# Hosted private beta

Hosted Witbitz is invite-only while the platform contract settles. The docs and API contracts are public; tenant keys
are gated.

This page is the operating model for builders using Witbitz-hosted infrastructure.

---

## What you get

| Surface | Status |
|---|---|
| Spaces app | Live |
| `/space` async runtime | Live |
| Tenant-keyed `/v1` API | Private beta |
| OpenAPI production spec | Public |
| Full design OpenAPI | Public, status-labelled |
| Owner rule | Built, opt-in, not default |
| Bridge API | Early preview |

## Access

The access page can redeem an access code and create a tenant key pair:

```text
https://witbitz.chat/access
```

Keys are shown once. Secret keys are server-side only. Publishable keys are browser-safe identifiers for public reads
and funnel-entry writes, but they do not authenticate an end user.

If you do not have an access code, email:

```text
hello@witbitz.chat
```

## API contract

The production `/v1` API is documented openly:

```text
https://api.witbitz.chat/v1/openapi.json
https://api.witbitz.chat/v1/openapi.full.json
https://api.witbitz.chat/v1/
```

During private beta, the contract may change in coordination with invited integrators. Treat `openapi.json` as the
production callable surface and `openapi.full.json` as the broader design map.

Read: [Platform API](./api-reference.md)

## Hosted trust evidence

The hosted mode is designed to be checked from outside:

| Evidence | Where |
|---|---|
| Admission gate refuses unauthorized reads/writes | [Verify it yourself](./verify.md) |
| Stored ledger is ciphertext | `op:'sealed'` |
| App egress is browser-enforced | Content-Security-Policy |
| Deployed render build is signed | `/cert.json` |
| Published source reproduces the deployed hash | `/source.tar.gz` and Test 7 |

The attested server tier is built and independently verifiable, but ordinary hosted production Spaces do not run inside
an enclave today.

Read: [Status](./status.md), [Trust model](./trust-model.md)

## Operational boundaries

Hosted Witbitz can still see metadata:

- room existence
- request timing
- ciphertext sizes
- billing/metering events
- transient identity during gated verification

Hosted Witbitz cannot read the sealed ledger at rest because there is no operator recovery recipient.

## When hosted is not enough

Use on-prem when you need:

- customer-controlled model calls
- customer-owned object storage and records
- customer IdP as the only identity authority
- local backup, retention, and logs
- no Witbitz-operated runtime in the path

Read: [Enterprise and on-prem](./on-prem.md)