Executive Summary
Some compliance judgments cannot be reduced to structured fields - whether a homebound-status narrative is clinically adequate, for instance, requires reading the actual free-text note. Doing that normally means the narrative has to enter a vendor's processing tier, creating a custody obligation and a breach surface for regulated data the moment it arrives. JIL Sovereign's no-retention ephemeral enclave, reduced to practice and shipped to production in June 2026, removes that obligation at the architecture level: the narrative is evaluated entirely in memory, and only a de-identified verdict - never the narrative itself - is ever written to durable storage.
Unstructured protected health information enters an in-memory enclave referenced by a tokenized identifier rather than a cleartext one. An explainable classifier scores the input and produces a verdict comprising a pass/fail/route-to-review decision, a confidence value, and named contributing signals - with no cleartext echoed anywhere in the output. Before the cleartext is discarded, the enclave computes a SHA-256 cryptographic commitment over it, binding the verdict to the exact input without storing that input. The de-identified verdict and commitment are sealed under a hybrid classical-and-post-quantum signature, and a retention attestation is emitted confirming that no protected health information was persisted.
Problem Statement
Confidential-computing platforms such as Intel SGX or AMD SEV-SNP attest to the integrity of an execution environment - proving the code that ran matches what was claimed - but they say nothing about whether the input content was retained afterward. A vendor could run a compliant, attested enclave and still write the input to a log or a database on the way out. Conventional de-identification and tokenization pipelines solve a related but different problem: they transform sensitive input into a less-sensitive form, but they still persist a transformed copy, which is a smaller custody surface, not a zero one.
Standard machine-learning inference services typically log or cache their inputs for debugging, retraining, or auditing purposes - exactly the behavior that turns "processed the data" into "retained the data" from a regulatory-custody standpoint. No prior approach combines a de-identified verdict, a cryptographic commitment binding that verdict to the exact (never-stored) input, and a confidence-gated human-review routing decision into one primitive purpose-built for unstructured regulated text.
Why Existing Approaches Fall Short
- Intel SGX / AMD SEV-SNP / confidential VMs: attest hardware and code integrity, not content non-retention.
- De-identification / tokenization pipelines: reduce sensitivity of the persisted copy but still persist a transformed copy.
- Standard ML inference services: commonly log or cache inputs for debugging or retraining, defeating a no-retention guarantee.
- None combine: a de-identified verdict, an input-binding commitment, and confidence-gated routing, with provable non-retention as the architectural default.
Technical Architecture
Processing Pipeline
| Step | Operation |
|---|---|
| 1. Ingest | Minimum-necessary unstructured PHI enters an in-memory enclave, referenced by a tokenized identifier; a request bearing a cleartext identifier is rejected. |
| 2. Classify | An explainable classifier evaluates the input, producing a pass/fail/route-to-review decision, a confidence value, and named contributing signals - no cleartext is echoed. |
| 3. Commit | A SHA-256 commitment is computed over the cleartext input, binding the verdict to the exact input content without storing it. |
| 4. Seal | The de-identified verdict and commitment are sealed under a hybrid Ed25519 + ML-DSA-65 signature. |
| 5. Discard and attest | The cleartext is discarded without ever being written to durable storage; a retention attestation is emitted confirming no PHI is at rest. |
Confidence-Gated Routing
Auto-decision is gated on a confidence threshold: items scoring above the threshold receive an automated pass/fail decision; items below it route to human review rather than being auto-decided. Both paths preserve the same no-retention, commitment-bound property - human reviewers work from the same ephemeral session, not from a retained copy.
Classifier Design
The classifier is a deterministic, explainable scorer over a lexicon of regulatory-element signals - the verdict's "named contributing signals" are drawn from this lexicon, never from the raw narrative text, so the persisted record contains no direct identifiers under a de-identification standard even at the level of the explanation itself.
Enclave Lifecycle
The enclave is ephemeral and re-derivable, holding no state across requests. In one embodiment the mechanism is invoked by a client-resident edge connector (see Claim 35) for checks that require richer processing than the edge can perform locally, with the verdict and seal consumable by a downstream attestation engine that never accesses the cleartext itself.
Prior Art Differentiation
| Approach | Attests hardware integrity | Provable content non-retention | Commitment binds verdict to input | Confidence-gated routing |
|---|---|---|---|---|
| Intel SGX / AMD SEV-SNP | Yes | No | No | No |
| De-identification pipelines | N/A | No (persists transformed copy) | No | No |
| Standard ML inference services | Varies | No (typically logs inputs) | No | Varies |
| JIL Sovereign | N/A (software-level guarantee) | Yes, zero bytes persisted | Yes, SHA-256 | Yes |
No prior art persists only a de-identified verdict plus a cryptographic commitment binding the verdict to the exact input plus a seal, with the cleartext provably never written to storage and with confidence-gated human routing - all as one composed primitive for unstructured regulated text.