t use End-to-End Encryption (E2EE) like the other Proton services, but something they termed User-to-Lumo Encryption (U2L). Where Lumo still shines is that your saved chat history is encrypted with your key at rest, so nobody at Proton can read your old conversations later.
How DentroChat does it
We tried to come up with a way to ensure true End-to-End Encryption for DentroChat, and we came up with an architecture that’s very close. But unfortunately, it wasn’t financially feasible for us to build (yet).
Our current approach is the classic encryption used by most modern apps: encryption in transit and encryption at rest:
- When we send you your data, or you send DentroChat your data, this traffic is encrypted in transit using TLS (which uses public-private keys to establish the encrypted connection).
- When your data is stored on our servers in Germany, it is encrypted at rest (which we configure and manage ourselves, since standard hosting providers don’t encrypt disks at rest by default). If an attacker copies the hard disk of our servers, they only get encrypted data.
We chose this approach because, during the moment the AI answers your prompt, it holds the same core trust assumption that Lumo has: the user has to trust us that we don’t read their data while processing it. Our current approach was much simpler to set up, while Proton’s approach is more sophisticated and puts more hurdles in the way of potential attackers for stored chat history. We might also go their way at some point if we see a clear benefit. For now, DentroChat’s approach is secure, solid, and battle-tested over the years by many applications.
How ChatGPT encrypts your conversations (and where the catch is)
On paper, ChatGPT uses the exact same cryptographic building blocks as DentroChat and most cloud software: encryption in transit (TLS) between your browser and OpenAI’s servers, and encryption at rest (AES-256) on their disks. ChatGPT does not use end-to-end encryption either, because OpenAI’s GPUs also need your prompt in plaintext to generate an answer.
The difference with ChatGPT isn’t is who holds the keys and what OpenAI is allowed to do with your data when they decrypt it:
- Model training and human review: On ChatGPT Free and Plus, your decrypted conversations are used to train future OpenAI models by default, and sampled chats can be read by human reviewers unless you manually opt out in your settings. Neither Lumo nor DentroChat ever trains on your chats.
- Retention after deletion: Even if you delete a chat or use ChatGPT’s “Temporary Chat” mode, OpenAI retains a copy on its servers for up to 30 days (we broke down all the details here).
- US CLOUD Act exposure: Because OpenAI holds the decryption keys for your stored chats and is a US company, US authorities can compel access under the US CLOUD Act. Even if your workspace is set to EU data residency!
| ChatGPT | Proton Lumo | DentroChat | |
|---|---|---|---|
| Encrypted in transit (TLS) | Yes | Yes | Yes |
| Encrypted at rest | Yes (OpenAI holds keys) | Yes (Zero-access, you hold keys) | Yes (DentroChat holds keys) |
| End-to-end encrypted during AI inference | No (plaintext on server) | No (plaintext on server, U2L) | No (plaintext on server) |
| Trains AI models on your chats | Yes by default (opt-out) | Never | Never |
| Subject to US CLOUD Act | Yes | No for chats (US for billing/support) | No (100% EU / Swiss stack) |
Two ways to get (almost) true end-to-end encryption for AI
So can you ever run an LLM in the cloud without the server operator seeing your plaintext prompt? There are two approaches for proper E2EE.
1. Homomorphic encryption
Homomorphic encryption is an amazing field of research. It allows you to perform computation directly on top of encrypted data.
For example: you encrypt the number 12, and another user encrypts the number 17. Both encrypted numbers are added together via an encrypted addition computation. The output is the encrypted number 29, and only you and the other user can actually decrypt it and find out the output is 29. The server that did the math never knew the numbers were 12, 17, or 29.
This example is simple, but it can also work for LLMs. In that case, you input encrypted data into the LLM, the LLM outputs an encrypted answer, and only the user can decrypt the answer. There is major academic research happening here, such as this recent paper on encrypted LLM inference (Cachemir).
The problem with homomorphic encryption is that it is computationally very expensive, and therefore very slow. Even with recent speedups, you’re looking at around 100 seconds of GPU time per generated token—meaning you’d have to wait 30 minutes for a simple answer to “What’s the capital of Spain?”
2. NVIDIA H100/H200 Confidential Computing GPUs (TEE)
The second approach is using NVIDIA H100/H200 Confidential Computing GPUs with a Trusted Execution Environment (TEE).
It works like this: the GPU has its own private-public key pair hardcoded directly into its hardware. It is created once when the GPU is manufactured, and once created, the private key cannot be retrieved from the outside, not even by the person who owns the server rack.
This is great, because now you can encrypt your data with the public key of the GPU and send it to the server. The GPU decrypts it inside its own hardware enclave using its private key, feeds it to the LLM running inside the GPU, encrypts the answer again, and sends it back to you.
This way, we get almost true E2EE. The only remaining hardware attack vector is at the manufacturing step: if the NSA recorded all private keys while these NVIDIA GPUs were created in the factory, they would theoretically still be able to intercept and decrypt the traffic later on when the GPU is deployed. However, an NVIDIA GPU with a TEE is a very strong security assumption.
We had two options for DentroChat: buy such GPUs ourselves, or find a European provider that offers them. The former was too expensive for us: a single H100 costs around €40,000, and to run large open-weights models like the ones we have in DentroChat, we’d need 8 of them. As a bootstrapped business, that wasn’t possible at the time. Finding a European provider that uses confidential computing GPUs wasn’t possible half a year ago either. However, this is the most realistic path going forward, and we’re constantly looking for European AI infrastructure providers that support it.
Why we think DentroChat is a strong pick alongside Lumo
Even without zero-access encryption on saved history yet, there are a few reasons why many users pick DentroChat over Lumo:
- Better AI models: Last time we tested Lumo, the response quality we got was rather lackluster and slow. With DentroChat, you get access to the best open-source models and a tailored agent harness under the hood.
- Zero US subprocessors across the entire stack: Both Lumo and DentroChat run their AI inference on European and Swiss servers. However, Lumo still routes billing and customer support through US companies (like Stripe and Zendesk). At DentroChat, we use zero US subprocessors anywhere. You can verify our full stack on our subprocessors page.
If you want to compare the two in more detail, check out our full Lumo alternatives test, our guide to private AI chat, or how European ChatGPT alternatives stack up. And if you ever have a technical question like this one, don’t hesitate to reach out to us via the feedback button in DentroChat!
Frequently asked questions
Is ChatGPT end-to-end encrypted?
No. OpenAI encrypts your conversations in transit (TLS) and at rest on its servers, which is the standard baseline for cloud apps. Because the LLM needs plaintext to generate a reply, OpenAI’s servers decrypt your prompt to process it. Unless you are on a business plan or explicitly opt out, consumer conversations may also be used for model training.
Is Proton Lumo end-to-end encrypted?
Not end-to-end. Lumo uses what Proton calls User-to-Lumo (U2L) encryption: your saved chat history is locked with zero-access encryption so Proton cannot read your old chats, and your prompt is encrypted all the way to the inference server. However, the Proton GPU server still has to decrypt your message in memory to feed it into the LLM.
How does DentroChat encrypt my conversations?
DentroChat encrypts all traffic in transit using TLS and stores your conversations and files with self-managed encryption at rest on European servers in Germany and France. Like Lumo and ChatGPT, prompts must be decrypted in server memory during inference so the AI model can answer them, and we never train on your data.
Can an AI chat ever be truly end-to-end encrypted?
Yes, either by running a small model locally on your own computer, or in the cloud using homomorphic encryption or NVIDIA Confidential Computing GPUs (TEEs). Today, homomorphic encryption is still far too slow for interactive chat, while confidential computing GPUs are the most promising path forward once European hosting providers make them widely available.