Show me: what happens to a sentence you write in Storyline

For two posts I argued that confidential AI has to be provable, not promised. The fair reply in my inbox was two words: show me.

So here is what actually happens to a sentence you write in Storyline.

Storyline is a writing app for work that cannot leak, for the therapist keeping session notes, the lawyer drafting privileged text, the inventor describing an unfiled idea, the screenwriter guarding a script. The privacy is not a page in a settings menu. It is the architecture.

There is no Storyline server. None. Your manuscript lives in your own iCloud and on your own devices. When you use an on-device model, nothing leaves the machine. When you connect your own provider key, the request goes straight from your device to that provider over TLS, and Storyline is never in the middle. There is no backend to log your work, lose a key from, or be asked to hand it over.

At rest, your text sits under a vault. The passphrase is stretched with Argon2id, content is sealed with AES-GCM, and each sealed unit is bound to its own context, so a file lifted from one place cannot be replayed into another. A wrong passphrase is told apart from real corruption before a single byte of content is touched.

Here is the part I care about most. Every time confidential content is opened, exported, or sent to a model, Storyline records it in a tamper-evident audit log. The log is a hash chain. Each entry is signed by a key that is generated inside the Secure Enclave and never leaves it. The head of the chain is pinned outside the file, so a deleted or rewritten history is detectable, and it is co-signed across your devices. You can verify that chain yourself. Not on a dashboard I control. On your own, even against me.

And it fails safe. If the leak check cannot run, it returns unverified rather than a convenient all-clear. It refuses to open privileged content under a debugger or on a jailbroken device. The default is to flag what it cannot prove, not to paper over it.

To keep myself honest, I review the whole security surface like an attacker would and fix what that turns up. Strong at rest is the easy thing to claim and the hard thing to earn.

Promised versus provable was the standard. This is the machinery under it.

Still early, and there is more to harden. But the parts that matter, you can check for yourself, which was the entire point.