Xanadu
·status
Dispatcher live · Cloud in build · 2026

Nothing to hand over.

Chat, code, and cowork apps. Iceland hardware, Swiss legal home.

Try the demoTalk to a founder
Feb 2026 · US v. Heppner

The court ruled. Your AI provider will comply.

A US federal judge ordered Anthropic to produce 31 customer chats with Claude. Six weeks earlier the same court ordered OpenAI to produce 20 million ChatGPT conversations to civil plaintiffs.

Every US-based AI provider can be subpoenaed under the CLOUD Act, the All Writs Act, and the Stored Communications Act. They will comply, because they have the data and they cannot refuse.

Read the case
architecture

Two anchors. One sealed stack.

Reykjanesbær for the hardware. Zürich for the company. NVIDIA Confidential Computing in between.

  1. 01
    Hardware-isolated inference

    Each request will run inside a Trusted Execution Environment on the GPU. Cleartext never leaves the chip by design.

  2. 02
    Swiss legal home

    The operating entity is forming as a Swiss Stiftung in Zürich. Article 271 SCC makes unauthorized foreign discovery a personal crime under Swiss law.

  3. 03
    Customer-verifiable build

    The enclave build hash will be published. The customer SDK verifies the attestation chain before sending the first byte.

apps

What the seat opens.

Four apps. Same shape your firm uses ChatGPT and Claude for. By design, on hardware that can’t read what you typed.

Designing · 2026

Chat

web

Like ChatGPT. By design, the hardware holds no key to the transcript. Bring a document, ask a question, walk away with no plaintext copy anywhere.

Join the beta waitlist
Designing · 2026

Code

CLI / agent

Like Claude Code. Open-source fork on top of the Xanadu Cloud. Engineering work product stays off any US-jurisdiction server.

Notify me
Designing · 2027

Cowork

desktop

Persistent encrypted projects. Customer-held keys. Inference rented; memory owned. The Anthropic-Cowork peer, the operator can’t read either.

Notify me
2027

Mobile

iOS · Android

Confidential AI in your pocket. PWA shell at first; native after the design-partner cohort ships.

Notify me
proof

Why this isn’t vapor.

The apps are designing. The infrastructure under them is already shipping or already written.

Live today

Dispatcher at xanadu.run/mcp

Open MCP server, real production traffic, ~120ms init latency. The on-ramp for any AI client that speaks MCP.

One click

Real dispatch, real ledger

The demo button POSTs to the production dispatcher and returns a real dispatch_id and cost. ~$0.004, ~10s.

Written + reviewed

Threat model + working paper

Five named adversaries with verification paths. ~3,000-word working paper, reviewed by counsel + external cryptographer.

Founders

Loop.health + srve.co

Built health data under HIPAA (couldn’t put it on Claude). Built an AI product whose API bill compounded. Bleeding in both halves of the wedge.

platform

What the apps run on.

The substrate. Engineers building against the platform skip the apps and wire in here. The Dispatcher is live today.

Building · Beta 2026
The engine

Cloud

Confidential inference on GPUs being stood up in Reykjanesbær, operated by a Swiss Stiftung (in formation) in Zürich. Jurisdictionally insulated from foreign extraterritorial claims under Art. 271 SCC. Frontier-grade open-weight model, customer-pinned weights.

Hosted Swiss enclave (in build) · or shipped as an appliance for on-prem.

Apply for the cohort
Live · MIT, publishing 2026
The engineer on-ramp

Dispatcher

Use Xanadu from any existing MCP client (Claude Code, Cursor, Cline) today, while the apps ship. Hard budget caps, append-only ledger, BYOT provider keys, provenance trailers in commits.

Hosted at xanadu.run/mcp; self-host in your VPC when source publishes.

See the dispatcher
Designing · 2027
The moat

Memory

Persistent encrypted context. Customer-held keys. Inference is rented; memory is owned. Ships under the Cowork desktop app as the lock-in layer.

Sits behind the Cloud. Accessible to your users only.

Read the design
trusted execution environment

Inside the GPU.

A hardware-isolated region of the chip holds the decryption key, attests to the customer SDK, and zeros its memory between requests. NVIDIA Confidential Computing, Blackwell-class.

  1. 01Customer SDK fetches the GPU’s attestation report and verifies the build hash.
  2. 02Customer encrypts the prompt to the enclave’s public key.
  3. 03TEE decrypts inside the GPU, runs inference, re-encrypts the output.
  4. 04Enclave memory is zeroed. No plaintext leaves the chip. No log is written.
public references
customers

Professions where confidentiality is non-negotiable.

Every seat opens the same client suite. Chat for research. Code for engineering. Cowork for ongoing matters. Pick the deployment your compliance allows. Law firms are the wedge; the design-partner cohort is open through Q3 2026.

Hosted cloud

Sovereign Swiss enclave (in build). GPUs in Reykjanesbær.

  • Law firms

    Chat for research. Cowork for case files. Privilege restored under Kovel.

  • M&A and PE deal teams

    Chat + Cowork for drafting against MNPI. The transcript stays in the box.

  • Family offices

    Cowork for wealth and estate planning conversations that cannot be subpoenaed.

  • Crypto and web3 funds

    Chat for strategy. Code for tooling. Keys and trade history stay yours.

  • Investigative journalists

    Chat for source notes. Cowork for ongoing investigations.

  • Foreign governments

    Sovereign data for delegations. Swiss legal home, Reykjanesbær hardware.

On-prem appliance

Inside your walls. Enclave shipped as an appliance.

  • Defense and ITAR

    Code + Cowork for CUI workloads. Inside the SCIF.

  • Pharma R&D

    Chat + Cowork for drug IP, trial data, regulatory filings.

  • Health systems

    Chat for clinical lookup. Cowork for case notes under HIPAA.

  • Accounting and audit

    Chat + Cowork for client books and tax workpapers.

  • Corporate GC

    Chat + Cowork. Privilege at scale, in-house.

  • Engineers with private IP

    Code + Cowork. Trade secrets stay yours.

pricing

Posted. No sales call to see the number.

Dispatcher
Free
MIT, self-hosted (when source publishes)

Open-sourcing under MIT in 2026. Bring your provider keys. Ledger is yours.

Hosted dispatcher
+10%
routing fee on raw provider cost

We run xanadu.run/mcp. You keep your provider quota and ledger.

Xanadu seat
$300
per seat / month · chat + code + cowork

Hosted cloud, sovereign Swiss enclave. Design-partner cohort. Price locks through GA.

On-prem and high-volume contracts are quoted per cohort. Full bracket table on /cloud.

the round trip

One request. Plaintext lives in one place.

The customer’s device encrypts the prompt to the enclave’s public key. The relay forwards opaque bytes. The TEE decrypts inside the GPU, runs inference, re-encrypts the response, zeros its memory. Plaintext exists only inside node 03, for the duration of the request.

  1. 01
    Device encrypts

    Customer SDK fetches the GPU attestation, verifies the build hash, encrypts the prompt to the enclave’s public key.

  2. 02
    Endpoint relays

    Reykjanesbær relay forwards ciphertext to the cluster. The relay has no decryption material.

  3. 03
    TEE computes

    Plaintext exists here, and only here. The GPU decrypts, runs inference, re-encrypts the output, zeros working memory.

  4. 04
    Device decrypts

    Customer SDK opens the response with its own key. No log, no persistence, no plaintext copy anywhere else.

start here

Three ways in.

for the buyer

Join the Chat beta

Web Chat opens Q4 2026 on the hosted Swiss cloud. Get on the list now and we’ll notify you when seats open.

Email the waitlist
for the firm

Apply for the design-partner cohort

Ten firms. Price locks through GA. Co-authored threat-model addendum naming your use case.

Open form
for the engineer

Wire the dispatcher

One block in your .mcp.json. The dispatcher shows up inside Claude Code or Cursor today.

Open docs