Threat Model
This document describes the attack surface of Hush AI, how we mitigate each threat, and the residual risks we accept and disclose. It is written for a DPO, IG lead, or CISO evaluating Hush AI for use with confidential data. Every mitigation is sourced from our /security or /proof page.
Related documents: Security and architecture · Transparency report · Sub-processor list (/security). Together these form the compliance package a procurement team needs.
System boundary
Hush AI is a web-based AI drafting and summarisation assistant for regulated professionals. The system has four components:
1. The web front-end (hush-ai.uk) - static pages served from our own hardware, with Cloudflare as the edge TLS and DDoS provider.
2. Hush Gateway - the request router. Validates identity, enforces plan quotas, logs metadata (not content), strips internal reasoning tokens, and routes to the serving model.
3. Hush Models (Omega, Prism, Lambda; a fourth, Alpha, is temporarily out of service) - open-weight models running on hardware we own. Process requests in memory. Content is not persisted to storage.
4. The client - the user's browser. Chat history is stored encrypted on the user's own device, never on our servers.
Source: /security (architecture section).
Assets
| Asset | Where it lives | Retention |
|---|---|---|
| Conversation and document content | User's device only (encrypted) | Until the user deletes it. Never on our servers. |
| API request/response content | Processed in memory on our hardware | Not stored. Metadata only. |
| Request metadata (timestamps, model used, token count) | Our database | 12 months, then automatically purged. |
| Source IP addresses | Our database | 30 days, then automatically purged. |
| Account credentials | Our database | While account exists + 90 days after deletion. |
| Backups | Our own hardware only | Nightly rotation, held up to 30 days. |
Source: /security (data retention summary).
Threat actors and mitigations
1. External attacker (unauthorised access)
| Threat | Mitigation |
|---|---|
| Network interception | TLS 1.2/1.3 only (1.0 and 1.1 disabled); hybrid post-quantum handshake (X25519 + ML-KEM-768) available. (Source: /proof) |
| Credential theft | Account authentication with PBKDF2-HMAC-SHA256; no stored conversation content to exfiltrate even if credentials are compromised. (Source: /security) |
| Server breach | Content is not persisted to storage. An attacker who breaches a server finds metadata only (timestamps, IPs retained 30 days). (Source: /security) |
| DDoS | Cloudflare edge protection. (Source: /security) |
2. Insider (our own staff)
| Threat | Mitigation |
|---|---|
| Staff reads user content at rest | Content is not stored on our servers. There is nothing at rest to read. (Source: /security) |
| Staff reads user content in transit or memory | This is the honest gap. During inference, the model must read the text in memory to answer it. An operator with root access to the serving hardware could, in principle, observe it. We mitigate this by policy (no staff access to serving memory outside maintenance), not by architecture. (Source: /security) |
| Roadmap mitigation | Confidential computing (hardware TEE / GPU enclave with remote attestation) removes this gap: data is encrypted in use, and even the OS, hypervisor, and our own admins cannot read it. The hardware signs a proof the customer can verify. Status: in research, not yet deployed. (Rung 2, roadmap only) |
3. Government and legal process
| Threat | Mitigation |
|---|---|
| Subpoena or court order for user content | We do not store conversation or document content. There is nothing to produce. (Source: /security) |
| Subpoena for metadata | We hold metadata (timestamps, IPs) within the retention windows above. We would narrow scope and notify the user unless prohibited. (Source: /transparency) |
| US CLOUD Act reach | Hush AI is a UK company with no US parent. Our hardware is in the UK. The US CLOUD Act does not reach us. (Source: /security, Companies House 17278687) |
| UK Investigatory Powers Act | We comply with UK law. See the warrant canary in our transparency report. The structural defence is the same: we do not store content, so a production order for content yields nothing. (Source: /transparency) |
4. Supply chain
| Threat | Mitigation |
|---|---|
| Third-party AI sub-processor | We have zero AI sub-processors. All inference runs on hardware we own. No API calls to OpenAI, Google, Microsoft, or any other AI provider. (Source: /security) |
| Cloudflare as edge provider | Cloudflare sees connection metadata (IP, timestamp, URL) in transit. Cloudflare is not an AI sub-processor, is never sent conversation or document content, and never uses anything for training. We disclose this rather than hide it. (Source: /security) |
| Model provenance | We run open-weight models. The model name is returned in every API response so the user can verify it. (Source: /proof) |
Residual risks we accept and disclose
These are risks we cannot fully mitigate today. We name them so a buyer can make an informed decision rather than discovering them later.
1. Cleartext in memory during inference. The model must read the text to answer it. An operator with root access could observe it. This is a policy mitigation, not an architectural one. The architectural fix is confidential computing (on our roadmap, not yet deployed).
2. Cloudflare sees connection metadata. IP, timestamp, URL. Not content. Cloudflare publishes its own transparency report. We cannot verify whether Cloudflare has received per-customer requests.
3. Single-site hardware. All hardware is currently in one UK location. A physical disaster at that site would cause downtime. Content is not affected (it is not stored). Metadata backups rotate within 30 days.
4. Early-stage company risk. We are a new company. If we cease trading, user content is not affected (it is on the user's device). Metadata would be handled per our privacy policy. Users can export their audit log at any time.
How to verify any of this
- Run the TLS and post-quantum checks on /proof.
- Export your audit log from your account dashboard.
- Check Companies House (17278687) and the ICO (ZC126901).
- Review the sub-processor list on /security.
- Read our transparency report (published quarterly).
- During a pilot, inspect the database schema.
This threat model is current as of 29 July 2026. It will be reviewed and updated whenever the architecture, sub-processor list, or retention schedule changes.
Ready to try it?
Free to start, no card, no conversations stored. Your audit log is yours to export from day one.
Start free → or See pricingHush AI is a drafting and summarisation assistant. It is not a source of medical, legal, or financial advice. Always verify AI-generated outputs before acting on them.
← Back to Trust Centre