> ## Documentation Index
> Fetch the complete documentation index at: https://docs.prem.io/llms.txt
> Use this file to discover all available pages before exploring further.
# ZDR Compared With Confidential Inference
> A direct comparison of confidential inference, Zero Data Retention, and a typical inference provider.
**The short answer:** Use confidential inference for sensitive data and for production workloads. Use ZDR for evaluation, for prototypes, and for public data. Do not send sensitive data to a typical inference provider.
## The comparison
| | Confidential inference | Zero Data Retention | A typical inference provider |
| ------------------------------------- | ---------------------------------------------------------------------------------- | ------------------------------------------- | --------------------------------------------------------- |
| **Basis of the guarantee** | Hardware and cryptography | A contract and operational controls | A policy |
| **Content at the provider** | Ciphertext only | Plaintext, but nobody keeps it | Plaintext, and a policy controls what the provider keeps |
| **Encryption** | Client-side, end-to-end | TLS 1.3 in transit | TLS 1.3 in transit |
| **Processing environment** | A Trusted Execution Environment (AMD SEV-SNP or Intel TDX, with confidential GPUs) | Standard compute | Standard compute |
| **Hardware evidence** | An attestation report that you can examine | None | None |
| **Who holds the keys** | You hold the client KEK | Not applicable | The provider |
| **Prompts and completions that stay** | None | None | Frequently 30 days, but it is different for each provider |
| **Training on your content** | Not possible, because the content is unreadable | The contract does not permit it | It is different for each plan |
| **A person reads your content** | Not possible | The contract does not permit it | Frequent, for abuse review |
| **Can you make sure of the claim?** | Yes | No | No |
| **Post-quantum protection** | Yes, a hybrid ML-KEM768 exchange | No | No |
| **Regions** | Switzerland | European Union, Switzerland, United Kingdom | It is different for each provider |
| **Integration cost** | The SDK or the local proxy, and the custody of the KEK | Change one base URL | Change one base URL |
## How to choose
Regulated data, personal data, health records, financial documents, legal documents, source code, and each production workload with sensitive input.
Evaluation, prototypes, public data, internal tests, and an OpenAI integration that must operate with no code changes.
## Why the basis of the guarantee is the important row
One difference causes each row in the table.
**Confidential inference removes the need to trust the operator.** Your device encrypts the payload. The Prem API Gateway sends ciphertext only. Only a sealed enclave holds the key material to decrypt it. The hardware supplies signed evidence, and you examine that evidence with an open verifier. Prem cannot read your content. See [Encryption](/encryption) and [Attestation](/attestation).
**ZDR makes the trust smaller: one contract.** Two components can read your content: the gateway and the partner. Nobody keeps it. You cannot show this yourself. You rely on the agreement and on the operational controls of Prem. See [ZDR security boundary](/zdr/security-boundary).
**A typical provider asks you to trust a policy.** The policy can change. The plaintext boundary contains the staff of the provider and its subprocessors. The provider frequently keeps content for a period, for abuse review. A change to a policy needs no technical change. Thus there is no signal that you can see.
A published retention policy is a statement. It is not a control that you can test. Your threat model can contain the provider. A policy does not correct that risk. ZDR makes the risk smaller with a contract. Confidential inference removes the need to trust the contract.
## What each mode costs you
Confidential inference asks for more work from you. You generate a client KEK, and you keep it. You use the Prem SDK, or you operate the local Confidential Proxy. You accept a smaller model catalog.
ZDR asks for almost no work. You change the base URL of your OpenAI client.
This difference in work is the reason to make one decision for each workload. Do not make one decision for the full application. Many teams use confidential inference for production traffic and ZDR for offline evaluation.
Read the [current limitations](/platform-status) of the confidential path before you make a guarantee for a specific workload. The work on the attestation policy is not complete.
What ZDR protects and what it does not.
The confidential threat model and its limits.
Set up confidential inference.
Set up ZDR.