private pilots soon
ᚺᚢᛚᛞᛖᚱ // old norse huldr: hidden

Your work stays in the forest.

Hulder runs under the harness you already use. Same terminal, same tools. Your whole session is sealed on your machine and opened only inside verified hardware.

[ private pilots · opening soon ] how it works ↓
// seen from the front

She could be anyone.

In Scandinavian folklore the hulder walks out of the deep forest looking like any other woman. Point your harness at her and it looks the same as it did.

// seen from behind

She is hollow.

Turn her around and her back is empty as a rotten tree. That's the design. No logs, no history, no training set. Nothing in there to find.

ᚺ the harness

Keep your harness. Change what's underneath.

A small local process, the ward, looks like a normal model API. Point Claude Code, Codex or pi at it with one setting. Your keybindings, tools and habits stay as they are. The model underneath is hidden, and the provider you used before is never called. 

# claude code
ANTHROPIC_BASE_URL=http://127.0.0.1:4141

# codex: ~/.codex/config.toml
model_provider = "hulder"

# pi: ~/.pi/agent/models.json
"baseUrl": "http://127.0.0.1:4141/v1"
# .hulder in any repo you want hidden
mode = "hidden"
on_unverified = "refuse"

# this repo:   sealed, or nothing is sent
# other repos: your usual model
one way: a hidden session stays hidden
 your harness ───> [ ward ] ══▓▓▓▓▓▓▓▓══> ( hulder )
                      │        sealed     intel tdx
                      │                   nothing kept
                      └── no .hulder ───> your usual model
ᚢ the leak

Your model talks. She doesn't.

Hypotheses, sequences, patent drafts: everything a hosted model reads sits on a server you don't control, under terms that can change. A contract says what a provider promises. It doesn't stop them being breached or subpoenaed.

the provider seesusual modelhidden repo
your conversationall of itnothing
your fileswhat it readsnothing
tool outputall of itnothing
how you knowa contracta hardware signature
frontier modelsyesno, open models

Only need her for one file? Stay on your frontier model and add her over MCP. Your model passes a path, the ward reads and seals the file, and the answer goes to disk. Your model still sees what you type to it.

ᛚ the rite

Prove. Seal. Forget.

[1] prove

The ward challenges her with a random number. The answer is signed by the processor itself, naming the exact code and system running. If anything differs from the public list, nothing is sent.

[2] seal

Every request is encrypted on your machine to a key only that verified code holds. Networks, clouds and Hulder's own operators see noise.

[3] forget

She reads, answers and discards. No logs, no stored prompts. There is nothing to hand over because nothing was kept.

hulder — ward

        

      


      

        
ᛞ the company she keeps

        
For people with something to lose.

        
    
          
  1. Universities
    Unpublished findings, grant ideas, student data. One pool for a whole faculty.
    2. 
          
  2. Biotech and R&D
    Targets, sequences and trial data, worth more unseen until filing.
    3. 
          
  3. Chip design
    Design IP and process know-how, where one leak undoes years.
    4. 
          
  4. Smaller states
    Agencies that won't route their work through another country's providers.
    5. 
        

        
She runs open models on confidential GPUs: GLM 5.3, DeepSeek V4.1, GLM 5.3 Flash.

      


      

        
ᛖ the price

        
Pay for tokens. Nothing else.

        
No seats, no licence, no hardware. An institution buys one pool and everyone draws from it. Finance sees what was spent. Credits are anonymous by construction, so nobody can tie a question to the person who asked it.

      


      

        
ᚱ questions

        
Asked quietly.

        

          

            Do I have to change tools?
            
No. Your harness keeps working the way it does now. One setting points it at the ward, and a .hulder file marks which repos are hidden.

          

          

            Can my usual provider see anything in a hidden repo?
            
Model traffic never reaches them. Harnesses can also send telemetry of their own, so setup turns that off wherever the harness allows it.

          

          

            Can I use a frontier model in the same session?
            
No, and that's deliberate. A hidden session stays hidden, because switching back would send the whole conversation to the provider. Other repos use your usual model as normal.

          

          

            What if the hardware can't be verified?
            
The ward refuses. It never falls back to a hosted model.

          

          

            Can you read my session?
            
No. Requests are encrypted on your machine to a key held only by verified code inside the hardware, and the ward sends nothing if that code isn't the published version.

          

          

            Where does MCP fit?
            
It's for one-off sensitive files while you stay on a frontier model. Your model still sees what you type to it, and anything you open afterwards. For a fully hidden session, use the harness route.

          

          

            What do you store?
            
Spent credit fingerprints, so a credit can't be used twice, and aggregate counters. No prompts, no files, no replies.

          

          

            How good are the models?
            
Behind the frontier, and we won't pretend otherwise. That's the trade: a strong open model, with proof that nothing leaks.

          

          

            Who is the hulder?
            
A forest being from Scandinavian folklore, named from the Old Norse for hiding. From the front she looks like anyone. From behind she's hollow.

          

          

            When can we use her?
            
Hulder is in development. Private pilots open soon.