A privacy policy is a promise. Attestation is proof.
Every prompt you send to someone else's AI is company data in plaintext on their machines, protected mostly by terms of service. For the data that matters most, we can protect it with hardware and cryptography instead.
The terms, in plain English
Zero data retention (ZDR)
A contract term. The provider deletes prompts and outputs right after processing instead of keeping them for a period. It limits how long data is kept, not who can see it while it is processed.
No-training terms
A promise that your data will not be used to train the provider's models. Standard on most business plans.
Private endpoint
A model served inside your own cloud network, reachable without the public internet, often with your own encryption keys and a pinned region.
Confidential computing
A hardware mode where the CPU and GPU encrypt a workload's memory, so the host operator, hypervisor, and other tenants cannot read it.
Attestation
A signed report from the hardware itself, stating which chip it is and exactly what code is running. You check it before sending any data or keys.
Zero data retention is a promise about deletion. Attestation is proof about access. They are not the same thing.
Privacy is not on or off.
We support hosted and self-run models alike, with a bias toward open-weight models you control. Select a level to see what it protects and how we set it up.
Closed model, hosted API
The provider runs the model and sees every prompt. Protected by its terms.
Open model, hosted API
Same exposure as level 1, but the model is open, so you can take it anywhere.
Frontier model, your cloud account
A closed model served inside your own cloud network, region, and keys.
Open model, rented GPUs
Your own deployment on someone else's host. The operator could still reach the machine.
Open model, attested GPUs
Rented hardware that proves what is running and locks the operator out of memory.
Open model, your hardware
Prompts and weights never leave infrastructure you control.
Level 1: Closed model, hosted API
Encryption in transit and at rest. Contract terms such as zero data retention and no training on your data.
The provider decrypts every prompt to run it. The model can change or be retired under you.
Public or low-risk data, where you need a frontier model.
A gateway you control in front, so prompts are logged on your side, sensitive fields are stripped, and you can switch providers.
Level 2: Open model, hosted API
Everything in level 1, plus no lock-in: the same model can later run on your own GPUs.
The provider still sees every prompt.
Early products and non-sensitive data, with a clear way out.
The same gateway, pinned model versions, and a plan to move in-house when volume justifies it.
Level 3: Frontier model, your cloud account
A private endpoint with no public internet path, a pinned region, your own encryption keys, and your cloud's existing agreements.
The cloud provider still processes prompts in plaintext, and the model is not yours to inspect or keep.
Teams standardized on one cloud that need a closed model.
Private networking from your apps to the endpoint, identity and logging through your existing cloud controls, behind the same gateway.
Level 4: Open model, rented GPUs
Nobody else serves your prompts. An encrypted private link, your keys for data at rest, your model, and your logs.
The host operator could, in principle, read memory or disks.
Internal business data and most production workloads.
Dedicated GPUs joined to your cluster over an encrypted link, a minimal locked-down operating system, and keys that stay with you.
Level 5: Open model, attested GPUs
Confidential computing encrypts memory on the CPU and GPU. Attestation proves the chip and the code before any data or keys are sent.
Fewer providers and hardware types support it, and capacity is tighter.
Regulated or confidential data on rented capacity, for a whole workload or only the overflow.
The gateway checks attestation before routing. Model weights and keys stay sealed until the check passes, and every new node is checked again.
Level 6: Open model, your hardware
Physical and network control, and the option to run fully offline.
You carry the hardware cost and capacity planning. Insider and supply chain risks still need controls.
The most sensitive data, sovereignty requirements, and air-gapped sites.
Measured boot and the same attestation checks on your own servers, so you can prove what is running. Any overflow goes only to level 5.
One gateway can route each workload to the right level, so a chatbot on public docs and a model reading patient records never share a path.
How attestation works
The check is the same whether a whole workload runs on rented GPUs, only the overflow does, or you are verifying your own servers.
Not every GPU cloud can do this
Attestation needs specific hardware and a provider that enables it, so today only some GPU clouds offer it. Part of our job is knowing which, and telling you plainly when the capacity you have in mind cannot be attested.
What that looks like in practice
Private even when you burst
Rented GPUs join over an encrypted private mesh, never the open internet. For sensitive workloads we recommend providers that support attestation, and use ordinary GPU clouds where the data allows.
Immutable by default
Where we build the cluster, nodes run a minimal, immutable operating system managed by API. No SSH, no shell, no drift, far less to attack.
Identity in front of everything
Every model endpoint and agent sits behind your identity provider with single sign-on.
Agents with limits
Agents get the permissions you grant them and nothing more, and they reach your systems from inside your network.
Open and auditable
Built from open source in your own accounts, with your keys. You can inspect every layer, and you keep all of it.
Experience in regulated environments
We have done hands-on security and remediation work in PCI and HIPAA environments, plus security testing and packet-level debugging of production networks. That is experience, not a certification, and we do not claim one.