Private inference

Private cloud is the default way Mera runs AI. Your phone encrypts the work before it leaves, and it's meant to be decrypted only inside secure hardware run by NEAR AI. Mera's servers pass it along without being able to read it.

Attestation is user-triggered and fails open. Ordinary requests don't check the hardware. The check runs only when you start it, it's partial, and a bad result blocks nothing. Today this path depends on Mera and NEAR AI operating as described.

What gets encrypted

The app encrypts the content of each message, and the reply comes back encrypted to your phone. That covers your facts, chat messages and the text used for ranking and notes.

A few things stay readable to the gateway, because it needs them to route and meter the request: your session token, the model name, token limits and the size of the request. A background request also carries a push token, so the gateway can wake the phone.

NEAR AI's encryption covers message content only, so a standard tool field would travel unencrypted. Mera sends tool use as text inside the encrypted content, and the app refuses to send any request with a tool field in it.

How the encryption works

1. The app fetches the model's attestation report through the gateway. It holds the model's public signing key.
2. The app generates its own key pair. A chat attempt uses a fresh pair held only in memory. A background ranking run keeps one pair in the phone's keychain, so it can read results later.
3. The app encrypts content to the model's key.
4. The secure environment decrypts, runs the model, and encrypts the reply to the app's key.

The algorithm depends on the length of the model's key.

The code is public in lib/e2ee/ in the Mera app repository.

What the gateway does

The gateway checks your session or a short-lived token, applies rate limits, and forwards the request. It doesn't read, log or change message content.

It does hold ciphertext for a short time:

It also counts the bytes of encrypted text sent for each account each day, to apply your plan. See What's stored where.

What attestation is

Attestation is a signed report from secure hardware. It's meant to show that a real secure environment holds the key your data is encrypted to. Without a check, whoever answers the report request could hand the app a key they control.

What happens on ordinary requests

Ordinary requests don't run the check. The app takes the key from the report and encrypts to it. Reports are cached for up to 10 minutes at the gateway and up to 30 minutes in the app. No nonce is sent, so a report's age can't be established either.

So chat, background ranking and topic generation all encrypt to a key the app hasn't checked.

The check you can run

You can start a check in the app under Settings, then Mera Protocol, with Verify attestation. It asks for a fresh report for each model with a random nonce and looks at it on the phone. The newest app version also shows the values behind each check, so you can compare them yourself.

The limits of the check

• It fails open. The results are shown to you. A failed check doesn't stop any request.
• It's only run when you ask. Nothing in normal use depends on it.
• It's partial. Some checks never run, because they need data the app doesn't fetch. The screen marks platform patch level as not checked, so the result can never be complete. Older app versions also mark GPU attestation as not checked.
• The GPU result has its own limit. The gateway asks NVIDIA for it, and the app checks NVIDIA's signature and the nonce. It shows genuine NVIDIA GPUs answered. It doesn't show those GPUs are attached to the secure hardware.
• It looks at one report for each model. A pass doesn't cover every request Mera makes.

Because of this, the Private cloud path shouldn't be described as proven by hardware. Your trust sits with the hardware, with NEAR AI as its operator, and with Mera.

Mera plans to make the check stricter. That work isn't done.

Check it yourself

In the app, open Settings, then Mera Protocol, then Verify attestation. It asks for a fresh report using a one-time number made on your phone.

Without the app, NEAR's model verification guide shows how to fetch and check a report. Mera uses Qwen/Qwen3.8-27B and Qwen/Qwen3.6-35B-A3B-FP8. Send your own nonce when you fetch one. That's what makes it fresh, so a saved report can't show what's running now.

The app's checks are in lib/algorithms/attestation-verify.ts in the Mera app repository, so you can read what it looks at and what it skips.

The report's measurements cover the operating system and NEAR's deployment system. The model and the proxy that decrypts your data are installed after boot, so the measurements alone don't identify them.

The report's compose_manager_attestation log lists each file the deployment system ran, with its hash. The public files pin the exact image of the proxy. The newest app version follows that trail and shows you the image.

It doesn't check how that image was built, and it doesn't show what the software does with your data. NEAR documents how to rebuild the image from source, and NEAR's verifier is a place to start.

What isn't encrypted this way

Web search in chat and quick fact checks send readable search words through the gateway, since a search index has to receive the actual words. A full fact check sends an article identifier to Mera's servers.

• Only the search words go to the search provider, with no user identifier, session token, facts or chat history.
• The gateway doesn't log the query text.
• You can turn web search off in Settings.

See What's stored where and the privacy policy.