> ## Documentation Index
> Fetch the complete documentation index at: https://docs.prem.io/llms.txt
> Use this file to discover all available pages before exploring further.

# How It Works

> Architecture overview: how data flows through Prem API from your device to the enclave and back, without ever being exposed.

## The Simple Version

This is the core idea, before the architecture diagrams:

1. **You type a prompt.**
2. **Your device encrypts the prompt** before it sends data over the network.
3. **Our gateway receives the encrypted payload.** The gateway handles authentication and billing, but it cannot read your data.
4. **The encrypted payload enters a sealed hardware environment** (a Confidential Virtual Machine). There, the enclave decrypts the payload, the AI model processes it, and the enclave encrypts the response again.
5. **The encrypted response travels back to your device.** Your device decrypts the response and shows it.

Your data exists in plaintext in only two locations: (a) your device and (b) the sealed hardware environment. Your data is not in plaintext on our servers, in our logs, or in transit. The hardware itself, made by AMD, Intel, and NVIDIA, enforces this seal. The seal is not a software setting that a person can turn off.

## Architecture Overview

```mermaid theme={"system"}
flowchart LR
    subgraph You["Your Device"]
        SDK["Prem API SDK"]
    end

    subgraph Platform["Prem API Platform"]
        Proxy["Proxy Gateway"]
        Enclave["Secure Enclave (TEE)"]
        Router["Model Router"]
    end

    subgraph Infra["Supporting Services"]
        S3["Encrypted File Storage"]
        VectorDB["RAG"]
        Redis["Redis Cache"]
    end

    SDK -->|"encrypted payload"| Proxy
    Proxy -->|"encrypted payload"| Enclave
    Enclave --> Router
    Router -->|"LLM inference"| Enclave
    Enclave --> S3
    Enclave --> VectorDB
    Proxy --> Redis
    Enclave -->|"encrypted response"| Proxy
    Proxy -->|"encrypted response"| SDK
```

## The Components

### Your Device: The Prem API SDK

The SDK runs on your side: your laptop, your server, your application, or your browser. It is the only location, besides the sealed enclave, where your data exists in readable form.

The functions of the SDK:

* **Encrypts all data** before the data leaves your device, with modern, quantum-resistant cryptography
* **Holds your master encryption key**: a key that you generate and that never leaves your device
* **Decrypts responses** when they come back

From the perspective of your code, the SDK operates like the standard OpenAI SDK. The encryption is invisible. The SDK does the encryption automatically.

### PREM API: The Blind Gateway

The proxy is the entry point of the platform. The proxy handles the operational tasks: it checks your API key, enforces rate limits, tracks usage for billing, and routes requests.

**The critical point: the proxy never sees your actual data.** The proxy processes only encrypted payloads and metadata, such as API keys and timestamps. It has no encryption keys and no method to decrypt the data that passes through it.

| What the Proxy does                             | What the Proxy cannot do            |
| ----------------------------------------------- | ----------------------------------- |
| Validate your API key and permissions           | Read your prompts or responses      |
| Enforce rate limits for your organization       | Access any encryption keys          |
| Route encrypted payloads to the correct enclave | Log or inspect your data            |
| Track usage for billing                         | Decrypt the files that you uploaded |

If an attacker fully compromises the proxy, the attacker gets encrypted bytes and metadata, never your actual content.

### Prem API Enclave: The Sealed Processing Environment

The enclave is the location where your data is processed. The enclave runs inside a **Trusted Execution Environment (TEE)**, a sealed area of the processor with its own encrypted memory. The rest of the system cannot access this memory.

The enclave is comparable to a bank vault inside a building. The building owner has keys to every room. But the vault has its own lock, and the building owner cannot open this lock. In this analogy, the "building" is the server. The "building owner" is the operator of the server: us, or our infrastructure provider. The "vault" is the TEE.

The steps inside the enclave:

1. Your encrypted payload arrives.
2. The enclave decrypts the payload with a secure key exchange.
3. The AI model processes your request.
4. The enclave encrypts the response before the response leaves.
5. The enclave wipes all plaintext from memory.

The enclave runs on **AMD SEV-SNP** or **Intel TDX** processors, with **NVIDIA Hopper and Blackwell architecture GPUs** in confidential compute mode. The hardware enforces the isolation. The isolation is not a software setting that admin privileges can turn off.

### Model Router

The model router is a service that directs AI requests to the correct model. We host all models in our confidential infrastructure. The router manages the available models, does health checks, and selects the applicable backend. The router runs **inside the same sealed environment** as the enclave. So it never exposes your data outside the confidential compute boundary. No requests leave our infrastructure. All models run on our own hardware inside CVMs.

### Everything Runs in Sealed Environments

The enclave is not the only component inside the sealed environment. **Each service that processes your data runs inside Confidential Virtual Machines (CVMs)**:

| Service                                | What It Does                                              | Runs in CVM? |
| -------------------------------------- | --------------------------------------------------------- | :----------: |
| **Enclave**                            | Decrypts, orchestrates, encrypts                          |      Yes     |
| **Model Router**                       | Routes to the correct AI model                            |      Yes     |
| **LLM Inference**                      | Runs the AI model on your prompt (all models self-hosted) |      Yes     |
| **Speech-to-Text** (Deepgram, Whisper) | Transcribes your audio                                    |      Yes     |
| **Vector DB**                          | Stores RAG embeddings                                     |      Yes     |

**There is no gap in the chain.**
Each service that touches your data runs inside hardware-sealed, attested confidential compute. This applies from the decryption of your data to the re-encryption of the response.
The only component outside the CVM is the API Gateway, and it handles only encrypted bytes.

### The Infrastructure Locations

Prem API runs on a **hybrid infrastructure**, a mix of hardware that we own and capacity that we rent:

* **Owned infrastructure** is in **Switzerland**, under Swiss data protection law
* **Rented infrastructure** is primarily in **Europe**, with some deployments in the **United States**

All machines, owned or rented, are **unattended**. There is no SSH access, no remote desktop, and no debug console. Nobody logs in to these machines. The TEE hardware enforces isolation, independent of the owner of the physical server. [Attestation](/attestation) gives the same cryptographic proof in both environments.

## The Lifecycle of a Chat Request

This is the full lifecycle of a chat request:

```mermaid theme={"system"}
sequenceDiagram
    participant You as Your Device
    participant Gateway as Proxy (sees only encrypted data)
    participant Enclave as Sealed Enclave (CVM)
    participant LLM as AI Model (inside CVM)

    Note over You: 1. Prepare
    You->>Enclave: Request enclave's public key
    Enclave-->>You: Public key

    Note over You: 2. Encrypt
    You->>You: Generate shared secret with enclave
    You->>You: Encrypt your message

    Note over You,Proxy: 3. Send (encrypted)
    You->>Proxy: Encrypted payload
    Note over Proxy: Check API key, rate limits
    Proxy->>Enclave: Forward (still encrypted)

    Note over Enclave: 4. Process (sealed hardware)
    Enclave->>Enclave: Decrypt your message
    Enclave->>LLM: Run inference
    LLM-->>Enclave: AI response
    Enclave->>Enclave: Encrypt response

    Note over Enclave,You: 5. Return (encrypted)
    Enclave-->>Proxy: Encrypted response
    Proxy-->>You: Forward (still encrypted)
    You->>You: Decrypt and display
```

For **streaming responses** (word-by-word output in the style of ChatGPT), the enclave encrypts each chunk individually before it sends the chunk. The proxy forwards the chunks and does not buffer or inspect them.

## The Tasks That the SDK Does for You

The SDK does all these tasks automatically. You do not need to:

* Understand or manage encryption algorithms
* Do key exchanges manually
* Encrypt or decrypt data in your application code
* Handle streaming decryption

From the perspective of your application, you make standard API calls and get standard responses. The encryption layer is fully invisible.

<Note>
  See the [Encryption](/encryption) reference for the full cryptographic details: algorithms, key types, and protocols. Continue to [Security Model](/security-model) for the security guarantees and their limits.
</Note>