Witbitz docs Get access
Documentation

Build, verify, and operate apps on Witbitz.

Witbitz is a trusted runtime for collaborative AI apps built around Spaces — backendless, content-blind, and verifiable. These docs run in three acts: build a tenant app, check the trust claims yourself, and run it hosted or in a boundary you control.

Start with the overview Build a tenant app Verify it yourself
Get Started · build it

Build a tenant app, end to end.

Register a coupon-free tenant, build by embedding the reference Spaces, deploy on your own origin, then verify the trust claims yourself. Understand the model first, then follow the path.

Read first

Overview

What a Space is, how static apps use Witbitz, and where the deeper docs fit.

 Architecture

Platform

The three layers, runtime services, topologies, and the live-call engine.

 The model

Async Spaces

The agent-as-a-function architecture and the content-blind poll model.
Vault SpacesRegister a coupon-free tenant, embed the reference Spaces, and put a function on your page as the agent's tool — build as a tenant. Deploy itHost your static page on your own branded origin; the verified Space stays on the Witbitz origin. Verify it yourselfReproduce the gate, the egress lock, the sealed store, and the reproducible build in your own terminal. Ship the ConciergeThe capstone reference app: a private concierge that discloses only a minimal query to an outside event service. Get a SeatGeek key, declare your origin, and it runs. App-faced SpacesGive a Space an app for a face: your site full-screen, the private room as a pull-up card, and three sign-in patterns — including a shared account whose token rides sealed in the room.
Contract

Platform API

The tenant-keyed `/v1` surface and the OpenAPI specs.

 Shortcut

SDK

A private, agent-backed, link-shared app from a static page in an afternoon.

 Drop-in

Embed a Space

Put a content-blind room into any page in one line — isolated iframe, origin-checked bridge.
Trust · believe it

Privacy you can check, not just claims.

Neither the operator nor the app's own owner can read the users' data — and it's a property you verify from the code, not a promise you take. Each doc is precise about what is Production, Implemented, or Design; the full reality map is Status, and the checks run in your own terminal on Verify it yourself.

Overview

Trust model

The two guarantees — the double blind and delegated authority — what is protected, and what is not hidden.

 Configuration

Privacy tiers

The maximal configuration, the orthogonal axes, and how named modes trade down.

 Admission & lifecycle

Identity and admission

Key possession, signed entries, gated Spaces, OIDC, the owner rule, removal, and recovery.

 The client

The verified client

Verification and key confinement, the native attested client, and the verifier extension.

 Unobservable in use

Attested server tier

Run a Space's turns inside measured Nitro hardware, the key sealed to the image.
Operations · run it

Run it wherever you need.

The same reproducible runtime, hosted or in a boundary you control. What is live, preview, built, and designed is tracked in Status.

Mode selector

Deployment options

Hosted private beta, enterprise VPC/on-prem, and air-gap in one map.

 Reality map

Status

Live, private beta, built-not-production, and designed work in one table.
Hosted

Hosted private beta

Access, tenant keys, the public OpenAPI, and the checkable hosted evidence.

 Customer boundary

Enterprise & on-prem

Run the runtime with your own model, storage, records, secrets, and IdP.

 Zero egress

Air-gap mode

What AIRGAP=1 changes, what still works, and what needs a local replacement.