Skip to main content
The short answer: Use confidential inference for sensitive data and for production workloads. Use ZDR for evaluation, for prototypes, and for public data. Do not send sensitive data to a typical inference provider.

​
The comparison

​
How to choose

Use confidential inference

Regulated data, personal data, health records, financial documents, legal documents, source code, and each production workload with sensitive input.

Use ZDR

Evaluation, prototypes, public data, internal tests, and an OpenAI integration that must operate with no code changes.

​
Why the basis of the guarantee is the important row

One difference causes each row in the table. Confidential inference removes the need to trust the operator. Your device encrypts the payload. The Prem API Gateway sends ciphertext only. Only a sealed enclave holds the key material to decrypt it. The hardware supplies signed evidence, and you examine that evidence with an open verifier. Prem cannot read your content. See Encryption and Attestation. ZDR makes the trust smaller: one contract. Two components can read your content: the gateway and the partner. Nobody keeps it. You cannot show this yourself. You rely on the agreement and on the operational controls of Prem. See ZDR security boundary. A typical provider asks you to trust a policy. The policy can change. The plaintext boundary contains the staff of the provider and its subprocessors. The provider frequently keeps content for a period, for abuse review. A change to a policy needs no technical change. Thus there is no signal that you can see.
A published retention policy is a statement. It is not a control that you can test. Your threat model can contain the provider. A policy does not correct that risk. ZDR makes the risk smaller with a contract. Confidential inference removes the need to trust the contract.

​
What each mode costs you

Confidential inference asks for more work from you. You generate a client KEK, and you keep it. You use the Prem SDK, or you operate the local Confidential Proxy. You accept a smaller model catalog. ZDR asks for almost no work. You change the base URL of your OpenAI client. This difference in work is the reason to make one decision for each workload. Do not make one decision for the full application. Many teams use confidential inference for production traffic and ZDR for offline evaluation.
Read the current limitations of the confidential path before you make a guarantee for a specific workload. The work on the attestation policy is not complete.

ZDR security boundary

What ZDR protects and what it does not.

Confidential Security Model

The confidential threat model and its limits.

Quickstart

Set up confidential inference.

ZDR overview

Set up ZDR.