Apple has made the strongest public commitment in the industry to intelligence that runs on the device and, when it cannot, in a cloud that is verifiably unable to retain what it sees. That commitment moves the hard problem down a layer. A model that never leaves the phone still retrieves from something, and what it retrieves from decides whether the answer can be trusted: where each fact came from, whether this request may see it, and how much confidence to place in it. Today that something is a collection of per-app databases, a metadata index and a set of caches that do not share an identity for the same event. 8DB is a store built for the setting instead.
Answering the questions people actually ask
"The restaurant my wife mentioned last Tuesday." "The photo of my dog in Calgary." Those are multi-anchor queries: two or three weak constraints across modalities, none of which is a keyword the user typed into a document. Full-text search is built for the opposite case, one strong lexical anchor, and it degrades on these.
On an M1 MacBook Pro in May 2026, over thirty multi-anchor queries, two thermal phases and 22,573 iterations, 8DB's inverted-index entity lookup returned in 290 µs at the median against 606 µs for SQLite's full-text extension on the same corpus, about 2.1 times faster at the median and between 1.8 and 2.1 times across percentiles. More important than the latency: on the class of query where one anchor is a topic and the other a person hidden in metadata rather than text, the adaptive retrieval path returned about 3.6 times the precision of the full-text baseline. Latency parity with a mature full-text engine is table stakes. Answering the question is the product.
Clearance enforced on every hop
An on-device model reasoning across a user's graph must not traverse into data its current context is not cleared for, and that has to be a property of the traversal, not of the prompt. In 8DB every edge carries governance and every hop checks it. In the on-device cognitive integration test, a 200-hop governed traversal completed at about 23 ns per hop with zero clearance violations, six of six scenarios passing. The clearance check is cheaper than the hop.
Deciding at write time what may leave
A privacy registry in the engine carries, per data category, whether a write may land locally, sync to other devices, or be included in a backup. Biometric and credential categories default to local only; messaging, media and documents carry their own defaults; an application can tighten a rule and cannot silently loosen it. Because the check runs at write time, a category that must never leave the device cannot be exported later by a code path that forgot to ask. The registry is exercised by a workload of 10,000 policy checks across eight categories and three write targets.
Built for the shapes intelligence produces
The store is exercised against eight workloads modelled on what on-device intelligence actually generates: speaker embeddings with match and diarisation, biometric time series with segment recognition and a circadian fit, spatial anchors with radius and nearest-neighbour queries, activity embeddings with prediction and weekly summary, the privacy gate above, a notification graph with temporal windows and per-app profiles, cross-device activity handoff with chain tracing, and a model registry that selects the best model for a target accelerator. Each reports ingest rate, per-query latency and rows returned, and each runs against the same atoms as every other, because that is the point.
Why one store
Every app on the device today keeps its own database, contributes its own metadata to a shared index, and maintains embedding caches no other app can reuse. The same event, a photo, exists as a row, an index entry, a face embedding, a location and a sharing permission with no shared identity, and a model retrieving across them has to trust application code to reconnect them. In 8DB those are projections of one protected atom with one provenance chain, one confidence vector and one governance state. The retrieval precision and the per-hop clearance above are what that identity buys on the read side. The registry is what it buys on the write side.
What to bring us
- Your hardest retrieval query. A real multi-anchor question your users ask and your search does not answer. We will run it against the corpus and return precision and latency.
- A model that needs governed context. If you are building on an on-device foundation model and assembling context by hand, the traversal and the registry are the two pieces to test first.
- A privacy rule you cannot enforce today. Tell us the category and the boundary. We will show whether the registry expresses it and what the write path does when it is violated.
Write to hello@8braid.com with the subject "On-device intelligence: governed retrieval test". You will hear back from an engineer.
Evidence notes
The retrieval measurements are Criterion and harness results from one M1 MacBook Pro in May 2026 against SQLite's FTS5 extension as run by us. The governed-traversal figures come from an integration test and a microbenchmark scheduled for a rerun on the current build. The privacy registry and the eight workloads run on generated data with default parameters, so their numbers are regression guards rather than product measurements and are not quoted here. No production application has yet shipped on the registry.
Sources and further reading
- Apple Foundation Models framework
- Apple technote: managing the on-device model's context window
- Private Cloud Compute security guide
- SQLite FTS5 extension
- 8DB: An Agent Can Only Leak What Its Process Can Decrypt
- 8DB: One Store Under Every App: 8DB on Apple Silicon, by the Numbers
Measurements were taken by 8Braid on one M1 MacBook Pro in May 2026 and describe 8DB and SQLite's FTS5 extension as run by us; they are not measurements of Apple's software or of any Apple service, and nothing here describes an announced Apple product or Apple's internal implementation. Apple, Apple Intelligence, iPhone, Mac, M1, Siri and Private Cloud Compute are trademarks of Apple Inc. SQLite is a trademark of Hipp, Wyrick and Company, Inc. 8Braid is not affiliated with or endorsed by Apple Inc.
Continue the technical conversation
Where could this help your work?
Bring a research question, a database workload or an application you want to build. Let’s connect the ideas in this article to an evaluation that matters to your team.
Discuss this work