How It Works

​

The Simple Version

This is the core idea, before the architecture diagrams:

1. You type a prompt.
2. Your device encrypts the prompt before it sends data over the network.
3. Our gateway receives the encrypted payload. The gateway handles authentication and billing, but it cannot read your data.
4. The encrypted payload enters a sealed hardware environment (a Confidential Virtual Machine). There, the enclave decrypts the payload, the AI model processes it, and the enclave encrypts the response again.
5. The encrypted response travels back to your device. Your device decrypts the response and shows it.

Your data exists in plaintext in only two locations: (a) your device and (b) the sealed hardware environment. Your data is not in plaintext on our servers, in our logs, or in transit. The hardware itself, made by AMD, Intel, and NVIDIA, enforces this seal. The seal is not a software setting that a person can turn off.

​

Architecture Overview

​

The Components

​

Your Device: The Prem API SDK

The SDK runs on your side: your laptop, your server, your application, or your browser. It is the only location, besides the sealed enclave, where your data exists in readable form. The functions of the SDK:

• Encrypts all data before the data leaves your device, with modern, quantum-resistant cryptography
• Holds your master encryption key: a key that you generate and that never leaves your device
• Decrypts responses when they come back

From the perspective of your code, the SDK operates like the standard OpenAI SDK. The encryption is invisible. The SDK does the encryption automatically.

​

PREM API: The Blind Gateway

The proxy is the entry point of the platform. The proxy handles the operational tasks: it checks your API key, enforces rate limits, tracks usage for billing, and routes requests. The critical point: the proxy never sees your actual data. The proxy processes only encrypted payloads and metadata, such as API keys and timestamps. It has no encryption keys and no method to decrypt the data that passes through it. If an attacker fully compromises the proxy, the attacker gets encrypted bytes and metadata, never your actual content.

​

Prem API Enclave: The Sealed Processing Environment

The enclave is the location where your data is processed. The enclave runs inside a Trusted Execution Environment (TEE), a sealed area of the processor with its own encrypted memory. The rest of the system cannot access this memory. The enclave is comparable to a bank vault inside a building. The building owner has keys to every room. But the vault has its own lock, and the building owner cannot open this lock. In this analogy, the “building” is the server. The “building owner” is the operator of the server: us, or our infrastructure provider. The “vault” is the TEE. The steps inside the enclave:

1. Your encrypted payload arrives.
2. The enclave decrypts the payload with a secure key exchange.
3. The AI model processes your request.
4. The enclave encrypts the response before the response leaves.
5. The enclave wipes all plaintext from memory.

The enclave runs on AMD SEV-SNP or Intel TDX processors, with NVIDIA Hopper and Blackwell architecture GPUs in confidential compute mode. The hardware enforces the isolation. The isolation is not a software setting that admin privileges can turn off.

​

Model Router

The model router is a service that directs AI requests to the correct model. We host all models in our confidential infrastructure. The router manages the available models, does health checks, and selects the applicable backend. The router runs inside the same sealed environment as the enclave. So it never exposes your data outside the confidential compute boundary. No requests leave our infrastructure. All models run on our own hardware inside CVMs.

​

Everything Runs in Sealed Environments

The enclave is not the only component inside the sealed environment. Each service that processes your data runs inside Confidential Virtual Machines (CVMs): There is no gap in the chain. Each service that touches your data runs inside hardware-sealed, attested confidential compute. This applies from the decryption of your data to the re-encryption of the response. The only component outside the CVM is the API Gateway, and it handles only encrypted bytes.

​

The Infrastructure Locations

Prem API runs on a hybrid infrastructure, a mix of hardware that we own and capacity that we rent:

• Owned infrastructure is in Switzerland, under Swiss data protection law
• Rented infrastructure is primarily in Europe, with some deployments in the United States

All machines, owned or rented, are unattended. There is no SSH access, no remote desktop, and no debug console. Nobody logs in to these machines. The TEE hardware enforces isolation, independent of the owner of the physical server. Attestation gives the same cryptographic proof in both environments.

​

The Lifecycle of a Chat Request

This is the full lifecycle of a chat request: For streaming responses (word-by-word output in the style of ChatGPT), the enclave encrypts each chunk individually before it sends the chunk. The proxy forwards the chunks and does not buffer or inspect them.

​

The Tasks That the SDK Does for You

The SDK does all these tasks automatically. You do not need to:

• Understand or manage encryption algorithms
• Do key exchanges manually
• Encrypt or decrypt data in your application code
• Handle streaming decryption

From the perspective of your application, you make standard API calls and get standard responses. The encryption layer is fully invisible.