deRoute

The people who need AI most are often the ones whose work they cannot share: a clinician with patient notes, a lawyer with client contracts, a developer with production keys. Their words pass through an app, a cloud and a model host, and each one can read them. All they get is a privacy policy, a promise they cannot check.

I built deRoute on my own in a weekend at Encode London 2026, and it won the Agents That Ship track.

Before anything leaves my browser, a filter swaps names, emails, keys and numbers for placeholders, and checks that its own rules match a fingerprint published on Arc, a public blockchain. The message is then sealed so that only one sealed computer can open it. My browser first runs seven checks on that machine: genuine hardware, approved software, a key bound to the hardware, running code that matches the public release, confidential GPUs, a place in the open registry and the pinned model. If any check fails, nothing is sent. The reply comes back sealed and my details are put back on my device.

The agent plans with Gemini 4 Argon, but Gemini only sees an outline with none of my words: the task type, a rounded size, rounded counts and which checks to run. A strict gate rejects anything else, which caps each request at about 67 bits. Private runs download the whole reference library from MongoDB Atlas, so the database never learns what I looked up. Payment is credits signed blind and bought with test USDC, and sign-in is a passkey with no email.

Arc is a testnet, so the payments, registry stakes and log anchors use test money. Our relay cannot read messages, but it does see IP addresses and timing. Malware on your own device can read text before it is encrypted, and the filter can miss unusual terms, which is why the sealed computer is the real boundary. The game uses made-up messages and a toy score.