FAQ

Answers to the questions we get most. Pick your product.

Confidential Inference

Our hosted inference endpoint runs on C8s, our confidential Kubernetes. The same answers apply if you license the stack and run it on your own GPUs.

How do I verify the endpoint from my client?

For a one-off check, run scripts/verify-public-attestation.py from confidential-inference against /attestation with a fresh nonce, and review the measurements and allowlist it reports. For ongoing use, connect through TEErminator, a localhost proxy that verifies the attestation, pins it to the TLS session, re-checks at least every minute, and can fail closed if the cluster no longer matches the allowlist you approved.

Do you verify NVIDIA GPU evidence?

Yes, at node boot. The GPUs run in NVIDIA Confidential Computing mode. Each node checks every GPU's NVIDIA attestation before it can run workloads, and powers off if any check fails. That check is part of the measured image your client verifies. The NVIDIA GPU report itself is not passed through to /attestation yet; end-to-end GPU attestation is on our roadmap.

Is attestation per request or per session?

Per session. Your client verifies once per connection, with its own nonce, before sending anything. If the attested state changes, for example an allowlist update, open connections are cut and clients re-verify.

What does attestation prove?

That every node is genuine confidential-computing hardware (Intel TDX on the hosted endpoint; C8s also supports AMD SEV-SNP) that booted the exact measured image, and that only allowlisted workloads can run. An allowlist entry pins the image digest and the exact command line; environment variables and mounts are not gated the same way. Development images can include SSH if you need it during setup. Production images have no SSH.

Can I inspect all the code?

The hosted endpoint runs open, reproducible builds. Dedicated, performance-optimised deployments may include proprietary components. Attestation still proves exactly which image runs, but not all of it is open source.

Is the prompt cache shared between customers?

On the shared hosted endpoint, prefix caching is not isolated per account today. Per-account or per-tenant cache isolation is available on dedicated deployments.

Which OpenAI API features are supported?

Chat completions, streaming, structured output and tool calling. For structured output pass response_format with json_object, or json_schema with strict: true. Tools work the same way as OpenAI: pass tools, get tool_calls back. DeepSeek V4 Flash is text-only.

What happens to model IDs when a model is upgraded?

We give advance notice before a model is dropped. After that, requests to its ID are forwarded to a successor model at the same price.

What are the rate limits? Can I load test?

Each key has rate limits. Above them the endpoint returns 429 with a Retry-After header. Retry on 429 and honour Retry-After. Tell us before you load test so we can make sure capacity is ready. Reserved capacity is available if you need guaranteed throughput.

Confidential VMs

Confidential VMs give you root inside a measured confidential VM, so you collect and verify attestation yourself.

How do I get GPU attestation?

From inside your VM: you can fetch both the CPU attestation (Intel TDX or AMD SEV-SNP) and the NVIDIA GPU attestation report, and verify them with our open-source tools or your own.

What do I control?

Root over SSH inside a measured confidential VM. No access to the bare-metal host. No custom guest images or kernels on rented VMs. Bring-your-own-image is part of Confidential Metal (licensed).

Is my VM on a shared host?

8 GPUs is a whole node, nothing shared. With 1, 2 or 4 GPUs, other tenants' confidential VMs may run on the same host. The hardware (Intel TDX or AMD SEV-SNP) keeps your memory unreadable to them, to the host and to us.

Is NVLink encrypted?

Yes on B200 and B300: multi-GPU with encrypted NVLink. H100 multi-GPU uses Protected PCIe, so NVLink is not encrypted.

Does storage persist across restarts?

Not yet. Encrypted persistent storage across VM restarts is not available. Treat each start as a cold load.

Can I get bare metal?

No. We provision the confidential VM and keep the host layer. To run your own hypervisor, use a bare-metal provider, or license Confidential Metal for your own hardware.

Shared (all products)

These answers apply across Confidential Inference, Confidential VMs and licensed deployments.

What do you retain?

We don't store prompts, outputs or workload data. Metadata, such as usage for billing, is covered by our Terms of Service and Privacy Policy.

Can Confidential AI or the hosting provider see my data?

Memory in use is encrypted by the hardware, in the VM and on the GPU. For the hosted endpoint, see our threat model for the full trust boundary, including what our operator key can and cannot do.

Do you support HIPAA, GDPR and NDAs?

Regulated data (HIPAA PHI, payment card data) is permitted under a written agreement. DPA for GDPR and UK GDPR on request. Happy to sign an NDA: send yours or ask for ours.

What is the minimum term?

Confidential Inference has no minimum: pay per token. Reserved GPU nodes have a 3-month minimum term. Before committing, we offer a short evaluation of up to a week: ask.

Where does it run?

United States (Texas) and Central America. EU capacity coming. Licensed deployments run wherever you run them.