Audit the code. Run it in your VPC.
Recordings stay on your machine, and every network action is one you named.
$ git clone github.com/attenlabs/hotato
pip install hotato # -> zero runtime dependencies pulled
$ hotato conversation verify ./call-artifact manifest recomputed evidence tier attested signature verifies exit 0
Offline by default.
Scoring, reports, and the workspace read and write local files only.
Proxy variables are honored like curl and pip, and TLS validation stays on.
| Command | Egress | Reaches, and when |
|---|---|---|
| run, report, assert run, test run (local judge), serve | none | Local only. Reads the files you point it at, writes local files, opens no socket. |
| connect | none | Stores a stack's credentials at file mode 0600; no round-trip on store. |
| capture, pull, sweep | your provider | Fetches the recordings you named into a local folder. |
| inspect | your provider | Reads the current turn-taking config. Read-only. |
| hosted judge --judge-provider hosted | refused | Refused unless you pass --judge-egress-opt-in. The default judge is a local model. |
| hosted diarizer --diarizer pyannoteai | refused | The one off-box audio path, refused unless you pass --egress-opt-in. |
| drive a live call (Vapi / Twilio) | double-gated | Places a billable call only with valid credentials and HOTATO_DRIVE_OPT_IN=1. |
The gated rows stay refused until you opt in yourself. Self-host the workspace in your VPC →
Evidence tier: none to attested.
A report's evidence tier: weakest dimension wins, never an average.
- tier 0none
- tier 1asserted
- tier 2measured
- tier 3paired
- tier 4attested
asserted: your word, not recomputed from audio. measured: one clean recording, recomputed. paired: a before/after in one manifest, both recomputed under one pinned (frozen) policy. attested: paired, plus a signed manifest and a runner-vouched capture origin. A shared-key HMAC shows the file is unedited, not who wrote it: it caps at paired.
Ed25519 signing is opt-in via the [sign] extra and verifies from the public key alone; shared-key artifacts use HMAC-SHA256. The recording has its own four tiers.
Three guarantees that always hold.
The same boundaries whether you run offline, self-hosted, or in CI.
Never mutates production by default
plan and patch write proposals; apply runs on a staging clone and dry-runs by default.
Never uploads recordings to Attention Labs
Audio moves from your stack to your disk only on a pull, capture, or sweep.
Never treats a webhook as instructions
The ingest worker extracts a recording reference and scans it. Payload fields are never executed.
Read the full threat model. Send vulnerabilities to [email protected]; keep recordings, consent, and PII out of public issues.
Prove it yourself. Offline.
autopsy reads one recording and lists its incidents, on your own machine.
$ hotato autopsy ./call.wav
Run it in your own VPC. Self-host →