How VBS Enclaves and encryption protect Recall snapshots and on-device AI data

Microsoft completely redesigned Windows Recall and on-device AI features around a Zero Trust architecture. Rather than storing snapshots and vector search databases in standard user folders accessible by system processes, Windows 11 leverages Virtualization-Based Security (VBS) Enclaves, hardware-backed encryption, and biometric authentication to isolate sensitive AI data from malware, administrative users, and external threats.

1. Virtualization-Based Security (VBS) Enclaves: Hypervisor-Level Isolation

At the core of Windows 11 AI security is the Hyper-V hypervisor, which divides system memory into distinct execution environments called Virtual Trust Levels (VTLs):

+-------------------------------------------------------------------+
|                           PHYSICAL RAM                            |
+------------------------------------+------------------------------+
|     VTL0: Untrusted Host OS        |    VTL1: Secure Kernel       |
|  (User Apps, Standard Windows      |  (Hypervisor-Protected       |
|   Kernel, Admin Processes)         |   Isolated Memory)           |
|                                    |                              |
|  [ Recall App Interface ] -------->|  [ VBS Enclave ]             |
|   (Only displays query             |   • Snapshot Processing      |
|    results authorized by user)     |   • Vector DB & Indexing     |
|                                    |   • Decryption Engine        |
+------------------------------------+------------------------------+

• VTL0 (Host Environment): Contains the standard Windows operating system, user applications, third-party drivers, and administrative user accounts.

• VTL1 (Secure Environment): A hardware-enforced virtual machine managed by the secure kernel.

• How Enclaves Protect Data: The AI background services—including screenshot capture, Optical Character Recognition (OCR), vector database indexing, and semantic search—run exclusively inside a VBS Enclave in VTL1.

• Kernel & Admin Isolation: Even if malware gains system or root administrative privileges in VTL0, it cannot read, modify, or inject code into the enclave’s VTL1 memory. The hypervisor prevents VTL0 processes from accessing VTL1 memory spaces.

2. Hardware Cryptography: TPM 2.0 & Windows Hello ESS Binding

Encryption alone is insufficient if encryption keys are accessible in system memory. Windows 11 binds Recall keys directly to hardware and user identity:

• TPM 2.0 Key Sealing: The master encryption keys used for AI snapshots and vector embeddings are sealed inside the hardware Trusted Platform Module (TPM 2.0).

• Windows Hello ESS (Enhanced Sign-in Security): Keys can only be unsealed via explicit biometric authentication (facial recognition or fingerprint scan) paired with Windows Hello ESS.

• Proof of Presence: The TPM releases decryption keys only directly into the VBS Enclave. Keys are never exposed to standard OS memory (VTL0) or saved to disk.

• Session Timeouts: Decryption is ephemeral. When a user searches Recall, data is decrypted briefly inside the enclave. Access times out after a short period, requiring biometric re-authentication for subsequent sessions.

3. Storage Architecture & Vector DB Encryption

On-device AI relies on vector databases to convert text and screenshots into mathematical representations (embeddings) for fast semantic search.

• At-Rest Encryption: Screenshots, OCR text logs, and vector database indices are stored encrypted on disk using AES-256. This acts as a secondary layer on top of standard BitLocker or Device Encryption.

• In-Enclave Search Execution: When you perform a search (e.g., "find the PDF with the yellow chart"), the query string is sent into the VBS Enclave. The enclave searches the encrypted vector index, decrypts only the specific matching result inside VTL1, and sends just that result back to the user interface.

• Isolated Data Flow: Raw screenshots and entire database files never leave the enclave or get exposed to standard background applications.

4. Anti-Tampering, Purview Filtering, and Measured Boot

To prevent abuse or automated scraping by malicious actors, Microsoft implemented additional safeguards:

• Automatic Sensitive Data Scrubbing: Integrated Microsoft Purview libraries automatically scan snapshots locally in real time to detect and redact sensitive information—such as credit card numbers, passwords, national ID numbers, and banking details—before they are ever written to the encrypted database.

• Measured Boot & System Guard: During system startup, hardware-rooted Measured Boot checks that the system kernel and hypervisor have not been tampered with. If boot integrity is compromised, the TPM refuses to release the VBS Enclave encryption keys.

• Anti-Hammering & Rate Limiting: The VBS Enclave enforces monotonic counters and rate limits on query requests. If malware attempts to brute-force queries or spam the enclave, the system rate-limits access and locks out the session.

• 100% Local Processing: No snapshots, search indexes, or telemetry generated by Recall or on-device AI models are sent to Microsoft cloud servers.