What is Private AI?

Q: Can I run private AI in the cloud?

Yes. TEE hardware locks the cloud provider out, so you get cloud-scale GPUs without cloud-scale visibility. You can rent the machine and still be the only one who can see inside it.

Private AI is AI that runs without exposing anything to the infrastructure it runs on. Prompts, responses, model weights, and agent state are never visible to the provider or the operator. Not as a policy. As a property of the hardware.

Most AI billed as private is a promise in a contract. Real private AI is enforced by silicon and provable by cryptography. You should not have to trust anyone: not the cloud, not the platform, not us.

The approaches to private AI

There are three ways to keep AI private. They are not equal.

Local models

Run the model on your own device. Nothing leaves the machine, so nothing leaks. For small models this is real privacy, and it works.

The limit is hardware. Frontier open-weight models need racks of GPUs, not a laptop. Local gets you privacy at the cost of capability, context, and speed.

On-prem deployment

Buy the GPUs. Run the models in your own datacenter. You get privacy from cloud providers, full control, and real capability.

You also get capex, power contracts, and an ops team. And the privacy is organizational, not provable. Your own admins can still read memory. Your customers still get a promise, not a proof.

Trusted execution environments

Trusted Execution Environments (TEEs) are isolated environments built into modern CPUs and GPUs. Data in Confidential VM memory is encrypted by the hardware. Model weights sit in the GPU's hardware-protected region. The host, the hypervisor, and the operator are locked out by the silicon itself. And the hardware signs an attestation proving exactly what code processed your data.

TEEs are the only approach that combines privacy, verifiability, and cloud-scale hardware.

Approach	Privacy	Verifiable by third parties	Frontier-scale hardware
Local models	Yes, physical	No	No
On-prem	From the cloud, not from insiders	No	Yes, at high capex
TEEs	Yes, hardware-enforced	Yes, cryptographic attestation	Yes, rented or owned

"Trust us" is not private AI

Every AI provider says they will not look at your data. That is contractual privacy: a policy, a promise, a terms-of-service clause. It can be changed, subpoenaed, or quietly violated, and you would never know.

Cryptographic privacy is different. The hardware refuses to expose your data, and it signs a proof of what ran. You verify the proof yourself. No trust required. That is the bar for calling AI private.

Private AI, done right, is confidential AI

Private AI with proof has a name: confidential AI. AI that runs on confidential computing hardware, sealed inside TEEs, with a signed attestation behind every claim. Private is the promise. Confidential is the mechanism that keeps it, plus the receipt that proves it.

The distinction matters. Anyone can claim their AI is private. Confidential AI is checkable: the enclave attests or it does not. When we say confidential AI, we mean private AI you can verify.

How Confidential delivers confidential AI

Confidential runs AI workloads inside TEEs, with an attestation on every result:

Confidential Inference: private AI inference behind an OpenAI-compatible API. Swap one base URL. Prompts and responses stay invisible to us, with an attestation on every response.
Confidential Agents: private, isolated Confidential VMs for AI agents, ready over SSH in seconds. Code, data, and keys stay invisible to the infrastructure.
Confidential VMs: dedicated TEE-backed GPU and CPU VMs for inference, training, and fine-tuning.
Confidential Kubernetes (C8s): turns any Kubernetes cluster confidential, so private AI scales to a whole platform.

Private AI: common questions

Is private AI slower?

Barely. Confidential inference runs at 4% lower token throughput than non-confidential inference, with negligible impact on time to first token. On CPUs, TEE overhead measures around 1.5% on compute-heavy workloads.

Can I run private AI in the cloud?

Yes. That is the point of TEEs. The hardware locks the cloud provider out, so you get cloud-scale GPUs without cloud-scale visibility. You can rent the machine and still be the only one who can see inside it.

What is the difference between private AI and confidential computing?

Confidential computing is the mechanism: hardware TEEs, memory encryption, attestation. Private AI is the outcome: AI workloads nobody else can see or tamper with. Confidential computing is how you get private AI with proof.

Is private AI the same as local AI?

No. Local AI is one way to get privacy, limited by the hardware you own. Private AI is the broader property: AI that is invisible to everyone but you, whether it runs on your laptop, your datacenter, or rented TEE hardware.

How do I verify that my AI is actually private?

Attestation. The TEE hardware signs a report of exactly what code booted and what environment it runs in. You check that signature against the hardware vendor's root of trust. If the report does not match, you do not send data.

Do I need to change my code?

No. Private AI inference is an OpenAI-compatible API: switch the base URL and keep the rest. VMs and Kubernetes workloads run unchanged inside Confidential VMs.