Jonathan Mortensen took his time getting to the product, and he said so himself. Asked what prompted him to start Confident Security, he started with the problem.
“I think there’s now a lot of proof points that say privacy is important, but it’s only being magnified with AI.”
Jonathan Mortensen, at 1:13
Jonathan is the chief executive officer of Confident Security, which he has led since November 2024, and a Founder Fellow at South Park Commons (LinkedIn). Before that he spent a year at Databricks as a staff software engineer, folding in the technology of bit.io, the serverless Postgres company he founded in July 2019 and ran as chief technology officer until Databricks acquired it in June 2023. Unite.AI describes bit.io as a multi-cloud, multi-region service that supported hundreds of thousands of databases (Unite.AI). Earlier he founded Gyroscope Software, which BlueVoyant acquired in February 2018, and then led data science and data engineering for BlueVoyant’s threat intelligence work. He started out as a data scientist at Nuna, the health data company, after a PhD in biomedical informatics at Stanford University.
Confident Security came out of stealth on July 17, 2025, with $4.2 million in seed funding from Decibel, South Park Commons, Ex Ante and Swyx. TechCrunch’s headline called it “the Signal for AI,” and the story described its product, CONFSEC, as an end-to-end encryption tool that wraps around foundation models, modeled on Apple’s Private Cloud Compute (TechCrunch). Today the company’s site offers a verifiably private inference API with an OpenAI-compatible interface, built on OpenPCC, the open-source standard it released in November 2025, and it says, “We take financial responsibility for any breach or misuse” (Confident Security).
Where we sit, so you can weigh what follows: YSecurity helps startups pass the security reviews enterprise buyers run, and Confident Security is one of the teams that work with us. Its logo is on our penetration testing page. Jon McLachlan and Sasha Sinkevich host the show together. The episode aired on August 12, 2025, and was recorded in early August, a few weeks after Confident Security came out of stealth. Our companion post, The Health System Security Review Your BAA Won’t Pass, turns the episode’s idea into a plan for digital health founders. This page stays with the tape.
Two sides of the debate
Jonathan counts Confident Security as his third company. The second, bit.io, went to Databricks, and this one, he said, was very much about privacy. He began with the old argument about it.
“And I think that for many years there’s been kind of two sides of the debate around privacy. It’s like, well, what do you have to hide? Privacy is not important, whatever.”
Jonathan Mortensen, at 1:01
For years the worry was a leaked Social Security number or a leaked password. AI adds a second kind of loss, he said, because what you hand a model can be used to train it, and what you hand it is often how you work.
“But now that your privacy, you know, is even more important, because the data that you’re giving to the AI could be used to train the AI, right? And maybe that data is private, like it’s a healthcare record, but maybe that data is also how you do your job.”
Jonathan Mortensen, at 1:25
For a person, that is the fear of training the thing that replaces you. For a business, it’s the fear of handing over the data that sets it apart.
“And it’s certainly maybe on a personal level, but for businesses, they still have highly proprietary data sets that are internal, and they don’t want those to be used to remove their competitive advantage.”
Jonathan Mortensen, at 1:45
No option out there
When he left Databricks, Jonathan went looking for a large model that a business could control and that came with real guarantees. He had worked at a cybersecurity company before, BlueVoyant by his LinkedIn.
“So when I left Databricks, I was very interested in privacy, and I worked at a cybersecurity company before, and just saw that there wasn’t a large model that you could control that gave you actual privacy and security guarantees. There was no option out there.”
Jonathan Mortensen, at 1:55
So he built the option.
“And so I said, why? Why shouldn’t there be something that is really privacy-first AI? And that’s what we built Confident Security to do.”
Jonathan Mortensen, at 2:17
Over the wall
Sasha asked for the problem in a single sentence, and offered one.
“So if we were to boil it down to a single-sentence problem statement, would it be you lose control over data and how the data is being used once you send it to an LLM vendor or LLM provider?”
Sasha Sinkevich, at 2:24
Jonathan agreed, and put it in the image the rest of the episode keeps coming back to.
“Yeah, once you throw it over the wall, you have no idea what’s happening behind the scenes. And they can make you assurances, but those assurances don’t always follow through.”
Jonathan Mortensen, at 2:38
Sasha sharpened it into the difference between a promise and a guarantee.
“So, in other words, there are a lot of contractual commitments and obligations that a vendor might claim or state, that there’s zero retention data, but from a technical point of view, there is no guarantee that that will be the case.”
Sasha Sinkevich, at 2:50
Jonathan’s answer was about incentives. A zero data retention clause is a promise, he said, while the incentive runs toward training on the data, because the open data loses value as every vendor uses it.
“That’s right. And the incentives are not aligned toward that, right?”
Jonathan Mortensen, at 3:05
None of this makes a retention clause worthless. It’s still the first thing a buyer asks for, and the major model providers publish their terms. If you’re the one answering that question for a customer, our post on questionnaire answers that look true but aren’t shows how to state the promise precisely, which providers, what they keep and for how long.
A contractual promise isn’t enough
Sasha laid out what large companies do today when they want AI and can’t risk the data. They run something in-house, so nothing leaves.
“Today, when these enterprises want to use LLMs or AI technology in general, they often have to deploy something in-house in order to guarantee that that data is not being trained on, or there is no retention on that data. But there is a better version of that approach, or there is a better approach in general.”
Sasha Sinkevich, at 3:41
Jonathan’s version of the better approach keeps the model remote and makes the guarantee technical. He picked two big names to show who it’s for.
“If you’re Disney or you’re Pfizer, a contractual promise probably isn’t enough for your proprietary data. And so, yeah, they either have to buy a bunch of GPUs and run it themselves, or figure out some other service that can manage that all for them.”
Jonathan Mortensen, at 4:12
What he’s heard from folks is that running it yourself is easy at the start. One open model on one machine is easy. The cost arrives with everything a real deployment needs.
“Like, just simple open model, it’s like running Ollama. But the second that you want to do anything more complicated, I mean, you have a lot of different model weights, you’re trying to serve it to everyone in your organization, any sort of production-level thing, suddenly, like, that little VM with an attached GPU that was running Ollama is no longer, like, what you want, and you end up spending a lot of money for that.”
Jonathan Mortensen, at 4:44
Ollama is a popular open-source tool for running language models on your own machine (Wikipedia). His point is about scale, not the tool. Serving many models to a whole company is an infrastructure project of its own.
We can’t see the data
Jon put the pitch back to him as he’d heard it, the managed model services companies already use, with rigorous technical controls added for privacy. Then he named the part that matters.
“Because at a very core level, it’s impossible for Confident Security to see the requests, the contents of the requests coming in, right?”
Jon McLachlan, at 5:42
Jonathan confirmed it, and added that he’d been holding the product back on purpose.
“Yeah, I’ve been kind of not directly answering what the product is yet. I’ve kind of been motivating the problem. But yes, we essentially make a guarantee that we can’t see the data”
Jonathan Mortensen, at 5:50
The contracts say the same thing, he said. Confident Security’s liability and indemnification clauses reflect the guarantee, with unlimited liability for data breaches in its contracts. Jon’s reaction was immediate.
“I was about to say, that’s totally unheard of and unprecedented.”
Jon McLachlan, at 6:10
Jonathan’s reasoning is that the paper has to match the system. If the company can’t see the data, it can sign for what happens to it.
“But we can’t see the data. And it feels like if we say that we have a technical control and our contracts don’t reflect it, like, what’s the point?”
Jonathan Mortensen, at 6:14
The company’s site makes the same promise today, in the line quoted at the top of this page. Liability terms are only as good as the rest of the contract, so a buyer will still read them closely. But a vendor offering them is telling you where it thinks the risk sits.
Apple’s reference architecture
Then Jonathan described what the product is.
“So our product is based off the same reference architecture of Apple’s Private Cloud Compute. We call it a provably private AI inference engine. And we use all the same techniques that Apple’s PCC architecture uses.”
Jonathan Mortensen, at 6:21
Apple described Private Cloud Compute on June 10, 2024, as the cloud system behind Apple Intelligence, and set out five core requirements for it: stateless computation on personal user data, enforceable guarantees, no privileged runtime access, non-targetability and verifiable transparency. “Security and privacy guarantees are strongest when they are entirely technically enforceable,” Apple wrote (Apple Security Research).
Confident Security’s site lists the same five requirements and the eight technologies it uses to meet them: Oblivious HTTP, blind signatures, remote attestation, a Trusted Platform Module, a transparency log, secure boot with a hardened operating system, confidential virtual machines and reproducible builds (Confident Security). Most of these have a public definition worth reading: confidential computing protects data while it’s in use, a trusted execution environment is the protected area of the processor where that happens, and Oblivious HTTP lets a request reach a server without any single party seeing both who sent it and what it says.
Jonathan’s plain-language version of all of it fit in three sentences.
“we can’t see your data, we can’t leak your data. Only you can see it, only you can encrypt and decrypt it. But we can run the model.”
Jonathan Mortensen, at 6:40
And the guarantee extends to the model itself.
“So if you had a custom model you wanted to run at scale, we could guarantee that that remains proprietary too.”
Jonathan Mortensen, at 6:49
Swap your endpoint
Jon brought it down to the founders who listen to this show. You’ve built an AI product, you’re selling into a regulated industry, and the security questionnaires keep coming.
“And I’m being bombarded with questions around privacy and security guarantees and technical controls to help protect all of that sensitive data that’s passing through my innovative AI startup, I could use Confident Security to help gain a lot of those technical controls at the LLM level.”
Jon McLachlan, at 7:22
Jonathan said the switch is meant to be small, because the interface is the one most AI products already call.
“Exactly. So if you have those concerns, your customers, you’re in healthcare, finance, legal, you’re selling into healthcare, finance, legal, you can swap your endpoint, right? We are a standard OpenAI API endpoint, right?”
Jonathan Mortensen, at 7:46
That’s the founder’s version of the whole pitch. You keep your product, you change where the model calls go, and the answers on the questionnaire change with them. Our companion post on the health system security review walks through the questions a hospital’s team asks about where your AI sends patient data, and our secure AI development team helps startups get those answers right.
No and no
What changes on the questionnaire, Jonathan said, is that the two questions most frameworks are built on stop having anything to point at.
“So any sort of compliance framework, there’s no at-rest things to worry about, there’s no access control to worry about. And those are kind of the fundamentals of most of the compliance stuff, which is like, where does the data end up? Who can access it? And the answer is no and no.”
Jonathan Mortensen, at 8:17
That’s a strong claim, and it’s scoped to the data passing through the model. Your own application still stores and logs data, your own people still have access, and a reviewer will still ask about both. A SOC 2 report covers those parts of the program. What a provider like this changes is one of the hardest rows on the list, the one about where your prompts go. Our post on the AI security questions enterprise buyers will ask in 2027 has one-sentence answers for that row and the rest.
Encrypted weights
Jon asked about teams that train their own models. Could they bring those too?
“I can actually upload those models into Confident Security.”
Jon McLachlan, at 8:44
They can, Jonathan said, with a person in the loop for now.
“You can. Now, it’s a white glove service right now. Yeah, so it’s not as easy as just clicking a button in the UI. But yes, in fact, you encrypt the weights yourself and then give us the encrypted weights.”
Jonathan Mortensen, at 8:47
The key to those weights travels with the requests, so only the confidential environment ever sees the model in the clear.
“And then when you make requests, you include that decryption key for us to verify, so that the confidential environment can use those weights without showing us the weights, to get it into the confidential environment.”
Jonathan Mortensen, at 8:59
Jon called that critical for business-to-business deals. Confident Security’s site now has a section on it, saying customers can “Host, manage, and even sell your own custom models” with the same guarantees (Confident Security).
Signal for AI
Jon asked about consumers. Jonathan’s answer started with how people talk to these systems.
“Yeah, I think people are increasingly sharing increasingly private data, right? Sensitive personal data, because of the value of the LLM, right? And I think partially because we anthropomorphize it, it’s like a little more human. And the interface is so human.”
Jonathan Mortensen, at 9:25
The signal he’d gotten was that consumers still don’t care that much about privacy, at least not when it means waiting. Most people choose the thing they need now over a privacy cost that arrives later.
“If you have to make a trade, you want something now, you need something now, versus dealing with privacy consequences later, including getting your data trained on, you’re going to make the trade as a consumer.”
Jonathan Mortensen, at 10:07
He’d still like to be the default for the products where privacy is the point, the way Signal made end-to-end encryption the default for messaging.
“It would be awesome, for example, if we were in Signal.”
Jonathan Mortensen, at 10:29
“I’d love to be in a world where everyone gets this level of privacy, where you’re controlling what data you’re giving to whom, and the default is no one else can see it but you.”
Jonathan Mortensen, at 10:44
Jon liked the phrase.
“Signal for AI. I love that. That’s just a nice little one-liner zinger.”
Jon McLachlan, at 10:53
It was already a headline. TechCrunch had used “the Signal for AI” for Confident Security’s launch a few weeks before the recording.
Privacy on the billboard
Sasha asked why privacy moved from the fine print to the front of the ad.
“On billboards, when you see Apple’s billboards, you can see privacy almost usually the first word on the billboard. Why do you think that is the case? Why do people and companies start to care about privacy more so than they used to 10 years ago?”
Sasha Sinkevich, at 11:11
Jonathan’s first answer was the business model. A premium product doesn’t need to make money from your data, and a cheap one often does.
“Well, Apple does it to differentiate itself in the market. I think that’s one major thing. And because they’re a premium product, they’re not getting value from your data, or they don’t need to get value from your data, right? When you sell something cheap, you’re essentially reselling the user to someone else for ads or other reasons.”
Jonathan Mortensen, at 11:28
His second answer was breaches. He pointed to the 2024 attacks on Snowflake customers, which he said came down to two-factor enforcement rather than Snowflake itself. Our blast radius playbook walks through that case: the attackers logged in with stolen passwords to accounts that didn’t require multi-factor authentication. His third answer was AI, and what it makes your data worth to someone else.
“And I was actually talking with someone else recently who wrote a piece on this so directly, which is like, every time you’re making a trade, you trade privacy for, like, some future loss, right? It’s more expensive than you think.”
Jonathan Mortensen, at 12:26
You are the product
Sasha answered with an old saying.
“There is a saying that if you don’t pay for the product, you are the product. And often, if you get service for free, you usually trade something for that free service, and usually that’s your data.”
Sasha Sinkevich, at 12:43
Data as the new oil is an old line by now. The British mathematician Clive Humby is credited with coining “Data is the new oil” in 2006 (Wikipedia). Sasha’s point was that 2025 made it literal for AI, because the open supply is running out.
“We’re recording this in 2025. There are a lot of papers out there that talk about the fact that we’ve exhausted all of the publicly available information for the training, or for the future training, of the models. And at this point, it’s the proprietary data that very few companies have their hands on that is extremely valuable.”
Sasha Sinkevich, at 13:08
Data remains the proprietary thing
Jonathan agreed and took it a step further. He said the newest models are incredibly good, and that in five years they may be close to interchangeable. What a provider will hold then is the data its users gave it.
“And the models otherwise would be identical. And the reason why you stay is because of your data, the special context that they have about you and the special training data that they have. So, as always, data remains the proprietary thing.”
Jonathan Mortensen, at 14:14
That’s the incentive he described at the start, seen from the other side. If your data is what keeps a customer, you want as much of it as you can get. A provider that can’t see it has given that lever up on purpose.
Secure against us
Jon described what that design does to the future. A company can change its terms of service, he said, and decide to monetize the data it already holds. Confident Security can’t, because of how it was built.
“But even Confident Security is putting itself in a position where it will not be able to retroactively change anything. Anything that comes in sounds ephemeral and protected with cryptographic mechanisms that just ensure privacy both today but also well into the future.”
Jon McLachlan, at 14:47
Jonathan explained why it would be impossible. The keys never leave the place the data is processed, and that place doesn’t last.
“Yeah, it would be impossible. We don’t hold the private keys, and the private keys are generated inside of a confidential environment we can’t access. And so once the data is encrypted with those keys, it can only be decrypted in that confidential environment, and that environment is thrown out after the request.”
Jonathan Mortensen, at 15:04
He mentioned the one exception people always raise, and put it where it belongs.
“So yes, we couldn’t log it and then, like, decrypt it later on, unless we had a giant, you know, quantum computer in the future. But that’s several threat models deep.”
Jonathan Mortensen, at 15:21
Jon asked the question every security review comes down to.
“Sure, sure, sure. You know, I guess everything always comes back to the threat model, asking the question, secure against who or what?”
Jon McLachlan, at 15:32
Jonathan’s answer gave this page its title.
“And for us, we’re saying it’s secure against us, right? The primary threat model that we’re selling to have solved is that we can’t tamper with your data. And so all the things that we do make it so that it’s as hard for us to see your data as it would be for any third-party attacker.”
Jonathan Mortensen, at 15:40
Most vendors list outside attackers as the threat and themselves as the trusted party. Putting the operator on the list of threats is the idea behind Apple’s requirement of no privileged runtime access, and it changes what a buyer can check. You stop asking whether the vendor’s staff are trustworthy and start asking whether the system lets them in at all.
Attested to
Sasha restated the claim, and Jonathan added the part that makes it checkable.
“Yeah, so essentially saying nothing in the infrastructure itself can see inside the confidential compute module.”
Sasha Sinkevich, at 15:58
“Yep. And what’s inside the confidential compute module is attested to. So we know exactly what’s running in there. And you can check what’s running in there. And what’s running in there is not log all of your data. That’s the most important thing.”
Jonathan Mortensen, at 16:08
Remote attestation is how a machine proves to someone else what software it’s running, using hardware that signs a measurement of its own state (Wikipedia). TechCrunch described the last step of Confident Security’s design the same way: the software running inference is publicly logged and open to review, so experts can verify the guarantees (TechCrunch). The company’s code for this is on GitHub. Its organization holds the compute node component and libraries for attestation on AMD processors and NVIDIA GPUs (GitHub).
For a buyer, attestation changes the question from whether the vendor promises to whether you can see what’s running, and a security reviewer can actually answer that one.
The crown jewels
Sasha put the episode in business terms. Every company has to adopt AI to keep up, and the safe options have been thin.
“And if you are an existing company and you would like to participate in the future economical benefits of using AI, you have to start adopting. But maybe there are not a lot of good options to do it safely and securely in order to protect the crown jewel, the data sets that you have.”
Sasha Sinkevich, at 16:38
Jonathan agreed, and was direct about the price.
“Essentially, it’s like you need the value of AI, but you’re blocked from adopting it because you don’t want to give out the crown jewels. You can use Confident Security and not have to make that trade-off. Now, just to be clear, we charge a little bit more on a per-token rate for the AI, but I think that that upcharge is way less than the cost of giving up your proprietary data”
Jonathan Mortensen, at 17:05
Then he caught himself mid-thought and landed on a line worth keeping.
“No, it’s good to pay for privacy, I think. It aligns incentives.”
Jonathan Mortensen, at 17:30
It ties back to the start of the conversation. When the customer pays for the privacy, the provider’s business is keeping the data private, not using it. The company’s pricing page describes base fees pinned to current market prices per model (Confident Security).
Everyone was putting stuff out there
Jon agreed it aligns incentives, and looked back at how we got here.
“No one had any idea. Like, there was no foresight into looking into the future and, you know, realizing all of that could be harvested in the future by these AI models that we have today, to actually train models against your voice, against your tone, you know, the essence of who you are.”
Jon McLachlan, at 17:46
He thinks the shift away from that is already underway.
“But it doesn’t mean, like, we have to continue down that road going forward. We can be much more privacy conscious, security aware. And I really feel like that shift is happening right now, right underneath our feet.”
Jon McLachlan, at 18:17
Jonathan said AI makes the trade easier to see, because the value is so obvious that a business can justify paying for it.
“And so it’s like, okay, I’m making a very clear trade, and, like, I know what I want to pay a premium for this thing, because it just gives me so much value.”
Jonathan Mortensen, at 19:22
Crypto agility
Sasha came back to the quantum computer Jonathan had mentioned, and explained why it isn’t a big worry.
“So it’s something that, even though people talk about quantum [breaking] all of the encryption, et cetera, I’m not really concerned about it that much, because if you have crypto agility built into your product, you can adapt to threats fairly quickly.”
Sasha Sinkevich, at 19:53
Jonathan said where Confident Security stands, and what it’s waiting on.
“Yep, that’s right. We’re not post-quantum right now, but once the vTPMs support post-quantum, we’re in.”
Jonathan Mortensen, at 20:08
A vTPM is a virtual Trusted Platform Module, the software version of the security chip that holds keys and measurements for a machine (Wikipedia). Jon asked Sasha to define crypto agility for listeners.
“On a high level, it’s just the ability to plug in any algorithms moving forward, and you can ensure that data is safely guarded using new type of encryption. And you can do it on the fly without breaking changes.”
Sasha Sinkevich, at 20:17
“Super important feature at the cryptography level for any product.”
Jon McLachlan, at 20:33
The textbook definition is the ability to switch between cryptographic primitives (Wikipedia), and the reason it matters is post-quantum cryptography. Our guide to harvest now, decrypt later explains which data is exposed first and puts crypto agility third in a four-step migration plan.
A $22 sale
Jon asked about Jonathan’s proudest day as a founder. The answer came from bit.io, a serverless Postgres company that he said was possibly before its time.
“So the company I did before this was bit.io. It was a serverless Postgres company before its time, possibly, but with the recent acquisition of Neon and Crunchy Data by Databricks and Snowflake, respectively.”
Jonathan Mortensen, at 20:50
Both deals were only a few months old. Databricks agreed to buy Neon in May 2025, for about $1 billion by CNBC’s report, and Snowflake announced its purchase of Crunchy Data in June for about $250 million (Wikipedia, Wikipedia). Jonathan’s proudest moment was much smaller than either.
“But the most proudest moment, I think the team was firing on all cylinders, and we got our first sale for $22. It had just been the culmination of a ton of effort from everyone on the team. I think that was probably my proudest moment.”
Jonathan Mortensen, at 21:25
It would have been monthly recurring revenue, he said, $22 of it. What mattered was that someone paid.
“So we had created something of value, right? Somebody was willing to pay for this thing.”
Jonathan Mortensen, at 21:44
Sasha took the founder’s lesson from it.
“And it’s important to stick with it. It’s important to grind through all of the difficulties and challenges, because let’s be honest, when you start a company, there are a lot of those, and it’s how you react to challenges is what matters.”
Sasha Sinkevich, at 22:17
Jonathan remembered what the months before it felt like, and Jon described what the sale changes.
“Before that first sale, you’re like, are we doing the right thing?”
Jonathan Mortensen, at 22:31
“And then when you land the sale and you get the market confirmation, you start getting the feedback from all of your new customers, that’s really special. It’s an important mark.”
Jon McLachlan, at 22:42
Jonathan made sure the credit went to the team, and explained why he thinks that way.
“Yeah, I played a lot of soccer when I was a kid, and the team analogy is what works for me, right? We’re all playing different positions on the field while trying to score a goal.”
Jonathan Mortensen, at 23:02
On the cusp of accurate enough
Sasha asked about the biggest pain point in using AI responsibly over the next year, the one nobody has addressed. Jonathan started with the word.
“A responsible manner is an interesting word there. But I think that right now we’re on, for a lot of use cases, on the cusp of something being accurate enough.”
Jonathan Mortensen, at 23:39
The newest models had finally convinced people about coding, he said, noisy and imperfect but a net positive. Many other uses are right on the edge, and the work that gets them over it is your own measurement.
“Whether it’s building a system to put in accuracy or fine-tuning your models, coming up with a data set to do evaluations, your own personal evaluations, and not relying on just the benchmarks”
Jonathan Mortensen, at 24:07
The classic line he paraphrased is Goodhart’s law, often stated as “When a measure becomes a target, it ceases to be a good measure” (Wikipedia). A public benchmark is a target for everyone who builds a model. Your own evaluation set, built from your own data, is a measure nobody else is aiming at.
“So I think creating your own benchmarks internally. And I know a lot of folks who are doing that.”
Jonathan Mortensen, at 24:27
Garbage in, garbage out
Sasha tied accuracy back to the data, and the data back to the controls around it.
“And you mentioned accuracy, which is tightly coupled with data inputs. In general, it’s garbage in, garbage out, which is where the proprietary data sets and the quality of the retrieved data makes a lot of sense.”
Sasha Sinkevich, at 24:32
“And it’s a full circle back into the data governance. How do you ensure that data that you share with models stays private and stays secured?”
Sasha Sinkevich, at 24:57
The better your own data, the better your model works, and the more it costs you if it leaks. That’s the same data set Jonathan said you should build your evaluations from, which makes it worth protecting twice.
Chaos for the next year
Jonathan’s other answer was agents.
“Yep. And with this whole agentic thing, I feel like where you put the security controls and how you delegate permissions for what things those agents can access is going to be chaos for the next year.”
Jonathan Mortensen, at 25:07
He’d noticed a wave of identity and access management vendors rebranding for it.
“Actually, there’s so many seem to have just relabeled their IAM product as agentic IAM. Like, how do you even keep track of what agent is doing what, where, and when it should have permission to do it and access what data?”
Jonathan Mortensen, at 25:21
Jon wasn’t sure what to call the new users.
“This new market here, all of these agentic users, they’re really not even users. I’m not sure what to call them. Machines.”
Jon McLachlan, at 25:44
More than a year later, the question is still open. Our posts on why agents need least privilege more than humans ever did, whether you’re actually going to give the agent write access and agents that share one API key take it from there.
The tea company
Sasha had seen this kind of relabeling before, in a different hype cycle.
“There was a tea company that added the word crypto to its name or to its product, and then the valuation of that company just exploded. I feel like we are in a similar space, but in the technology.”
Sasha Sinkevich, at 26:08
The company was Long Island Iced Tea Corp., and the word it added was blockchain. On December 21, 2017, it announced it would rebrand as Long Blockchain Corp., and its stock price spiked as much as 380 percent. Four months later Nasdaq told it the stock would be delisted, and by then it had dropped its plan to buy Bitcoin mining equipment (Wikipedia). The lesson carries over to AI labels. A new word on the pitch deck changes the valuation faster than it changes the product, so a buyer’s security review still has to look at what the product does.
Bought, not sold
Jon asked about the hardest day. Jonathan’s first answer was every day before the first sale.
“Any day before we got the first sale. Every one of those days was so challenging.”
Jonathan Mortensen, at 26:32
The most stressful, he said, were the two acquisitions, because everyone else in the room had done far more of them than he had.
“You know, I’ve sold two companies. The M&A process is certainly pretty stressful.”
Jonathan Mortensen, at 26:52
“You know, everyone else at the table has done N of these, and I’ve done two of them.”
Jonathan Mortensen, at 27:02
Sasha asked what he took from it.
“What’s the biggest learning from that M&A process? You’ve done two of them.”
Sasha Sinkevich, at 27:34
“Well, companies are bought, not sold. That’s the most classic line, right? Don’t seek to get your company sold. Wait for the call. Wait for the call.”
Jonathan Mortensen, at 27:38
The rest of his answer was negotiation theory. A BATNA is the best alternative to a negotiated agreement, the course you can take if the talks fail (Wikipedia).
“And the most important thing with any negotiation is to have a BATNA, the best alternative to a negotiated agreement. Because if you don’t have the BATNA, particularly for those situations, you have no way to say no, essentially, right?”
Jonathan Mortensen, at 27:51
His example was a buyer offering a dollar with nobody offering two. Sasha finished the thought.
“The market value is what the highest bidder is willing to pay.”
Sasha Sinkevich, at 28:15
“And unfortunately, like, it’s a trade, and in those trades, you have to know what your value is and have alternatives.”
Jonathan Mortensen, at 28:35
It’s the same lesson as the rest of the episode, in a different setting. In a negotiation, and in a contract with an AI vendor, the party with no alternative takes whatever terms it’s offered.
A catalyst for privacy
Jon asked what legacy Jonathan would like to leave, in business or in life. He answered for the company.
“I’d love for Confident Security to be a catalyst for having a bunch more privacy around AI.”
Jonathan Mortensen, at 28:57
He meant all of it, the model vendors, the GPU resellers, the software platforms and the big businesses running their own GPUs, doing their inference privately, whether Confident Security provides it or spurs everyone else into it.
“I think everyone will benefit from privacy, or at least the choice around privacy and what they share.”
Jonathan Mortensen, at 29:28
Regulation, or a leak
Sasha asked what will actually move businesses and consumers toward privacy.
“What do you think will incentivize businesses or consumers to opt in for more services that are privacy aware or built around privacy?”
Sasha Sinkevich, at 29:32
Jonathan’s first answer was regulation, with a caution about how regulators treat the tools.
“I think regulations is going to be one. Now, privacy is like a double-edged sword, right? In the same way that encryption generally is kind of a double-edged sword around regulatory frameworks, right? A lot of people don’t want encryption. I tend to be on the side of encryption is better.”
Jonathan Mortensen, at 29:54
His second answer was an incident nobody wants.
“there’s going to be some situation where someone accidentally retained the data that they said they weren’t going to, and then either accidentally trained on it or someone leaked it, and it was super proprietary, but they needed the value from AI.”
Jonathan Mortensen, at 29:55
Sasha added the engineering answer to that fear. If the data is encrypted from the start, a backup that outlives its welcome is still unreadable once the key is gone.
“you can guarantee secure deletion by destroying the keys.”
Sasha Sinkevich, at 30:49
The practice has a name, crypto-shredding, which renders encrypted data unusable by deleting the keys (Wikipedia). Jonathan agreed, and said regulation would still be the main push, because companies can put a number on what their data is worth.
“And again, I think corporations kind of understand, unlike consumers, can kind of quantify the value of their proprietary data and make informed business decisions based on that.”
Jonathan Mortensen, at 30:59
Differentiators
Sasha named the third driver, the one founders feel first.
“We see it more and more often in the space, in the marketplace, where the security and privacy controls are becoming differentiators. When two products are being considered for the same function, products with more security and more privacy built into the product tend to win contracts over those that don’t have those.”
Sasha Sinkevich, at 31:13
“Great. I want that to create that competitive pressure.”
Jonathan Mortensen, at 31:34
This is the part of the episode closest to our own work. In an enterprise deal, the security review is often where two similar products separate, and the product that can answer the hard questions with evidence is usually the one that gets the contract.
Maybe you shouldn’t put it on the internet
Jon told a story on himself.
“When I was in graduate school, I received a phone call from a news reporter who wanted to comment. She looked me up, and she saw I was a security person at the University of Minnesota.”
Jon McLachlan, at 31:46
The reporter asked about people posting on Facebook and then suffering a huge data leak, one of the site’s first.
“And I said something along the lines of, well, if you want your stuff private, maybe you shouldn’t put it on the internet.”
Jon McLachlan, at 32:15
Jonathan allowed that it was true. Jon has since changed his mind about the answer.
“There’s truth to this, but it’s also dismissive, I think, and almost blaming the victim. I think that there are ways to build technology that respects people’s privacy.”
Jon McLachlan, at 32:23
Jon said he’s happy to pay a little every month for a service that adds value and doesn’t advertise at him, and the same goes for AI. Jonathan raised the catch.
“Now, this assumes that you have the money to pay for the privacy versus the free version, right? And you need this technology to not get left in the dust.”
Jonathan Mortensen, at 33:17
“I think that’s a very important question, and I could have a whole show just on that one question.”
Jon McLachlan, at 33:27
It’s a fair question to leave open. Privacy you pay for works best for the people who can pay, and Jon thought it deserved a show of its own.
Trust past J-Mo
Jon asked what advice Jonathan would give his younger self. He started with a motto.
“I think I like to have a phrase which is like, trust past J-Mo, which is like, I probably made a decision in the past that made sense.”
Jonathan Mortensen, at 34:11
“But maybe there should also be a trust future J-Mo line.”
Jonathan Mortensen, at 34:20
Then three pieces of advice. For the companies, spend sooner on selling.
“I’d go back and be like, spend more money on marketing and sales.”
Jonathan Mortensen, at 34:43
For college, take the class that has nothing to do with the degree.
“On a personal level, if I go back to college years, I would say take more classes for fun.”
Jonathan Mortensen, at 34:46
“I should have stayed in that aerospace class. That was really interesting.”
Jonathan Mortensen, at 35:03
And the last one surprised the hosts, from a man who’d just credited soccer for how he thinks about teams.
“Or play another team sport that is less damaging to your musculoskeletal system.”
Jonathan Mortensen, at 35:24
What happened after the tape
The episode aired on August 12, 2025. In September Confident Security launched its blog, The Dead Drop, and in October Jonathan announced a month of open-source releases, one a week (LinkedIn). First came twoway, an encrypted request and response library built on hybrid public key encryption. Then go-nvtrust, a Go library for NVIDIA GPU and NVSwitch confidential computing attestation. Then Go implementations of Binary HTTP and Oblivious HTTP, the protocol Jonathan said he first learned about in 2024 while reading Apple’s Private Cloud Compute post (LinkedIn). Oblivious HTTP is RFC 9458, published in January 2024 (Wikipedia).
On November 5, 2025, the month ended with OpenPCC, which Jonathan called an open-source standard to protect data from LLMs. It’s released under the Apache 2.0 license with no contributor license agreement, a choice he said makes it possible for OpenPCC to become a standard.
I'm thrilled to introduce OpenPCC, an open-source standard to protect data from LLMs.
Jonathan Mortensen · November 5, 2025
Axios had the launch as an exclusive the same day, describing the team as former Apple and Databricks engineers (Axios). The OpenPCC repository describes a framework inspired by Apple’s Private Cloud Compute but “fully open, auditable, and deployable on your own infrastructure,” using encrypted streaming, hardware attestation and unlinkable requests, and it recommends routing requests through an Oblivious HTTP relay run by a third party (GitHub). The repository had 956 stars when we checked in November 2026. CONFSEC, the company’s managed service, is based on it.
In December Jonathan sat down with Unite.AI. His answer to why AI needs a different approach to privacy was the episode in two sentences: “trust isn’t enough. They need proof” (Unite.AI). He put it more bluntly on LinkedIn the next day.
Here's a hot take: privacy should work like math.
Jonathan Mortensen · December 4, 2025
That’s the thread from the tape to today. In August 2025 Jonathan described a service built so its operator can’t see the data and contracts that sign for it. By the end of the year he had published the pieces as open source, so anyone can check the work.
Did you catch it? A six-question quiz
Six questions from the episode. Each answer links the moment in the transcript.
Quiz · six questions
Did you catch it?
Pick an answer for each question, then check your score.
-
Whose reference architecture did Jonathan say Confident Security's product is based on?
- A database company's
- Apple's Private Cloud Compute
- A chip maker's reference design
b. "So our product is based off the same reference architecture of Apple's Private Cloud Compute." Transcript, 6:21.
-
Which two questions did Jonathan say most compliance frameworks come down to?
- Who signed it, and when
- How fast you respond, and to whom
- Where the data ends up, and who can access it
c. "which is like, where does the data end up? Who can access it? And the answer is no and no." Transcript, 8:28.
-
How does a customer's own model stay private, by Jonathan's account?
- The customer encrypts the weights and sends the key with requests
- The model runs only on the customer's own GPUs
- The weights are split across several vendors
a. "But yes, in fact, you encrypt the weights yourself and then give us the encrypted weights." Transcript, 8:53.
-
Who did Jonathan say the system is secure against, as its primary threat model?
- Nation states only
- Confident Security itself
- A future quantum computer
b. "And for us, we're saying it's secure against us, right?" Transcript, 15:40.
-
What was bit.io's first sale worth?
- $22
- $2,200
- $22,000
a. "the team was firing on all cylinders, and we got our first sale for $22." Transcript, 21:27.
-
What did Jonathan call the most classic line about selling a company?
- Always run a process
- Price is what you pay
- Companies are bought, not sold
c. "Well, companies are bought, not sold. That's the most classic line, right?" Transcript, 27:38.
Over the wall, or provable?
Eight questions on what happens to your customers’ data when your product sends it to an AI model. Each one links the part of the episode it comes from.
Scorecard · eight questions
Over the wall, or provable?
Answer for the product you ship today, not the plan. If two answers fit, pick the lower one.
-
Do you know every party that can see a customer's prompt?
- Not really
- We know our model provider
- Every party is listed, including logging and monitoring tools
"Yeah, once you throw it over the wall, you have no idea what's happening behind the scenes." See Over the wall.
-
What stops your model provider from keeping or training on that data?
- We assume it doesn't
- A zero data retention or no-training clause
- A clause, plus a technical control we can show a buyer
"If you're Disney or you're Pfizer, a contractual promise probably isn't enough for your proprietary data." See A contractual promise isn't enough.
-
Where do prompts end up at rest?
- We don't know
- Our logs and our provider's, for a set number of days
- We can name every store and its retention, or there are none
"And the answer is no and no." See No and no.
-
Who can read a prompt while it's being processed?
- Engineers at more than one company
- A small, named group, and access is logged
- No one, and the system is built to prove it
"And so all the things that we do make it so that it's as hard for us to see your data as it would be for any third-party attacker." See Secure against us.
-
Can a buyer check what software handles their data?
- No
- They can read our security documentation
- They can verify an attestation or a public log
"So we know exactly what's running in there." See Attested to.
-
Do your contracts match your technical controls?
- We've never compared them
- Mostly
- Every promise in the contract points at a control we can show
"But we can't see the data." See We can't see the data.
-
How do you know a model is accurate enough for your customers?
- Public benchmarks
- Spot checks by the team
- Our own evaluation set, built from our data
"So I think creating your own benchmarks internally." See On the cusp of accurate enough.
-
Could you swap the encryption your product uses without breaking clients?
- No
- With a rewrite
- Yes, it sits behind one interface
"And you can do it on the fly without breaking changes." See Crypto agility.
Your customers' data probably goes somewhere you can't fully describe. Start with two moves: list every party that sees a prompt and how long each keeps it, and read each provider's retention and training terms.
You have the clauses. Close the gap between them and the system next: point every contract promise at a control you can show, and ask your providers what a buyer can verify for themselves.
You can probably show a buyer where the data goes and who can see it. Keep it that way as you add models and vendors, and put the cryptography behind one interface so the next change is a configuration, not a rewrite.
How many copies of a prompt?
Every party that keeps a copy of a prompt is a place a buyer will ask about. Put in your own numbers.
Calculator
How many copies of a prompt?
Three estimates: how many prompts your product sends to a model each day, how many parties keep a copy (your own logs, the model provider, a monitoring tool), and how many days each keeps it.
On a typical day about 450,000 copies of your customers' prompts sit at rest in 3 places, and 5,475,000 get written in a year. With a model provider that can't see or keep them, the copies at rest drop to 300,000.
A rough model, not a measurement. It counts the model provider as one of the parties and assumes each party keeps every prompt for the full period. Your own logs are usually the easiest copies to shorten, and every copy you remove is one less answer on a security questionnaire.
From Stanford to OpenPCC
Everything on this page sits on one timeline, from Jonathan’s PhD to OpenPCC. Filter it by thread.
Timeline · 2006 to 2025
From Stanford to OpenPCC
Filter by thread. Dates are from the public record except where marked as part of this show.
- Data is the new oil
Clive Humby is credited with coining the phrase (Wikipedia).
- Stanford
A PhD in biomedical informatics, to 2016 (LinkedIn).
- Nuna
A data scientist at the health data company, to February 2017 (LinkedIn).
- Gyroscope Software
Jonathan's first company, as founder and chief technology officer (LinkedIn).
- Long Blockchain
A tea company adds blockchain to its name, and its stock spikes as much as 380 percent (Wikipedia, on this show).
- BlueVoyant
Gyroscope is acquired, and Jonathan leads data science and data engineering for threat intelligence (LinkedIn).
- bit.io
A serverless Postgres company, with Jonathan as founder and chief technology officer (LinkedIn, on this show).
- Databricks
bit.io is acquired, and Jonathan stays a year as a staff software engineer (LinkedIn).
- Oblivious HTTP
RFC 9458 is published (Wikipedia).
- South Park Commons
Jonathan becomes a Founder Fellow (LinkedIn).
- Private Cloud Compute
Apple publishes the design and its five core requirements (Apple Security Research).
- Confident Security
Jonathan's role as chief executive officer begins, by his LinkedIn (LinkedIn).
- Databricks and Neon
Databricks agrees to buy the serverless Postgres startup (Wikipedia).
- Snowflake and Crunchy Data
Snowflake announces it will buy the Postgres provider (Wikipedia).
- Out of stealth
$4.2 million in seed funding, and "the Signal for AI" (TechCrunch).
- Episode 75 airs
"And for us, we're saying it's secure against us, right?" (Transcript).
- The Dead Drop
Confident Security launches its blog (LinkedIn).
- A month of announcements
It starts with twoway, an encrypted request and response library (LinkedIn).
- go-nvtrust
A Go library for NVIDIA GPU confidential computing attestation (LinkedIn).
- Binary HTTP
A Go implementation of the message format (LinkedIn).
- Oblivious HTTP
A Go implementation of RFC 9458 (LinkedIn).
- OpenPCC
The open-source standard, under Apache 2.0 (LinkedIn, Axios).
- Trust isn't enough
Jonathan's Unite.AI interview on OpenPCC (Unite.AI).
What to do this week
Five things, in the order Jonathan’s argument suggests.
- List every party that sees a prompt. Write down each place a customer’s prompt goes when your product calls a model, including your own logs and any monitoring tool, and how long each keeps it. The scorecard above is a quick first pass, and the calculator shows what each copy adds up to.
- Point every promise at a control. For each line in your contracts and security questionnaires about AI, retention or training, write the control that keeps it. Where there isn’t one, change the system or the sentence. Our post on questionnaire answers that look true but aren’t shows how to word the AI answers precisely.
- Ask your providers what you can verify. Ask each model provider the two questions from the episode, where the data ends up and who can access it, and then ask what a buyer can check for themselves, such as an attestation, a public log or published terms. Our health system review guide has the questions a hospital’s security team asks about AI vendors.
- Build your own evaluation set. Collect a few hundred real examples from your own data, with the answers you expect, and run every model change against them before it ships. It’s the measure no public benchmark can be tuned to.
- Put your cryptography behind one interface. Keep algorithm choices in configuration so the post-quantum change, when it comes, is a setting and not a rewrite. If you’d like a second pair of eyes on any of it, book 15 minutes with us.