Safebox makes AI verifiable: every action it takes is tied to code that was signed off on in advance, runs inside hardware attestation, and can be replayed end-to-end by a regulator, an auditor, or you. Safebots is the collaboration layer on top. Safebux is the utility currency that powers Safecloud — a decentralized network of encrypted storage and compute where anyone can participate and no node ever sees plaintext.
When an AI agent sends an email, signs a document, or moves money — who authorized it? What code ran? Was the data it saw supposed to be seen? If something goes wrong, can anyone reconstruct what happened?
Right now, for most production AI deployments, the answer to all of these questions is the same: we'll take your word for it. That works fine until it doesn't. A bank, a hospital, a law firm, a government agency — any organization that answers to an auditor, a regulator, or a board — can't deploy AI this way. They need provable answers. Safebox is what provable answers look like.
A hardware-attested environment where AI runs. Every piece of code is signed off in advance. Every external call goes through a reviewed gate. Every run produces a cryptographic receipt.
AI agents you work with, not just talk to. Goal-directed, memory-native, multi-participant. Humans and agents operate on the same living knowledge graph — no more "chat with the bot, then copy-paste the result."
The currency that pays for storage and compute on Safecloud — a decentralized network where Safebox instances, browser tabs, and idle devices all provide encrypted capacity. No node ever sees plaintext. Spend Safebux to run workflows. Earn Safebux by contributing resources.
Safebox is HTTPS for AI. You don't need to understand the cryptography to use it — you just need to know the padlock means someone can prove it's safe.
Safebox is built so that a compromised AI agent — whether by prompt injection, a malicious model, or a bad actor — cannot do damage without passing through gates that a human approved in advance. These aren't policies written in natural language and enforced by asking the model to behave. They're structural. The wrong behavior is impossible by construction, not just discouraged.
Here's how the system is built. Each layer is narrower than the one below it.
| Layer | What it is | What it can do | What it cannot do |
|---|---|---|---|
| Workflow | A declarative tree of Steps — the signed, immutable plan for what gets done. | Compose approved Tools and Capabilities into sequential or parallel Steps. | Introduce new Tools or Capabilities; alter a Step's contents after signing. |
| Workload | The runtime tree of Tasks produced when a Workflow executes. | Traverse Steps in the declared order and materialize each as a Task. | Deviate from the Workflow's declared composition. |
| Tool | LLM-authored code that runs inside an isolated sandbox worker. | Read streams, propose actions via Action.propose, yield stream references, return scalar values. |
Reach the network, filesystem, or host APIs. Write to any stream directly. See credentials. |
| Capability | Approved, hash-pinned code that calls exactly one external Protocol. | Execute the specific external call it was reviewed and signed for. | Run if its code hash doesn't match what was approved. Call any Protocol it wasn't approved to call. |
| Protocol | The external system being called — HTTP, LLM, SMTP, Payment, Web3. | Carry out the request the Capability constructed, under the credentials injected by the host. | See the Tool's internal state. Persist anything back into the environment without going through a Capability return. |
| Policy | The governance layer: M-of-N signing rules, approval thresholds, automated policy checks. | Gate which Workflows run, which Capabilities are approved, which proposed actions commit. | Be bypassed by any layer above it. Signatures are cryptographic; approvals are unforgeable. |
A prompt injection inside a Tool cannot call the network, cannot forge a Capability, cannot reach credentials, cannot alter the Workflow it's running inside, and cannot bypass the Policy that approved it. Five walls, each closing a different class of attack.
A SOC 2 Type II auditor doesn't want your promise that the AI behaved. They want a log they can verify. Safebox produces that log as a cryptographic artifact — the full execution trace, signed by the hardware it ran on, replayable against the same inputs to produce the same outputs. This is the thing regulated industries have been asking every AI vendor for and nobody has been shipping.
Most AI collaboration today is group chat with a bot in it. That's not collaboration — that's a slightly more articulate paperclip assistant. Safebots is a different model.
Each participant has their own 1-on-1 conversation with the AI. The AI has full context on what everyone else is contributing — their shared goal, the current state of the work, the history of decisions made. It synthesizes across all the private conversations, proposes artifacts, routes approvals to whoever needs to sign off, and keeps the shared work moving forward.
The Context paper behind Safebots proved, mathematically, that this structure dominates reactive chatbots for goal-directed work. Same task, fewer turns, higher artifact quality. Not a claim about any specific product — a theorem about the structure of goal-directed interaction.
If Slack is a chatroom where people happen to talk, Safebots is a workshop where people happen to build — with an AI that knows what you're building, who's doing what, and what comes next.
Under the hood, Safebots stores everything as a typed, versioned, access-controlled graph. A proposal is a node. A revision is a fork with a vote weight. A sent email is an edge from your draft to your customer's channel. A decision is an ordinal in the timeline.
This is strictly more expressive than a chat log or a RAG vector index. It can answer multi-hop questions ("which proposals did Alice approve that eventually shipped to production?") that no chatbot architecture can currently express. And because it's structural, access control lives in the graph itself — a prompt-injected agent can't induce retrieval of data its user doesn't have rights to see.
Safebux is not an investment. It's a utility token — the currency you spend to buy storage and compute on Safecloud, and the currency you earn when you provide storage and compute to Safecloud.
Safecloud is the network of infrastructure that actually runs workflows and stores data. It includes Safebox instances hosted by professional operators on AWS, GCP, and Azure. It also includes browser tabs left open on desktops, idle mobile devices, home servers, and any other machine willing to contribute capacity. All of them are peers on the same network. All of them accept Safebux in exchange for the storage and compute they provide.
If you've used AWS credits, you've used something similar: a platform-specific currency you spend for infrastructure services. Safebux is that — except Safecloud isn't owned by a single company, and the people earning Safebux aren't the platform; they're the participants.
The obvious question about distributed storage is: if my data is spread across other people's machines, what stops them from reading it? The answer is cryptography, not trust. Every chunk is encrypted with AES-256-GCM before it leaves your device. The network nodes that route chunks (Jets) never see plaintext. The nodes that store chunks (Drops) never see plaintext. Only you — or whoever you explicitly delegate access to — has the keys to decrypt.
The system uses convergent encryption — keys are deterministically derived from your rootKey — which means the same file uploaded twice produces identical ciphertext and can be deduplicated across the network without anyone knowing the files match. Every chunk's identity is a content hash (CID); the Merkle root of all CIDs is in a public manifest, so any party can verify a chunk they received is the one that was originally uploaded, without any keys at all.
AWS credits are what you spend to rent Amazon's infrastructure. Safebux is what you spend to rent Safecloud's infrastructure — except Safecloud is everyone, the credits flow to whoever contributed the capacity, and nobody running the infrastructure can read what they're storing.
Centralized clouds have one price and one failure mode: if AWS goes down, your workflow goes down. Safecloud has many providers running the same verifiable infrastructure, so jobs can route around outages automatically. And because anyone can contribute capacity, the cost structure has headroom that traditional clouds don't — idle desktops, underused home servers, and open browser tabs can all earn Safebux while doing nothing else.
The core Safecloud storage primitives are live today: encrypted chunk distribution, browser-based Drops, Merkle-verified retrieval, delegated access via signed capabilities. The economic layer that meters payments in Safebux — OCP payment verification, on-chain trustline enforcement, proof-of-storage challenges — is in active development and targeted for v0.5. Safebux economics described on this page reflect the v0.5 design, which the storage layer is already architected to support.
Depending on who you are, Safebox is a different thing. Pick the one that fits.
If you're a creator — podcaster, video-maker, writer, musician, course-seller — the current stack you depend on is rented. YouTube decides what your viewers see. Instagram decides who your followers are. TikTok decides whether your work exists tomorrow. You can be deplatformed by a policy update, an algorithm change, or a mood swing. The platforms own the relationship with your audience; you're just the content supplier.
Safebots gives you a different stack. Your media pipeline, your community, your currency, your site — all yours, all portable, all running on infrastructure you control.
Drop in your full archive. Safebots inventories every video, audio file, article.
Every clip gets searchable text, speaker labels, and timestamps automatically.
AI finds the best 30-second, 60-second, and 3-minute clips inside longer content.
Auto-dub into the languages your audience speaks. Voice cloning optional.
Upload to every platform at once, with metadata, thumbnails, and chapter markers optimized per platform.
On top of the media pipeline, Safebots gives you three things the platforms will never give you:
Patreon rents you a tip jar. Substack rents you a mailing list. YouTube rents you an audience. Safebots gives you the whole stack — and if you ever want to leave, your audience and your data come with you.
Safebox is designed to be run by operators, not just by us. If you want to host a Safebox instance — provide the infrastructure that powers somebody else's workflow — you earn Safebux for every capability call that runs on your hardware. This can be a side business, a primary business, or the foundation of a new company.
Complete the Safebox operator course. Learn the architecture, the security model, and the deployment process.
Form your LLC or equivalent. Safebox operators are independent businesses.
Apply for cloud startup credits. Most operators start with $5K from AWS; aggressive operators stack up to $500K across providers.
Deploy a Safebox instance. Earn Safebux for every workflow that runs on your hardware. Scale as usage grows.
These credit programs are public and stackable. A motivated founder can accumulate several hundred thousand dollars of cloud compute without taking a dollar of equity investment.
Credit availability varies by jurisdiction, stage, and program. Actual awards depend on the program's eligibility criteria at the time of application. Not all credits can be stacked in practice.
The ecosystem has two tokens, and they serve fundamentally different roles.
The Unblockers custodial framework is a formal legal structure that separates the $SAFE instrument from the $SAFEBUX utility token entirely. This separation is deliberate: $SAFEBUX is usable regardless of any $SAFE holder's actions, and the $SAFEBUX economy operates as a functioning utility market whether or not any $SAFE-related event ever occurs. The structure preserves conventional secured-party rights for $SAFE holders under the SAFE note, governed by US contract law.
Formal offering materials, subscription documents, and the custodial agreement are available to accredited and otherwise qualified investors who pass diligence. Reach out and we'll route you to the right materials and the right counsel.
Safebox isn't a single company's infrastructure. It's a network of independent operators, creators, enterprises, and investors — each playing a distinct role, connected by Safebux as the common currency.
The picture above shows the ecosystem. This next one shows what happens when one of those creators, enterprises, or operators actually runs a Safebox workflow — the five structural walls you read about earlier, in motion.
Safebox is live infrastructure, not a whitepaper. The fastest way to figure out what it means for you is a direct conversation — fifteen or thirty minutes, no slides, no pitch deck.
Or reach out directly by role: