# Confidential

> The AI confidential compute platform.

Confidential runs AI workloads (inference, training, agents) inside hardware-encrypted Trusted Execution Environments (TEEs). Data and code stay private during processing, can't be tampered with, and both claims are cryptographically verifiable without trusting Confidential.

Deploy code unchanged. Get end-to-end privacy, enhanced security, and full verifiability with negligible performance overhead.

## Use Cases

- **Private inference** — guarantee data privacy during inference. Customer prompts, responses, and model interactions are never visible to the provider or their infrastructure.
- **Weight protection** — protect proprietary weights from extraction during inference or fine-tuning. Weights never leave hardware-enforced secure enclaves.
- **Private training** — train on sensitive data and cryptographically prove exactly what data was used.
- **Agent security** — agents run inside TEEs with hardware-enforced credential isolation. Tokens and API keys never exist in plaintext outside a TEE.
- **Multi-agent trust** — agents verify each other's identity and code via cryptographic attestation before establishing trust.
- **Regulatory verifiability** — prove to regulators that the audited model is what's actually running in production via verifiable attestation.

## Performance

TEE overhead is minimal. Benchmarks comparing identical workloads inside TEE-enabled vs regular VMs show ~1.5% overhead. The largest overhead observed across any stage was 2.08%.

| Metric           | TEE Environment | Regular Environment | Difference |
| ---------------- | --------------- | ------------------- | ---------- |
| Execution Speed  | 5.16 kHz        | 5.26 kHz            | -1.90%     |
| Runtime Duration | 89.46s          | 87.78s              | +1.91%     |
| CPU Utilization  | 26.61%          | 26.23%              | +1.45%     |
| Memory Usage     | 19.02 GB        | 18.87 GB            | +0.80%     |

Tested on AMD EPYC with SEV-SNP using cryptographic proving workloads (STARK proofs via zkVM) — among the most compute-intensive workloads possible. If overhead is negligible here, it's negligible for typical AI workloads.

Full benchmark details: [TEE Performance on CPUs](https://confidential.ai/blog/tee-performance-cpus)

## Products

Confidential is a stack of licensed software for running private AI on your own infrastructure — bare metal or any major cloud. Prompts, weights, data, and agent state stay encrypted in memory while they run, and every result carries a cryptographic attestation of what ran and where. License the layers you need, or run all of them as a managed service on [Confidential Cloud](https://confidential.ai/cloud). [Products](https://confidential.ai/products)

- **Confidential Metal** — the foundation for bare metal. Turns on confidential computing on CC-capable hardware and launches CVMs you can fully measure and verify, with a hardened guest image measured from firmware to user space.
- **Confidential Kubernetes (C8s)** — turns a single CVM into a platform you can host and scale on. Every workload gets an attested identity, all traffic between components is encrypted, and the control plane stays outside the trust boundary.
- **Confidential Inference** — private inference on your own stack. Open-weight models behind an OpenAI-compatible API, with prompts, responses, and weights encrypted in CVM memory and an attestation on every response.
- **Confidential Agents** — private, isolated CVMs for AI agents, ready over SSH in seconds, preloaded with an agent runtime and attested inference. Code, data, and keys stay invisible to the host.

## How To Use Confidential

- **Confidential Cloud** — hosted TEE-backed infrastructure. On-demand inference, GPU and CPU VMs, attested CI/CD builds, and a private agents API. No code changes. [Cloud](https://confidential.ai/cloud) · [Pricing](https://confidential.ai/pricing)
- **Enterprise / Licensed** — deploy Confidential's modular software stack on your own infrastructure. Use the full platform or specific pieces. On-prem, bare metal, all major clouds. [Contact sales](mailto:hello@confidential.ai).

## Confidential Cloud Services

### [Confidential Inference](https://confidential.ai/confidential-inference)

Pay-per-token private inference. OpenAI-compatible API. Drop-in replacement for existing providers. 4% lower token throughput vs non-confidential; negligible impact on Time to First Token.

Token pricing:

| Model             | Input (per 1M tokens) | Output (per 1M tokens) |
| ----------------- | --------------------- | ---------------------- |
| GLM 5.2           | $1.25                 | $4.00                  |
| Qwen 3.5 35B      | $0.25                 | $2.00                  |
| Qwen3.6 27B       | $0.30                 | $2.00                  |
| DeepSeek V4-Flash | $0.20                 | $0.40                  |
| DeepSeek V4-Pro   | $2.50                 | $5.00                  |

### [Confidential VMs](https://confidential.ai/confidential-vms)

Dedicated TEE-backed VMs. Single-GPU pass-through on all GPUs, protected PCIe on H100, multi-GPU pass-through with encrypted NVLink on B200 and B300.

GPU VMs (per GPU-hour):

| GPU          | VRAM         | Host CPU TEE             | Per GPU-Hour |
| ------------ | ------------ | ------------------------ | ------------ |
| RTX PRO 6000 | 96 GB GDDR7  | AMD SEV-SNP              | $1.50        |
| H100         | 80 GB HBM3   | AMD SEV-SNP or Intel TDX | $2.00        |
| B200         | 192 GB HBM3e | AMD SEV-SNP or Intel TDX | $5.00        |
| B300         | 288 GB HBM3e | AMD SEV-SNP or Intel TDX | $6.00        |

CPU VMs (per core-hour + per GB-hour RAM):

| TEE Backend | Per Core-Hour | Per GB-Hour (RAM) |
| ----------- | ------------- | ----------------- |
| AMD SEV-SNP | $0.05         | $0.012            |
| Intel TDX   | $0.05         | $0.012            |

### [Attested Builds (Kettle)](https://confidential.ai/attested-builds)

Attested CI/CD inside TEEs with cryptographic provenance. SLSA Build L3. GitHub integration. Base rate $0.008 per vCPU-minute; runners scale linearly.

| Runner   | Specs          | Per Minute |
| -------- | -------------- | ---------- |
| Standard | 2 vCPU, 8 GB   | $0.016     |
| Medium   | 4 vCPU, 16 GB  | $0.032     |
| Large    | 8 vCPU, 32 GB  | $0.064     |
| XL       | 16 vCPU, 64 GB | $0.128     |

### [Confidential Agents](https://confidential.ai/confidential-agents)

Spin up a private, isolated agent environment in under 15 seconds. Each instance ships with the OpenClaw runtime and a bundled OpenAI-compatible inference gateway, accessible over SSH. Invisible to everyone, including Confidential.

## Components

Confidential is a set of independent, composable components. Use them all or integrate individual pieces into your existing stack. For licensing, [contact sales](mailto:hello@confidential.ai).

- **Attestation Service** — Generates and verifies TEE attestation reports. Trust anchor for the platform. Supports AMD SEV-SNP (VCEK/VLEK), Intel TDX, and NVIDIA CC. Continuous re-attestation with automatic certificate revocation. Public verification API and CLI.
- **Certificate Distribution Service (CDS)** — Gates secret and certificate distribution on attestation. Workloads prove what they're running before receiving secrets. Optional certificate authority and TEE registry. Integrates with existing secret stores (e.g. HashiCorp Vault).
- **Build Pipeline (Kettle)** — Produces attested builds: runs builds inside a TEE with cryptographic proof of inputs, environment, and outputs. Verifiable chain from git commit to running code without needing deterministic compilers. Achieves SLSA Build L3 through hardware enforcement.
- **Networking & Application Services** — All networking runs inside TEEs. API gateway, multi-recipient hybrid encryption (payloads encrypted to multiple attested TEEs for reliability), firewalls, DDoS protection, load balancing. Internal mTLS with attestation-rooted certificates.
- **Oblivious HTTP Gateway** — OHTTP-compatible gateway in a TEE paired with a third-party relay. Separates client identity from request content. No single party learns both who is asking and what they're asking.
- **Control Plane** — Orchestration, scheduling, and autoscaling inside a TEE. Telemetry extracted from within the encrypted boundary. Optional ZK proofs verify scaling decisions without exposing per-process data. Supports on-prem, bare metal, and cloud (CPU and GPU).
- **Hardened VM Image** — Minimal, hardened base OS for all workloads. No unnecessary services or debugging tools in production. Measured as part of TEE launch. SELinux, seccomp filters, network isolation.
- **SDKs (Client and Server)** — Client SDK handles encryption, attestation verification, and CDS certificate negotiation. Server SDK handles attestation report generation and TEE-side encryption. Verification API and CLI for programmatic and manual checks.

### Adoption Patterns

- **Attestation only:** Attestation service + SDKs — for teams adding TEE verification to existing deployments.
- **Security layer:** Attestation + CDS + build pipeline — for organizations needing the cryptographic verification layer.
- **Full platform:** All components end-to-end — equivalent to the hosted platform, deployed on your infrastructure.

## Enterprise

Confidential works with AI labs and infrastructure providers. Components are modular and designed for existing bespoke infrastructure. [Contact sales](mailto:hello@confidential.ai) to scope an engagement.

**Three-phase engagement:**
1. **Discovery** (free) — Understand your architecture and threat model. Outcome: gap analysis and pilot scope.
2. **Pilot** (1-4 months) — Deploy components on your infrastructure. Architectural deep dive, integration design, deployment, cryptographic verification. If closing the trust boundary requires components that don't exist yet, we build them. No strings attached — license or walk away.
3. **Production** — Full deployment with ongoing support. On-prem, bare metal, all major clouds.

## Documentation

- [Documentation](https://confidential.ai/docs)
  - [Confidential Agents API](https://confidential.ai/docs/api/confidential-agents)
  - [Attested Builds](https://confidential.ai/docs/attested-builds)
  - [How Attested Builds Work](https://confidential.ai/docs/attested-builds/how-it-works)
  - [Provenance & Standards](https://confidential.ai/docs/attested-builds/provenance-standards)
  - [Threat Model & Security Boundaries](https://confidential.ai/docs/attested-builds/threat-model)
  - [What Are Attested Builds?](https://confidential.ai/docs/attested-builds/what-are-attested-builds)
  - [Overview](https://confidential.ai/docs/c8s)
  - [Limitations](https://confidential.ai/docs/c8s/limitations)
    - [Components & Data Flow](https://confidential.ai/docs/c8s/architecture/components)
    - [Threat Model](https://confidential.ai/docs/c8s/architecture/threat-model)
    - [The Allowlist](https://confidential.ai/docs/c8s/attestation/allowlist)
    - [CDS Bootstrapping & Verification](https://confidential.ai/docs/c8s/attestation/cds)
    - [Provisioning a confidential cluster on Azure (AKS)](https://confidential.ai/docs/c8s/install/azure)
    - [CLI Reference](https://confidential.ai/docs/c8s/install/cli-reference)
    - [Installing c8s](https://confidential.ai/docs/c8s/install/installation)
    - [Kata Containers](https://confidential.ai/docs/c8s/runtime/kata-containers)
    - [Pod-as-CVM vs Node-as-CVM](https://confidential.ai/docs/c8s/runtime/pod-vs-node-cvm)
    - [Deploy a confidential AKS cluster and run c8s](https://confidential.ai/docs/c8s/tutorials/azure-e2e)
    - [Deploy NVIDIA Dynamo as a confidential workload](https://confidential.ai/docs/c8s/tutorials/dynamo)
    - [Serving a confidential model with KServe](https://confidential.ai/docs/c8s/tutorials/kserve)
    - [Verified chat over confidential vLLM](https://confidential.ai/docs/c8s/tutorials/vllm-chat)
    - [Operator & service verification](https://confidential.ai/docs/c8s/verification/cli)
    - [Consumer & browser verification](https://confidential.ai/docs/c8s/verification/consumer)
  - [Introduction to TEEs](https://confidential.ai/docs/concepts/intro-to-tees)
  - [Zero-Knowledge Proofs](https://confidential.ai/docs/concepts/zk)
    - [Confidential Computing Primer](https://confidential.ai/docs/concepts/confidential-computing-primer)
    - [Threat Model & Security Boundaries](https://confidential.ai/docs/concepts/confidential-computing-primer/01-threat-model)
    - [Hardware Foundations](https://confidential.ai/docs/concepts/confidential-computing-primer/02-hardware-foundations)
    - [Memory Integrity](https://confidential.ai/docs/concepts/confidential-computing-primer/03-memory-integrity)
    - [Privilege & Communication](https://confidential.ai/docs/concepts/confidential-computing-primer/04-privilege-and-communication)
    - [Attestation & Verification](https://confidential.ai/docs/concepts/confidential-computing-primer/05-attestation)
    - [Measurement Strategies](https://confidential.ai/docs/concepts/confidential-computing-primer/06-measurement-strategies)
  - [c8s: A Confidential Kubernetes Architecture](https://confidential.ai/docs/whitepapers/c8s)
  - [Kettle: Attested Builds](https://confidential.ai/docs/whitepapers/kettle)

## Blog

- [c8s Is Now Generally Available](https://confidential.ai/blog/c8s-ga)
- [C8s: Kubernetes, Made Confidential](https://confidential.ai/blog/c8s-launch)
- [Confidential Agents](https://confidential.ai/blog/confidential-agents-launch)
- [Open-sourcing our Confidential Virtual Machine builder](https://confidential.ai/blog/cvm-builder)
- [The Isolation Spectrum: From Plaintext to TEEs](https://confidential.ai/blog/isolation-spectrum)
- [Kettle: Attested Builds from a TEE](https://confidential.ai/blog/kettle-attested-builds)
- [Lunal Becomes Confidential](https://confidential.ai/blog/lunal-becomes-confidential)
- [A New Mark for Confidential](https://confidential.ai/blog/new-logo)
- [PrivateClaw launches on Confidential: E2E Private AI Agents](https://confidential.ai/blog/privateclaw-launch)
- [Secure AI Needs TEEs](https://confidential.ai/blog/secure-ai-needs-tees)
- [TEE Performance on CPUs](https://confidential.ai/blog/tee-performance-cpus)

## Company

- [Team](https://confidential.ai/team): The people building Confidential.
- [Careers](https://confidential.ai/careers): Open positions at Confidential.
- [Email](mailto:hello@confidential.ai): hello@confidential.ai

## All Pages

Complete index of top-level pages:

- [Confidential AI](https://confidential.ai/)
- [Attested Builds](https://confidential.ai/attested-builds)
- [Confidential Cloud](https://confidential.ai/cloud)
- [Confidential Agents](https://confidential.ai/confidential-agents)
- [Confidential Inference](https://confidential.ai/confidential-inference)
- [Confidential VMs](https://confidential.ai/confidential-vms)
- [Pricing](https://confidential.ai/pricing)
- [Products](https://confidential.ai/products)
- [c8s-docs Style Guide](https://confidential.ai/STYLE_GUIDE)
- [Team](https://confidential.ai/team)

## Full Documentation

- [llms-full.txt](https://confidential.ai/llms-full.txt): Complete content from all pages — entire site in one file.