The problem TraceZero solves

Most OSINT and privacy tools focus on whether a user's data has already been leaked. However, attackers can often build a detailed profile without any new breach by correlating information that is already publicly available across different platforms.

TraceZero helps users discover these hidden correlation risks by analyzing their authorized public footprint, identifying potential attack paths, and generating an explainable digital exposure score. It then provides actionable recommendations to reduce that exposure.

The key difference is that TraceZero is privacy-first by design: raw OSINT data is processed locally and is never stored in a centralized database or placed on the blockchain.

After reducing their exposure, users can use Zero-Knowledge Proofs to prove that they satisfy a privacy requirement (for example, "Exposure Score < 30") without revealing their actual score or underlying personal information.

Ethereum acts as the public verification layer, storing privacy policies and verifying cryptographic proofs rather than storing user data.

Challenges I ran into

The biggest challenge was designing the system so that we could actually use blockchain and AI without defeating the purpose of a privacy application.

Our first architectural concern was data storage: sending raw OSINT information to a centralized backend or AI service would create exactly the privacy risk we were trying to solve. We therefore redesigned the architecture around local-first processing, keeping sensitive analysis on the user's device and sending only minimal, sanitized information to external AI services when necessary.

A second challenge was making Zero-Knowledge Proofs useful rather than simply adding ZK as a buzzword. We needed the exposure score to be deterministic and structured enough to be proven cryptographically. We separated the deterministic risk engine from the AI explanation layer so that AI could explain threats without being responsible for the value being proved.

Finally, integrating Ethereum required carefully separating public and private state. We designed the smart contract to store privacy policies and verify proofs, while keeping usernames, locations, OSINT findings, attack graphs, and other sensitive information completely off-chain.

This resulted in our final architecture:

Private data → Local analysis → Deterministic exposure score → ZK proof → Ethereum verification

rather than storing user data in a centralized database or on-chain.