An independent position paper

Let's encrypt AI.

Our goal: protect AI chats with confidential computing on most AI GPUs by the end of 2027.

Read our position

Buy compute. Keep your ideas.

Use confidential AI today
01 / The convictionYour work belongs to you.

A prompt is someone's work.

A discovery. A business plan. A private conversation. A line of code that took years of experience to write.

We are putting more of our lives into AI. The next generation of models will help us think, build, diagnose, negotiate and invent. The value in those conversations belongs to the people having them.

Paying for an answer should buy you an answer. It should never quietly give a model trainer a free copy of your ideas, your customers' secrets or your company's intellectual property.

Access to intelligence should come with ownership of your own thinking.

Training on someone's data should be a separate, informed agreement: permission, clear terms and compensation. Our private work should stay outside the training pipeline unless we choose to put it there.

We can build that boundary into the machines. The technology is here. Now we need to make it ordinary.

02 / The standardPrivacy with proof.

Encrypt the work.
Verify the machine.

Encryption protects data on the wire and on disk. Confidential computing extends protection into the place where AI actually runs: the CPU and GPU.

A trusted execution environment, or TEE, isolates sensitive execution from the host operator. Remote attestation lets a client check evidence about the hardware and approved software before it releases sensitive data.

  1. Protect the whole route.

    Keep prompts, responses, caches and transfers within a protected path, from the client to attested CPU and GPU execution and back.

  2. Make the software inspectable.

    Publish the security-critical source, build measurements and verification tools. Bind the encrypted connection to the approved workload.

  3. Keep content under the user's control.

    Reviewed software must enforce the content-logging and reuse policy. An enclave alone can still run code that copies your data.

  4. Make verification a condition of service.

    Verify the actual route. Stop when its evidence fails. Give customers explicit control over every fallback and external tool.

The boundary matters: a confidential gateway is only one part of the route. Hardware and firmware flaws, compromised clients, untrusted software and external tools still matter. Review each service's threat model, retention terms and exact model route. Read a detailed threat model.

03 / Already possibleStart with one workload.

Use it today.

Private AI is already available. These are places to start, across enterprise buying, developer APIs and everyday chat. Select the confidential offering and check its verification requirements.

And growing. The goal is an open ecosystem.

Suggest a service

Inclusion is an invitation to evaluate a service, rather than a certification or a claim that its team endorses this position. Offerings and guarantees vary by route.

04 / The leverageLet demand change the default.

Open models can move the whole market.

Start with open-weight models. Make encrypted AI chats, backed by verified confidential computing, an everyday experience.

As more people and companies choose those services, their spending creates demand for the same protection everywhere. Every workload moved and every contract that requires attestation gives the next provider a reason to offer it.

Our aim is to make that demand strong enough that OpenAI, Anthropic and other frontier labs have to offer verifiable confidential computing to win those customers. People should be able to choose the model they want while keeping their conversations private.

First an option. Then an expectation. Eventually, the default.

That is how we intend to change the market: make private AI useful today, reward the providers that deliver it, and make privacy a condition of winning tomorrow's business.

Protect customers' secrets, too.

Anthropic already makes the case. Its research on confidential inference describes work to protect both model weights and user data, using measured software and controlled release of decryption keys.

Our ask to the labs: extend that work into a customer-verifiable service. Give customers attestation, a connection bound to approved code, and clearly stated protections for prompts and responses across the whole route. Make the protection available to customers. Then make it the default.

Anthropic presents this as early research, rather than a shipped customer guarantee. Its interim design still relies on compute providers for physical and hypervisor security; detailed API-server protection is outside the article's scope. Closing those gaps is part of the work.

05 / The goal31 December 2027

Make confidential computing the default for AI chats.

By the end of 2027, we want AI chats protected by verifiable confidential computing on most AI GPUs. The goal is to protect people's prompts, responses and context while they are processed.

Start today

Move one workload.

Run a real task on a verified confidential route. Compare cost, quality, latency and evidence.

Build through 2027

Make it routine.

Put verification into SDKs, route selection and procurement. Publish the evidence and the gaps.

By year-end 2027

Make it the norm.

Buyers ask for attestation. Operators protect AI chats during inference. Model builders compete on intelligence.

This is a goal, rather than a claim about adoption today. Counting progress requires a published definition of protected AI chats, an inventory of GPUs serving those chats and evidence that the conversations stay within verified confidential execution.

A better bargain for everyone

More intelligence.
Ownership of your ideas.

Builders: make private AI easy. GPU operators: make it available. Buyers: make it a requirement. Together, we can change what people expect from AI.

Find a confidential AI service