Encrypted analytics platforms, compared

TEEs come closest to Blind Insight on real-time speed — and TEE.fail (October 2025) extracted secrets from fully patched Intel and AMD chips using under $1,000 of hardware. Unlike trusted execution environments, which require specific CPU hardware and were shown vulnerable to a DDR5 memory-bus attack (TEE.fail, October 2025), Blind Insight is pure software with no hardware trust dependency. For the full breakdown of each approach, see our PETs guide; for FHE's cost model in depth, start here.

• MongoDB Queryable Encryption supports equality and range in general availability; prefix/suffix/substring matching are public preview, not production-ready; it's locked to MongoDB.
• CipherStash supports equality, range (order-revealing encryption, not FIPS/NIST), and fuzzy/free-text search via encrypted Bloom filters — but no documented aggregate operators (sum/avg/count).
• Duality Technologies is FHE-based: training and inference on encrypted data exist, but for limited models and data volumes — DARPA is funding the work to make them fast.
• Paperclip SAFE comes from 35 years in document management, mostly insurance; it's now marketing encryption-in-use plus AI. Its searchable encryption is string matching only — equality, prefix, and suffix — with no ranges, aggregates, fuzzy matching, model training, or LLM inference.

Sources: MongoDB — Queryable Encryption supported operations; CipherStash — searchable encryption concepts; Duality — DARPA contract announcement; Paperclip SAFE (operator set: Blind Insight evaluation, September 2026 — not publicly documented); TEE.fail. The "government crypto standards" row reflects whether a vendor's documented primitives are NIST-approved; order-revealing encryption and current FHE schemes are not. Verified September 2026.

Double the records produced roughly 1.7× the median latency — query latency scales sub-linearly with record count.

Per-record scoring after training runs about 8 milliseconds. A scaling sweep from 50,000 to 1 million records showed the data grow 20× while training time grew roughly 9× — sub-linear, not flat. The public demo dataset ships at 600,000 records, so the shape of that result is reproducible outside our internal benchmark. The reason it scales this way: training runs as a fixed set of encrypted aggregate count() queries, and the number of those queries is set by the model's shape — not by how many rows you have. For FHE's cost model in depth, read why most teams don't need it; for the library itself, see BlindML.

This isn't an approximation or a lossy trade-off. An aggregate count over encrypted records returns the same number as a count over the plaintext version of those records — the math is identical; only the storage format differs. Since Naive Bayes, decision trees, and logistic regression all train from aggregate counts, a model trained on encrypted data learns the exact same decision boundaries as one trained on plaintext. Measured F1 delta between encrypted and plaintext training: 0.0, on those supported training algorithms — we're not claiming that for every model architecture, only the ones that train from aggregates.

42% of companies abandoned most of their AI initiatives in 2025 — up from 17% the year before — citing cost, data privacy, and security risk as the top reasons. That's the ROI problem hiding inside every agentic AI roadmap: the moment a model can act on customer data, someone has to prove a rogue agent can't exfiltrate it, reach the wrong field, or keep acting after the ticket closed. Most orgs can't. So the project stalls at legal review — not because the model failed, because nobody could bound what it touched.

Here's the mechanism: an agent talks to BlindInsightOrchestrator, not your database. The proxy puts exactly the keys the grant allows on the agent's keyring — query keys by default, a decryption key only for a field someone explicitly let it decrypt — scoped to that session, nothing else, and nothing after the session ends. Every call is logged: which key, which query, which identity. The LLM sees aggregate counts and ratios, never a record. Prompt injection can still trick an agent into asking a bad question; it can't make the agent decrypt a field it was never granted. Zero trust enforced by cryptography, not policy. Centralized key custody breaks the trust assumption. Blind Insight doesn't have your keys. How Blind(L)LM works →

What we guarantee is narrow and absolute: the server only ever sees encrypted data, and it never holds a key. Everything else on this page — k-anonymity gates, field-level grants, audit evidence, which regulation you can point at — depends on configuring it properly. Our privacy engineer Cameron wrote the compliance playbook for GDPR, HIPAA, and DORA that says exactly how. It isn't legal advice, and it says so.

Phrase and free-text search on encrypted fields is real, but it runs at batch and analytical speed today — roughly ten seconds warm on a 10,000-record field in our own measurements, longer cold. If you need interactive typeahead over free text, this isn't that yet.

For fields with phrase search enabled, the server stores keyed token hashes and the position of each token — a weaker leakage profile than a plain equality field, where only the whole value is ever compared. We'd rather state that plainly than let you find it later.

Blind(L)LM answers questions from aggregates over structured fields; it does not read or search free text.

The 1-million-record training benchmark on this page was run internally. The public, reproducible demo dataset ships at 600,000 records, so anyone evaluating us can rerun the shape of that result themselves.

More questions — pricing, deployment, DORA and HIPAA — are answered on the FAQ page. Definitions for each technique live in the PETs guide. The configuration side — k-anonymity tiers, default-deny access, evidence packs — lives in the compliance playbook.