The Spaces app — default configuration
This documents the out-of-the-box configuration of the first-party Spaces app — which of the platform's privacy mechanisms it turns on by default.
It is one app's configuration, not a platform property. The platform supports the full stack (see Privacy tiers); this page records only what Spaces, as shipped, enables. Any other app built on the runtime makes its own choices.
What the Spaces app enables by default
Mechanisms are defined in Privacy tiers; this table is only the first-party app's setting for each.
| Mechanism | Spaces app default | Turn it on by |
|---|---|---|
| Foundation — admission gate, egress-lock, content-blind storage, signed + reproducible build, key confinement | On — structural, cannot be disabled | — |
| Server attestation (Nitro enclave) | Off | "Run this Space inside the enclave" — opt-in per Space |
| Client verification (external verifier) | Off | Install the Windows verifier extension, or run the verifier tool |
| Client attestation (hardware) | Off — not shipped | — (Design) |
| OHTTP (network-metadata) | Off by default — shipped | "Hide my IP" toggle (sticky, per device). Routes all app→AWS traffic through a pinned L1.5 frame + an attested relay (GCP Confidential Space) so no party sees both your IP and your rooms — see Privacy tiers |
| Client shaping | Off — not shipped | — (Design) |
| Notifications (content-free push) | Off | Enable push on an installed PWA — opt-in per install |
In mode terms
So the first-party Spaces app ships at the Baseline mode (Privacy tiers §5) — the always-on foundation, with the enclave, the verifier, and push each available opt-in per Space or per device. Turning any of them on moves that Space up the ladder (Verified → Attested → …), with the trades named in Privacy tiers §7.
The foundation is not a choice — it is structural and holds for every Space regardless of these settings. What this page records is only which of the optional mechanisms are on by default, and Spaces leaves them off so the app stays frictionless while the stronger tiers remain one opt-in away.
Update rule: when the Spaces app changes which mechanisms it enables by default, update this page only — the platform's capabilities live in Privacy tiers and Status and are unaffected.
Machine-readable source: spaces-app-defaults.md · Generated 2026-08-29T18:46:30Z · build f3ff88cc · every doc in one fetch: llms-full.txt (HTML) · ← privacy-tiers · identity-and-admission →