Every privacy claim, linked to the test that checks it.
PARANOID is open source. On every change, GitHub's own machines rebuild it from scratch and run the full test suite, a real bubblewrap sandbox and a real Tor network check. The logs are public; nobody, including us, can edit them.
Live checks
Two checks run against the real thing, not a stand-in. Output copied from the public run log (exit addresses truncated by the script itself).
Tor isolation LIVE
A real Tor daemon; requests go through PARANOID's own SOCKS5 code. torproject.org must confirm every exit is Tor; one conversation must keep its exit; three conversations must not share one.
conversation A, request 1: exit 192.42.116.x IsTor=true
conversation A, request 2: exit 192.42.116.x IsTor=true
conversation B: exit 83.217.9.x IsTor=true
conversation C: exit 171.25.193.x IsTor=true
PASS: every exit is Tor, a conversation keeps
its circuit, conversations are isolatedbubblewrap sandbox LIVE
A real bwrap. Before running, the isolation probe must find uid 65534, only the loopback interface, no /mnt, /home, /root or /etc/passwd, and a read-only /usr; the test then runs a script inside and checks the same from its output. The run fails if this test is skipped.
✔ live: real bubblewrap blocks network and host files
ℹ tests 1
ℹ pass 1
ℹ fail 0
ℹ skipped 0Property → evidence
Each link opens the exact test, at the verified commit. Tests use a recording stand-in for the AI provider, so they can assert what the provider would have received.
| Property | Evidence | Kind |
|---|---|---|
| The AI provider receives only the sanitized text, over Tor, and the answer is restored on your machine | privacy.test.ts#L30 | test |
| If local sanitization fails, the original prompt is never sent (server error, bad JSON, wrong count, empty output, model server down) | sanitizer.test.ts#L68sanitizer.test.ts#L76privacy.test.ts#L10 | test |
| Raw identifiers never reach even the local model: deterministic rules run first | sanitizer.test.ts#L60sanitizer.test.ts#L9 | test |
| People and organizations named by the local model are masked even if its rewrite would keep them | sanitizer.test.ts#L42 | test |
| Code is kept byte for byte; identifiers reintroduced by the rewrite are masked again | sanitizer.test.ts#L25 | test |
| Without verified Tor, nothing is sent: no fallback to a direct connection | privacy.test.ts#L19tor.test.ts#L71 | test |
| Each conversation gets its own Tor circuit; DNS is resolved by the Tor exit, not locally | tor.test.ts#L57tor.test.ts#L45CI run | test + live |
| A profile never downgrades itself: a missing layer means 409 and nothing forwarded | server.test.ts#L86server.test.ts#L47privacy.test.ts#L71 | test |
| Sending an unsanitized prompt is impossible outside Standard mode | privacy.test.ts#L54privacy.test.ts#L63 | test |
| Paranoid never uses your API key: it pays only with a zkAPI lease, and a foreign lease endpoint is refused | privacy.test.ts#L87 | test |
| Agent tools run sandboxed, never implicitly; their output is re-masked before the model sees it | privacy.test.ts#L107privacy.test.ts#L132 | test |
| The JavaScript sandbox exposes no network, filesystem or process API | privacy.test.ts#L107 | test |
| The shell sandbox has no network, no host files and no privileges, and is offered only after its isolation probe passes | bwrap.test.ts#L140bwrap.test.ts#L31bwrap.test.ts#L100CI run | test + live |
| Websites cannot drive the local daemon: foreign Host, Origin and cross-site requests are refused (DNS rebinding, CSRF) | server.test.ts#L27server.test.ts#L122 | test |
| The API cannot point the sanitizer off your machine or the provider at another host | server.test.ts#L111 | test |
| Cover traffic needs verified Tor and stays within its budgets | privacy.test.ts#L171privacy.test.ts#L185 | test |
| No invented balances: the wallet lives in your browser and the daemon never reports funds it does not hold | server.test.ts#L103 | test |
| The zkAPI relay only reaches the SDK's pinned hosts, and only over Tor | server.test.ts#L56server.test.ts#L76 | test |
What this does not prove
Tests show the code does what it claims. They do not cover everything:
- What the provider does with the sanitized text it receives. It still reads the task.
- How much the sanitizer catches on arbitrary text. The tests check the mechanism and fail-closed behaviour, not a detection rate; no public benchmark yet.
- Anonymity against a global observer. Tor hides your IP from the provider; it does not defeat someone watching most of the network.
- zkAPI payments end to end. The policy (Paranoid never uses your key) is tested; a live deposit, lease and withdrawal has not been run yet.
- The binary you download is this code. Builds are not yet reproducible or signed; build from source to be sure.
- An audit. PARANOID has not been independently audited.
Verify it yourself
Same commands as the public run, on your machine:
git clone https://github.com/paranoidfamily/paranoid
cd paranoid
git checkout b288eb3
npm ci
npm test # 47 tests (the live bwrap test runs where bwrap exists)
node scripts/verify-tor.ts 9050 # needs a running Tor on 127.0.0.1:9050PARANOID is not affiliated with Vitalik Buterin, the Ethereum Foundation, Open Anonymity or the Tor Project. The verification run is executed by GitHub Actions on GitHub-hosted runners.