Hosted private beta
Hosted Witbitz is invite-only while the platform contract settles. The docs and API contracts are public; tenant keys are gated.
This page is the operating model for builders using Witbitz-hosted infrastructure.
What you get
| Surface | Status |
|---|---|
| Spaces app | Live |
/space async runtime |
Live |
Tenant-keyed /v1 API |
Private beta |
| OpenAPI production spec | Public |
| Full design OpenAPI | Public, status-labelled |
| Owner rule | Built, opt-in, not default |
| Bridge API | Early preview |
Access
The access page can redeem an access code and create a tenant key pair:
https://witbitz.chat/access
Keys are shown once. Secret keys are server-side only. Publishable keys are browser-safe identifiers for public reads and funnel-entry writes, but they do not authenticate an end user.
If you do not have an access code, email:
hello@witbitz.chat
API contract
The production /v1 API is documented openly:
https://api.witbitz.chat/v1/openapi.json
https://api.witbitz.chat/v1/openapi.full.json
https://api.witbitz.chat/v1/
During private beta, the contract may change in coordination with invited integrators. Treat openapi.json as the
production callable surface and openapi.full.json as the broader design map.
Read: Platform API
Hosted trust evidence
The hosted mode is designed to be checked from outside:
| Evidence | Where |
|---|---|
| Admission gate refuses unauthorized reads/writes | Verify it yourself |
| Stored ledger is ciphertext | op:'sealed' |
| App egress is browser-enforced | Content-Security-Policy |
| Deployed render build is signed | /cert.json |
| Published source reproduces the deployed hash | /source.tar.gz and Test 7 |
The attested server tier is built and independently verifiable, but ordinary hosted production Spaces do not run inside an enclave today.
Read: Status, Trust model
Operational boundaries
Hosted Witbitz can still see metadata:
- room existence
- request timing
- ciphertext sizes
- billing/metering events
- transient identity during gated verification
Hosted Witbitz cannot read the sealed ledger at rest because there is no operator recovery recipient.
When hosted is not enough
Use on-prem when you need:
- customer-controlled model calls
- customer-owned object storage and records
- customer IdP as the only identity authority
- local backup, retention, and logs
- no Witbitz-operated runtime in the path
Read: Enterprise and on-prem
Machine-readable source: hosted-private-beta.md · every doc in one fetch: llms-full.txt (HTML) · ← deployment-options · on-prem →