The Confidential option

Proven on real hardware, offered by arrangement

On 28 Sep 2026 we ran the whole setup for a day on a rented confidential-computing GPU (an NVIDIA H200 in an Intel TDX confidential VM). There is no permanent confidential node yet: we set one up for you when you sign, and until then this page describes a tested pilot, not a live service.

• 3,329 · 0 errorssealed requests in a 30-minute load test at 1, 8 and 32 at a time
• 33 of 33tools ran end to end through the enclave on their samples and passed their checks
• 249 of 249sealed receipts from those runs checked out offline afterwards

What the pilot showed, in detail, is below. All data was synthetic.

What it is

1. 01

   The tool runs on your server

   The same container you would self-host, on an ordinary server or VM with no GPU. It holds your documents and does the checks, citations and signed records. (The GPU and Mac sizes on each use-case page are for running the model yourself; with this tier you don't need them.)
2. 02

   The model runs in an attested enclave

   Qwen3.8-27B runs on a shared confidential node (or one dedicated to you), inside a confidential VM on a GPU in confidential-computing mode (in the pilot: Intel TDX and an NVIDIA H200). The chips produce a signed report of exactly which software and which model weights are running.
3. 03

   Nothing is sent until the report checks out

   Before its first call, the container checks that report against the policy we publish for your node (software hash, weights, hardware state). If anything differs, it refuses to send.
4. 04

   Each call is sealed to the enclave

   Every prompt is encrypted to a key that was created inside the enclave and never leaves it. The answer comes back encrypted, signed by that key, with a receipt signed inside the enclave. Keep the receipts: they check out offline later.

What the pilot showed

One rented node (Phala Cloud: Intel TDX, NVIDIA H200 in confidential-computing mode, dstack OS 0.5.9) for one day, 27–28 Sep 2026. Synthetic data only. These are pilot numbers, not a service-level promise.

• The hardware report checks out. The CPU report chains to Intel's root with an up-to-date security level; the GPU report from NVIDIA shows confidential-computing mode on; the software hash matches our build byte for byte; the encryption key is bound into the report.
• A second, independent checker agrees. Phala's open-source dstack-verifier recomputed the operating-system measurements from the published image and agreed with ours on every pinned value.
• 190 of 190 receipts checked out offline, with network access blocked.
• It fails closed. During a software update, 18 calls in flight were refused rather than answered without a valid report.
• 3,329 sealed requests, 0 errors across the three load levels below. Every request was encrypted on our side, opened in the enclave, and sealed, signed and checked on return.

For comparison, our production GPU (not confidential) does 132 tokens/s on one request and 1,173 at 32 in parallel. Sealing adds about 1 second per request.

Real tools through the enclave

• Legal: deposition digest

  Two fictional depositions; finds the time-of-fall contradiction, checks every sentence against its lines, signs the record

  13.8 s median · checks 3 of 3

• Financial: SAR narrative check

  Planted errors caught, signed report checks out

  1.9 s median · checks 3 of 3

• Medical: clinical considerations

  A chest-pain transcript: the red flag with its quote and source; the decision record checks out

  5.3 s median · checks 3 of 3

Three runs each, unmodified use-case code with every model call sealed. The medical run is a measurement only: patient data waits for a BAA.

How you check it

Your node comes with a kit: its published policy, the attestation bundle, the key document, and the checking tool with its source. The steps below don't rely on our word or on our servers. They do rely on the chip makers' signing keys (see the limits).

1. 01

   Check the attestation, offline

   The chip vendors' roots are pinned in the tool and the bundle carries the vendor data it needs, so this runs with no network:

   python -m decosa_api.confidential.verify \
     --bundle bundle.json --policy policy.json \
     --key-doc key_doc.json --at collected

   Exit code 0 means: genuine Intel and NVIDIA hardware in confidential mode, the exact software and weights in the policy, and this encryption key.

2. 02

   Check each receipt

   The receipt names that attestation, the answer is signed by the attested key, and the answer's hash matches. The kit's receipt checker does this for a whole folder of calls.
3. 03

   Rebuild the software hash

   Rebuild the node's compose file from the tagged release with our deterministic build script and compare its hash with the one in the report.
4. 04

   Recompute the operating system

   Phala's open-source dstack-verifier recomputes the OS measurements from the published image, independently of our tool.

Which tools can run on it

Marked "tested end to end" when every model the tool calls runs inside the attested enclave: the language model (Qwen3.8-27B) and, since 28 Sep 2026, speech recognition (Voxtral realtime), the diarizer, the document reader (Docling layout and PaddleOCR-VL) and evidence retrieval (Qwen3 embedder and reranker), and image input to the language model. Marked "needs more work" when the tool also needs a model that still runs outside the enclave (translation, video input, media generation, the music similarity model, the paper parser), or when it handles patient data, which waits for a business associate agreement. No badge when the input is not confidential.

Worked out from the backend code (which model services each tool calls), commit add3be2, 2026-09-28, then reviewed by hand.

Honest limits

• It's a pilot. The results above come from one node rented for one day. There is no standing node yet: we set one up for you when you sign, and it runs on one machine, with no failover yet.
• Not for patient data yet. No cloud provider we can use offers a business associate agreement (BAA) that clearly covers confidential GPUs, and an enclave doesn't remove the need for one. Until we have a signed BAA, don't send PHI.
• Our checking tool hasn't had an outside review yet. It agrees with Phala's independent verifier on real hardware, and a third-party review is planned before general availability.
• Someone with physical access could still attack it. Published attacks with a memory-bus interposer (TEE.fail, DDRop) can break these enclaves. The node sits in the provider's data centre, not with an individual operator.
• You trust the chip makers and the provider's enclave OS. Intel and NVIDIA sign the reports. The provider's OS runs inside the enclave; it is open source and measured, and we pin its measurements.
• Some things stay visible: which model, request and answer sizes, timing and billing. The host can also switch the node off.
• It is still a third-party service. The enclave narrows who could read your material, but whether privileged or client material may go to any outside service is your firm's call. Self-hosting on your own GPU remains the most private option, and each use case's page still recommends it for real matters.
• Attestation is not quality. It proves which code and model ran, not that the output is right. Each tool's eval results and their caveats are on its metrics page.
• Paperwork your security review will ask for. We don't have a SOC 2 report of our own yet. The pilot node's host is Phala Cloud (SOC 2 Type I, December 2025). Ask us for the draft terms, data processing terms and subprocessor list when we reply, and we'll tell you plainly what exists and what doesn't.
• What runs inside today. The language model (with image input), live speech recognition, the diarizer, the document reader and retrieval, each pinned by hash and checked at boot (28 Sep 2026 pilot). Tools that also need translation, video input or media generation are marked “coming”. Your own container does the rest of the work on your server.

For law firms: the attestation, no training on your inputs, and the fact that we can't read your prompts may help you document the “reasonable efforts” your confidentiality duty asks for (ABA Model Rule 1.6(c), Formal Opinion 512, 29 July 2024). Whether they are enough is your judgment, and they don't replace client consent where Opinion 512 calls for it. This is not legal advice.

Pricing

• Dedicated enclave: a monthly minimum reserves your own node, and your usage is drawn from it first. Shared (standard): we quote it when we talk.
• Usage is billed at 2× the list price: tokens and use-case prices both.
• We quote the minimum when we talk. It depends on the term and the hardware.
• No payment is taken on this site.