Your browser encrypts research questions, source files and project content before they reach Nibgate's ordinary backend. A verified Phala confidential worker decrypts authorized content to run the research, then encrypts saved activity, checkpoints, reports and exports. Phala provides the protected computing environment; Dr. Nib is the research agent running inside it.

Worker verification uses Phala's official verifier software. In Nibgate-operated deployments, you trust our verification service to report honestly. It receives hardware evidence, not your research content or project keys; this is not an independent audit.

Primary research inference uses a separate verified Phala service. JEV decisions use TypeSafe through OpenRouter with zero data retention (ZDR). If you authorize the hosted research fallback, it also uses OpenRouter ZDR. Those hosted providers receive the context needed for their calls: ZDR governs retention and does not make prompts invisible to the provider.

Approved searches and website requests reveal their public queries or URLs to those services. Account identity, timing, sizes and necessary payment metadata remain visible; blockchain transactions are public. A failed worker verification blocks key delivery.

Read the privacy overview, architecture and data boundaries, or models, tools and payments.

• What is Phala Cloud? — the confidential computing platform.
• Phala TEE proof guide — how hardware evidence is obtained and verified.
• Phala CVM and attestation reference — technical verification and lifecycle details.
• OpenRouter zero data retention — the policy used for disclosed hosted model routes.

These explain the underlying services. Dr. Nib's privacy guide describes how the agent uses them and what each service can see.

Ask a question on the Research page. Dr. Nib interviews you first (intake), you configure depth and budget, it plans, you fund the onchain escrow, you approve — then it searches, reads, scores, and writes. The report lands with cited sources, and whatever money is unspent returns to you automatically at settle.

Paid research requires confirmed escrow and your approval. Intake, planning and plan edits do not draw from your deposit; their provider costs are sponsored by the operator.

Answer option buttons, or type another answer. Submit a whole batch at once; Dr. Nib shows its read, you press Next when you have read enough. Just plan it skips the rest — unanswered questions stay unanswered and the brief goes to planning as-is.

Leave mid-intake and come back: Research picks the flow back up where you left it. Anything past intake lives on the run page.

The plan carries a cost estimate based on the planned search, reading, judging and writing work, scaled by depth and report length. It is not the final charge. It is the minimum worth funding: approve stays locked until the escrow holds at least the estimate.

The cap is the most a run may ever spend. On escrowed runs the deposit is the working budget — approve aligns the cap down to what actually landed, so you can fund just the estimate instead of the whole cap.

A 1% platform fee accrues as the budget draws down, taken from the operator share at settle — you pay for what actually ran, and the refund is everything else.

Runs are funded by an onchain escrow deposit in USDC: open the job, set its budget, approve USDC, and fund it — four wallet confirmations. Approve stays locked until the job reads Funded onchain.

Deposits are one-shot: the contract flips Open → Funded on funding and can never be topped up. Pick the amount deliberately — the run pauses when it is spent, and a bigger budget means ending the run and starting a new one. Unspent money returns to your wallet when the settlement transaction confirms. Pending refunds are labeled and retry automatically; the receipt also has a Retry settlement button. Refunds are enforced by the escrow contract.

Your project list, saved chats, reports and receipts open without waking the private worker. Your browser decrypts saved content. Submitting a research question, sending a follow-up or resuming work connects to the worker; if it is asleep, the workspace shows Waking private worker, then Verifying secure connection.

Saved content stays visible during startup. After work finishes, a five-minute idle period keeps short follow-ups warm before shutdown. Reopening a stalled project shows its history; use Resume to continue its saved work.

The run page is a live feed: Dr. Nib's reads, JEV's judgements with their probabilities, every tool call with its result, and stage-by-stage spend. Mid-run, Dr. Nib may park with a question — answer it in the box and the run continues. The steer box applies your guidance at the next stage boundary.

Paused at the budget cap means there is not enough available budget for the next action; some funds may still be reserved for unresolved operations. Completed work is kept. Pause any time yourself; resume continues from the saved checkpoint when the blocking condition is resolved. A settled or refunded deposit cannot fund more work.

Every factual claim cites its source as [n] — the chips link straight to the cited page. The full source list sits below the report. After settlement, start a fresh run with a new deposit for further research; refunded money cannot be reused. Existing report versions remain selectable.

Below the report, Ask about this reportanswers fixed questions (weakest claim, strongest support, what's unsupported, which source carried most) straight from the verify pass — no model, no budget. Under it, Discuss this reporttakes free-form follow-ups: each finished run gets a small free allowance (shown as “N of 10 left”), answered from the report and its sources only, with no ledger draw and no deposit needed. When the allowance runs out, start a fresh funded run for a deeper pass.

Export to PDF, Word, Excel, PowerPoint, Markdown, JSON, or BibTeX from the run page. Exports render from the finished report and download directly.

At Configure, add PDF with selectable text, DOCX, XLSX, CSV, TXT, Markdown, or PNG/JPEG/WebP images with readable English text, or a public HTTPS link. Images use local OCR and may misread figures; review the extracted text against the original before approving. Up to five sources, 2 MB each; images are limited to 20 megapixels and PDFs to 100 pages. Scanned PDFs still need OCR first. You can change sources until an escrow job is opened; changing a planned source set returns you to Configure.

Source files and extracted content are encrypted outside the verified worker, with owner-authorized access. Model calls receive only the context required under the disclosed inference policy. Source-only mode disables external retrieval and creator tips. Files freeze once research starts; a fresh run needs its files added again.

Spreadsheet totals are computed decimal column sums grouped by stated currency and, when present, category. CSV dates stay as entered. Repeated rows remain in the sums and are flagged with row references. These are not a reconciliation or financial audit.

Projects lists every run with its status and spend; deleted runs restorable for seven days. The sources library collects everything your runs have cited.

Page shows a load error: one network blip never wipes a loaded page — retry from the banner or the error card. If it persists, the backend may be redeploying; Projects in a minute.

Approve won't go through: it names the reason — usually an unfunded escrow (fund at least the estimate) or a plan still being written.

“Sign in” loops:connect the wallet, then use the Sign in button once — repeated signing means the session call is failing, not your wallet. “Message expired” means your device clock is off (enable automatic date & time); “nonce missing” means cookies are blocked for the site. Wait a moment and retry.

Answers show as skipped: only questions left unanswered (e.g. via Just plan it) show that way. Anything you picked or typed is recorded with its label in the transcript.

The model and every research tool — live web search, scraping, document parsing, code execution — are configured by Nibgate; you do not need to add provider API keys. Receipts show reconciled customer charges with one cumulative row per model or tool. Worker compute and storage are operator-funded, separate from your research charges.