Confidential AI API: Secure LLM Inference at Scale

Verified current behavior

Area	Current evidence
Client encryption	Direct SDK and local proxy requests completed through the encrypted RVENC path
Zero Data Retention (ZDR)	Live requests completed on `/openai` routes; partners operate under zero-retention contracts without CVM isolation
Chat completions	Live non-streaming and streaming requests completed on OpenAI and Anthropic compatibility surfaces
Coding clients	OpenCode, Claude Code, Qwen Code, OpenClaw, Hermes Agent, Goose, Loupe, Cursor, and Codex CLI completed live requests
Audio transcription	Live requests completed and returned Deepgram-style transcriptions
Attestation gate	The SDK calls high-level Reticle attestation and requires a session ID before protected requests when attestation is enabled
Models and pricing	The full catalog and current prices are published on Models & Pricing

Attestation status

Capability	Status	Boundary
AMD SEV-SNP evidence verification	Implemented	Signature/certificate and nonce checks run; appraisal runs through golden policies in prem-research/confidential-policies with reference measurements unpinned by default
Intel TDX evidence verification	Implemented	Quote collateral and nonce verification run; appraisal runs through golden policies in prem-research/confidential-policies with reference measurements unpinned by default
NVIDIA evidence verification	Implemented with source-review caveat	Overall and detached JWTs, digest links, nonce values, and returned GPU claims are processed; selected per-GPU check semantics need code-owner review
Combined module discovery	Implemented	The unified client discovers one CPU module and an optional NVIDIA evidence bundle; the bundle can contain multiple detached GPU claims
Automatic approved-image comparison	Policy-dependent	Measured values reach the golden policies; comparison against approved references happens only if operator policies pin them
Multi-GPU attestation	Implemented	Every returned GPU claim is verified, including digest links, signatures, and nonces; the public result does not prove exact-set session and scheduler binding

Attestation evidence can still provide meaningful hardware authenticity and freshness checks. The missing policy checks limit the conclusion: a pass must not be described as complete proof that an approved release image processed the request.

Known gaps

Gap	Impact
ZDR hardware isolation	Zero Data Retention currently relies on partner zero-retention agreements rather than Confidential Virtual Machines (CVMs)
Approved-image pinning	Reference measurements are unpinned by default, so an attestation pass does not by itself prove that an approved release image processed the request; comparison happens only where operator policies pin references
Multi-GPU evidence contract	Developers cannot audit from the public result that every participating GPU was bound to serving
Open-source CVM base image	The deployed CVM base image cannot yet be inspected against public source. A hardened, read-only base image with a minimal package set, a reduced attack surface, and a verifiable root of trust is planned as open source.
Route assurance	Developers cannot yet inspect that a request’s model build and routing path match the model and backend that served it. Binding the attested measurement to the served model path is planned so the route becomes independently verifiable.

Priority sequence and roadmap

Open-source CVM base image: Open-source the hardened, read-only confidential-VM base image with a minimal package set and a verifiable root of trust. Closes: open-source CVM base image.
Pin approved measurements by default: Ship golden policies with reference measurements pinned, so an attestation pass proves an approved release image processed the request without operator-specific configuration. Closes: approved-image pinning.
ZDR inside CVMs: Deploy Zero Data Retention workloads inside hardware-isolated Confidential Virtual Machines. Closes: ZDR hardware isolation.
Multi-GPU binding contract: Publish a verifiable exact-set contract so developers can confirm from the public result that every participating GPU was bound to serving. Closes: multi-GPU evidence contract.
Route assurance: Bind the attested measurement to the served model and backend so the routing path is independently verifiable. Closes: route assurance.
Model and engine verification: Add an open-source procedure to verify model weights, serving engine code, and runtime configuration.
Transparency logs: Publish public transparency logs for CVM images so customers can audit changes.
Third-party security audit: Complete an independent security audit of the platform and publish the audit report.

Trust progression

Each stage answers a different question. Manufacturer evidence authenticates hardware claims. Release policy decides whether measured values are approved. Route assurance binds that decision to a model path. Reproducible provenance connects the approved measurements to source and build inputs.

Model catalog and pricing

Model availability depends on your API key and the selected inference mode (Confidential or ZDR). See Models & Pricing for the full list of available models, context windows, modalities, and prices.

Get Started

Zero Data Retention

Core Concepts

Handling Errors

Platform Status & Roadmap

Verified current behavior

Attestation status

Known gaps

Priority sequence and roadmap

Trust progression

Model catalog and pricing

​Verified current behavior

​Attestation status

​Known gaps

​Priority sequence and roadmap

​Trust progression

​Model catalog and pricing

Verified current behavior

Attestation status

Known gaps

Priority sequence and roadmap

Trust progression

Model catalog and pricing