AI agents are being handed work that touches regulated data, such as patient records, client files, and payroll. A team putting an agent to work needs the data protected while it’s computed on, the agent’s keys out of its reach, limits on what it can do, a record an auditor can check, and encryption that holds up for decades. Most tools cover one of those, and teams stitch the rest together.
OpenMatter® covers all of them in one platform and runs it from one console, Datavizor™. This week’s article walks through each part of the platform and what it’s built on. With one key system and one record underneath, a team has fewer vendors to trust and no separate logs to reconcile. That’s what makes OpenMatter, matter. Now more than ever.
Stay up to date as we build the infrastructure layer for secure AI collaboration:
OpenMatter is chairing the Decentralized AI Agent Alliance’s Agentic Privacy & Security subgroup. Our next meeting will be held on October 21 at 1pm EDT, and every other Wednesday thereafter. Please join us.
If you’re curious what DAIAA is all about, you can check out their YouTube for a full archive of meeting recordings.
Why OpenMatter Is One Platform Instead of Six Tools
What an Agent on Sensitive Data Needs, and How Our Layers Fit Together
One Agent, Six Needs
Picture an agent working for a hospital research group. Its job is to compare treatment outcomes with a partner hospital, ask a language model to draft a summary, and pull drug-interaction data from an outside website.
The job comes with six needs:
Private compute. The joint analysis needs both hospitals’ patient records, and neither hospital can hand its records over.
Keys out of reach. The model call needs a provider key, and the agent shouldn’t be the one holding it.
Where it can go. The call to the outside website needs limits on which sites the agent can reach and what it can send.
A checkable record. A compliance officer will want a record of every action the agent takes.
Post-quantum encryption. Patient data has to stay protected for decades, so its encryption has to hold up against quantum computers that don’t exist yet but could one day break today’s methods.
One console. Someone has to run all of it from somewhere.
Each of those needs has a standalone product built for it. Put six of them together and each one brings its own keys, its own log, and its own console. The trouble is in the gaps between them: a provider key sitting in a second vendor’s storage, an auditor lining up two records by timestamp.
OpenMatter covers all six with one key system, one record, and post-quantum cryptography.
The Foundation: Keys That Are Never Whole
Every secret on the platform goes through MatterVault™. When you paste one into the console, it’s encrypted in your browser before it leaves the page. The key that can decrypt it is created in five pieces, one on each machine of a committee, and never exists whole. Decrypting takes three of those machines working together, so no single machine can read a secret on its own.
MatterSDK™ puts the same system inside your own applications.
Agents That Never Hold Their Keys
ModelRouter™, our model gateway, keeps its provider keys in MatterVault and unseals one only while serving a request. Your agents get a gateway token and one address for every model.
QuantumGuard™, which sits between an agent and the services it calls, extends the same idea beyond model calls. The agent holds a stand-in credential. The real key is swapped in by QuantumGuard, only for the hosts it belongs to, so an agent that’s compromised has no key to give up. That key comes from MatterVault, so no single machine ever holds a readable copy.
Rules the Agent Can’t Talk Its Way Around
A QuantumGuard policy lists the hosts, methods, ports, and paths an agent is allowed to reach, along with forbidden keywords such as password and secret. Anything the policy doesn’t allow is blocked the moment it’s attempted.
When a policy is saved, it’s compiled into a program that runs in a zero-knowledge virtual machine. Every request is recorded, and each allowed one comes with a proof that it was checked against that policy. A guardrail that reads the agent’s request and makes a judgment call can be argued with. A check compiled into a program runs the same way every time, and the proof shows it ran.
Computation on Data Nobody Hands Over
Masked Compute™ lets organizations train a shared model without handing over their data. Each participant’s agent splits every row of its data into five masked pieces and sends one to each of five separate compute servers. No server ever holds a whole row, and every participant gets the same finished model.
The privacy comes from the math, so there’s no chip vendor to trust and no sealed enclave to break into. MatterML™ V2, the engine underneath, cut a linear-regression training session from around two and a half hours to about two minutes in OpenMatter’s own testing.
Post-Quantum from the Start
The key system and the setup for masked computation rest on lattice problems. QuantumGuard’s proofs rest on hash functions. Both are designed to resist attacks from quantum computers.
A platform that adds post-quantum cryptography later has to re-encrypt every stored secret and replace its proof systems. Building on it from the start avoids that work.
One Record, One Console
MatterChain carries the shared record. QuantumGuard writes each policy’s hash there and logs which version is running whenever a policy changes. Its proofs are checked against that hash. A Masked Compute session closes only after every participant confirms it received the same result, and that agreement is recorded onchain.
Datavizor is where all of it runs. You deploy an agent, attach a policy, add a provider key to ModelRouter, and start a joint training session with a partner, all with one sign-in. Datavizor is also where a team sets the boundaries. Each project gets its own members and spending cap, and its owner chooses which models, routes, and policies it can use through ModelRouter. Members see only the projects they’re assigned to, while owners and admins can watch every project’s running apps from one Monitoring page.
Back to the Hospital
Put the research agent on this platform and each of its six needs is met. Both hospitals’ records reach the shared model in masked pieces. The model call goes through a gateway holding a key the agent never sees. The call to the outside website is checked against a policy and leaves a proof behind. The compliance officer gets a record of every request, with proofs tied to a policy hash on one chain. And the team runs everything from one console.
Separate tools mean keeping keys in several places and reconciling several records. On OpenMatter, every credential comes from one key system, and every policy and joint result goes into one record. The keys, the computation, and the proofs all rest on post-quantum cryptography from the start.
Don’t trust data. Prove it. Start in Datavizor.
— The OpenMatter Team
If you know someone who would benefit from reading this article, please share it:
OpenMatter is building the verifiable trust layer that enables AI agents to securely collaborate on sensitive data sets. If you’re in a regulated industry and need a better way to prove that your data is secure, contact our team to learn how OpenMatter can help.