<!doctype html>
<html lang="en">
  <head>
    <meta charset="utf-8">
    <meta name="viewport" content="width=device-width, initial-scale=1">
    <title>Why Ambient is Safe — Privacy Through Sharding</title>
    <meta name="description" content="Ambient never sends a full recording to any single worker. Audio is sliced into 60-second fragments before dispatch, so no worker ever hears a complete conversation.">
    <link rel="stylesheet" href="/static/styles.css">
  </head>
  <body>
    <div class="shell">
      <header class="nav">
        <a class="brand" href="/">
          <span class="brand-mark">HC</span>
          <span>Ambient</span>
        </a>
        <nav class="nav-links">
          <a href="/">Overview</a>
          <a href="/download">Download</a>
          <a href="/earn">Earn</a>
          <a href="/manager/login">Manager</a>
        </nav>
      </header>

      <main>
        <section class="hero">
          <article class="hero-copy">
            <div class="eyebrow">Privacy model</div>
            <h1>No worker ever hears a full recording.</h1>
            <p class="lead">
              Before any audio reaches a worker, the coordinator slices it into
              60-second fragments. Each fragment goes to a different machine. No single
              worker receives enough audio to reconstruct the original.
            </p>
            <div class="hero-actions">
              <a class="button" href="/download">Download for Mac</a>
              <a class="ghost-button" href="/earn">How earning works →</a>
            </div>
          </article>

          <aside class="hero-panel">
            <div class="panel-kicker">What your Mac sees</div>
            <div class="metric">
              <strong>60 seconds</strong>
              <span>Maximum audio per fragment. Workers never receive the full job.</span>
            </div>
            <div class="metric">
              <strong>No metadata</strong>
              <span>Fragments carry no sender name, email, or identifying information.</span>
            </div>
            <div class="metric">
              <strong>Memory only</strong>
              <span>Audio is processed in memory and discarded. Nothing is written to disk.</span>
            </div>
          </aside>
        </section>

        <section class="section">
          <div class="section-header">
            <div>
              <div class="eyebrow">How sharding works</div>
              <h2 class="section-title">Dispatch without exposing the full picture.</h2>
            </div>
          </div>
          <div class="grid grid-2">
            <article class="panel">
              <h3>How sharding protects you</h3>
              <ul class="list">
                <li>A 30-minute meeting becomes roughly 30 one-minute shards.</li>
                <li>Each shard includes only a small overlap for clean transcript stitching.</li>
                <li>Adjacent shards are sent to different Macs, not the same machine twice in a row.</li>
                <li>No worker hears enough contiguous audio to follow the full conversation.</li>
              </ul>
            </article>
            <article class="panel">
              <h3>Sharding diagram</h3>
              <div class="shard-diagram" aria-label="Waveform sliced into shards and sent to different workers">
                <div class="waveform" aria-hidden="true">
                  <span class="wave-bar tall"></span>
                  <span class="wave-bar"></span>
                  <span class="wave-bar medium"></span>
                  <span class="wave-bar short"></span>
                  <span class="wave-bar tall"></span>
                  <span class="wave-bar medium"></span>
                  <span class="wave-bar short"></span>
                  <span class="wave-bar"></span>
                  <span class="wave-bar tall"></span>
                  <span class="wave-bar medium"></span>
                  <span class="wave-bar short"></span>
                  <span class="wave-bar tall"></span>
                  <span class="wave-bar"></span>
                  <span class="wave-bar medium"></span>
                  <span class="wave-bar short"></span>
                  <span class="wave-bar tall"></span>
                </div>
                <div class="shard-strip" aria-hidden="true">
                  <span class="shard-block shard-a">00:00-01:00</span>
                  <span class="shard-block shard-b">00:58-01:58</span>
                  <span class="shard-block shard-c">01:56-02:56</span>
                  <span class="shard-block shard-d">02:54-03:54</span>
                </div>
                <svg class="shard-arrows" viewBox="0 0 520 110" role="img" aria-label="Each shard routes to a different worker">
                  <path d="M64 8 C64 42, 64 42, 64 76" />
                  <path d="M190 8 C190 42, 190 42, 190 76" />
                  <path d="M318 8 C318 42, 318 42, 318 76" />
                  <path d="M446 8 C446 42, 446 42, 446 76" />
                </svg>
                <div class="worker-row">
                  <div class="worker-node shard-a">Mac A</div>
                  <div class="worker-node shard-b">Mac B</div>
                  <div class="worker-node shard-c">Mac C</div>
                  <div class="worker-node shard-d">Mac D</div>
                </div>
              </div>
            </article>
          </div>
        </section>

        <section class="section">
          <div class="section-header">
            <div>
              <div class="eyebrow">Anti-correlation</div>
              <h2 class="section-title">The coordinator avoids adjacent shard reuse.</h2>
            </div>
            <p class="section-note">
              Even if a worker is compromised, it should only ever see non-adjacent
              slices. That makes reconstruction materially harder.
            </p>
          </div>
          <div class="grid grid-2">
            <article class="panel">
              <h3>Why adjacency matters</h3>
              <ul class="list">
                <li>Shard 12 and shard 13 together reveal more context than shard 12 and shard 27.</li>
                <li>Scheduling spreads neighboring audio across different machines on purpose.</li>
                <li>A worker can be accurate on its clip without learning what was said before or after.</li>
              </ul>
            </article>
            <article class="panel">
              <h3>Anti-correlation visualization</h3>
              <div class="anti-correlation" aria-label="Shard assignments avoid adjacent workers">
                <div class="anti-header">
                  <span>Shard</span>
                  <span>Assigned worker</span>
                </div>
                <div class="anti-row">
                  <span>01</span>
                  <span class="anti-cell shard-a">Mac A</span>
                </div>
                <div class="anti-row">
                  <span>02</span>
                  <span class="anti-cell shard-b">Mac B</span>
                </div>
                <div class="anti-row">
                  <span>03</span>
                  <span class="anti-cell shard-c">Mac C</span>
                </div>
                <div class="anti-row">
                  <span>04</span>
                  <span class="anti-cell shard-a">Mac A</span>
                </div>
                <div class="anti-row">
                  <span>05</span>
                  <span class="anti-cell shard-d">Mac D</span>
                </div>
                <div class="anti-row">
                  <span>06</span>
                  <span class="anti-cell shard-b">Mac B</span>
                </div>
              </div>
            </article>
          </div>
        </section>

        <section class="section">
          <div class="section-header">
            <div>
              <div class="eyebrow">Validation</div>
              <h2 class="section-title">What the coordinator does to validate workers.</h2>
            </div>
            <p class="section-note">
              Hidden canaries and reputation scoring let Ambient validate output
              without assuming any worker is trustworthy on day one.
            </p>
          </div>
          <div class="grid grid-3">
            <article class="card">
              <h3>Double-check new workers</h3>
              <p>
                New workers start at zero trust. Their early output can be verified by
                a second independent worker before it is accepted.
              </p>
            </article>
            <article class="card">
              <h3>Canary injection</h3>
              <p>
                The coordinator occasionally swaps in known-answer audio. Workers do not
                know when they are being tested, which makes gaming the system harder.
              </p>
            </article>
            <article class="card">
              <h3>Reputation scoring</h3>
              <p>
                Workers build up from new to provisional to trusted to elite. Bad
                output lowers reputation and reduces future work.
              </p>
            </article>
          </div>
        </section>

        <section class="section">
          <div class="section-header">
            <div>
              <div class="eyebrow">Visibility</div>
              <h2 class="section-title">What a worker receives, and what stays hidden.</h2>
            </div>
          </div>
          <div class="panel">
            <div class="comparison-table double">
              <div class="comparison-head">Workers see</div>
              <div class="comparison-head">Workers do not see</div>

              <div class="comparison-cell">A single 60-second audio clip</div>
              <div class="comparison-cell">Your name, company, or email</div>

              <div class="comparison-cell">The language to transcribe</div>
              <div class="comparison-cell">The full recording</div>

              <div class="comparison-cell">A result endpoint for that clip</div>
              <div class="comparison-cell">Other shards from your job</div>

              <div class="comparison-cell">Only the current shard timing</div>
              <div class="comparison-cell">The final merged transcript</div>

              <div class="comparison-cell">Transport over HTTPS</div>
              <div class="comparison-cell">Any account metadata about you</div>
            </div>
          </div>
        </section>

        <section class="section">
          <div class="section-header">
            <div>
              <div class="eyebrow">Comparison</div>
              <h2 class="section-title">How Ambient compares.</h2>
            </div>
          </div>
          <div class="panel">
            <div class="comparison-table comparison-quad">
              <div class="comparison-head"></div>
              <div class="comparison-head">Ambient</div>
              <div class="comparison-head">OpenAI Whisper API</div>
              <div class="comparison-head">Self-hosted</div>

              <div class="comparison-label">Your audio goes to</div>
              <div class="comparison-cell">Distributed Macs, one shard each</div>
              <div class="comparison-cell">OpenAI servers, full file</div>
              <div class="comparison-cell">Your own machine or cluster</div>

              <div class="comparison-label">Who can access it</div>
              <div class="comparison-cell">No single worker hears the full recording</div>
              <div class="comparison-cell">OpenAI systems handling the job</div>
              <div class="comparison-cell">Your team and infrastructure</div>

              <div class="comparison-label">Cost</div>
              <div class="comparison-cell">Around $0.003 per minute</div>
              <div class="comparison-cell">Around $0.006 per minute</div>
              <div class="comparison-cell">Hardware and ops overhead</div>

              <div class="comparison-label">Speed</div>
              <div class="comparison-cell">Parallel shards across a fleet</div>
              <div class="comparison-cell">Single hosted request path</div>
              <div class="comparison-cell">Bound by your own capacity</div>

              <div class="comparison-label">Retention</div>
              <div class="comparison-cell">Deleted after completion</div>
              <div class="comparison-cell">30-day retention by default</div>
              <div class="comparison-cell">You decide</div>
            </div>
          </div>
        </section>

        <section class="section">
          <div class="section-header">
            <div>
              <div class="eyebrow">FAQ</div>
              <h2 class="section-title">Direct answers to the obvious questions.</h2>
            </div>
          </div>
          <div class="faq-stack">
            <details class="faq-item">
              <summary>Can a worker reconstruct my full recording?</summary>
              <p>
                No. Shards are short, adjacent clips are intentionally split across
                different workers, and a worker does not receive the merged transcript.
              </p>
            </details>
            <details class="faq-item">
              <summary>What if a worker saves the audio?</summary>
              <p>
                The worker still only has a short clip with no identifying metadata.
                Hidden canaries and reputation scoring make low-quality or malicious
                behavior easier to detect and remove.
              </p>
            </details>
            <details class="faq-item">
              <summary>Is the transcript encrypted?</summary>
              <p>
                In transit, yes. Audio and transcripts move over HTTPS. At rest, the
                transcript sits in the coordinator database behind your API access
                controls.
              </p>
            </details>
            <details class="faq-item">
              <summary>Can I use this for HIPAA-regulated audio?</summary>
              <p>
                Not yet. The pilot is designed for teams that want lower cost and good
                privacy boundaries, but it is not represented as HIPAA-certified today.
              </p>
            </details>
          </div>
        </section>

        <section class="section">
          <div class="callout">
            <div class="eyebrow">Open source</div>
            <h2 class="section-title">The worker is open. Audit it yourself.</h2>
            <p class="lead">
              The local worker code is public. You can read exactly what runs on your machine —
              how it polls, what it sends back, and how audio is handled.
            </p>
            <div style="margin-top: 28px;">
              <a class="ghost-button" href="https://github.com/sburl/Ambient">View source on GitHub →</a>
            </div>
          </div>
        </section>
      </main>

      <footer class="footer">
        Ambient · <a href="/earn" style="opacity:0.6;">Earn</a> · <a href="https://github.com/sburl/Ambient" style="opacity:0.6;">GitHub</a>
      </footer>
    </div>
  </body>
</html>
