Full Control

Deploy code on customer infrastructure while maintaining cryptographic billing control. Data never leaves customer network. Vendor retains payment enforcement.

The Impossible Contradiction

Enterprise customers demand control. They want:

• On-premises deployment — Code runs on their servers, behind their firewall
• Data sovereignty — Sensitive data never leaves their network
• Air-gapped operation — No mandatory cloud dependencies
• Zero vendor visibility — Vendor cannot see usage, data, or access patterns

But vendors need to charge for usage. Traditional licensing creates an unsolvable conflict:

Healthcare won't use cloud ML models (HIPAA). Financial firms won't send trading data to SaaS (compliance). Defense contractors can't upload classified data (ITAR). Government agencies mandate on-prem (FedRAMP Moderate/High).

Result: Vendors turn down massive contracts because they can't solve this contradiction.

Cryptographic Billing Enforcement

PRIVATE.ME breaks the trade-off with Xpass: billing enforcement embedded in the cryptography itself. Not policy-based. Not tracking-based. Mathematical.

How It Works (Simple)

• Customer gets Share 1 — useless alone (information-theoretic guarantee)
• Vendor holds Share 2 — delivered only if payment current
• Code runs on customer infra — execution, data, everything stays on-prem
• Billing is cryptographic — payment stops → Share 2 delivery stops → code stops
• No usage tracking needed — vendor doesn't see what customer does with it

Technical Architecture

Xpass uses XorIDA threshold sharing to embed billing inside the cryptography. No separate billing layer. No API keys. No usage tracking. The split itself is the enforcement mechanism.

Code Example

// Vendor: Build and deploy to customer infrastructure
import { ghostBuild } from '@private.me/xghost';
import { createConnectionId, splitForConnection } from '@private.me/xpass';

// Step 1: Build ghost (XorIDA split)
const mlModel = `
  return {
    predict: (features) => {
      // Proprietary ML model (never exposed)
      return trainedModel.infer(features);
    }
  };
`;

const ghost = await ghostBuild({
  source: new TextEncoder().encode(mlModel),
  exports: ['predict'],
  n: 2, // 2-of-2 threshold
});

// Share 1 → Customer's on-prem Docker container
// Share 2 → Vendor server (delivered via Xpass)

// Step 2: Create connection ID
const connId = await createConnectionId(
  vendorDID,
  customerDID,
  'ml-inference'
);

// Step 3: Generate and split connection secret
const secret = generateConnectionSecret(connId.value, 1);
const shares = await splitForConnection(
  secret.value.secret,
  connId.value,
  secret.value.epoch
);

// Distribute Share 2 (Share 1 already on customer infra)

// Customer: Runs on their infrastructure
import { createGhost } from '@private.me/xghost';

// Initialize ghost (Share 1 bundled in deployment)
const ghost = await createGhost({
  customerShare: share1,   // From Docker image
  manifest,
  server: vendorServer,    // Gets Share 2 if payment current
  did: customerDID,
  tier: 2,                // Xpass billing enforcement
  tier2Config: {
    connectionId: connId,
    shares: [shares.share1, shares.share2],
    epoch: shares.epoch,
  }
});

// Call ML model (on customer infrastructure)
const patientData = loadFromHIPAADatabase(); // Stays on-prem
const prediction = await ghost.call('predict', patientData);

// Data never left customer network
// Vendor never saw inputs or outputs
// Billing still enforced (payment required for Share 2)

Real-World Applications

What This Enables

vs Traditional On-Prem Licensing

Deployment Models

Three integration tiers based on customer requirements:

Economic Impact

Xpass unlocks contract values that were previously impossible:

• Healthcare AI: $15-50K/month per hospital. 500 hospitals = $7.5-25M ARR. Previously: $0 (wouldn't deploy to cloud).
• Trading Algorithms: $25-100K/month per hedge fund. 50 funds = $15-60M ARR. Previously: $0 (wouldn't share trade data).
• Government SaaS: $100-500K/year per agency. 20 agencies = $2-10M ARR. Previously: $0 (FedRAMP on-prem required).
• Industrial OT: $50-200K/year per factory. 100 factories = $5-20M ARR. Previously: $0 (air-gapped PLCs).

Total addressable: Contracts that were impossible to close become standard deployments. No product compromise. No usage visibility sacrifice. Pure cryptographic enforcement.

Performance

Overhead: ~75µs per call (reconstruction). Negligible for ML inference (typically 10-100ms), simulations (seconds), or batch processing (hours). Share delivery amortized over 24-hour epoch.

Implementation

Two integration paths depending on your deployment model: