Private AI landscape
Who can tie a prompt to you, and who can take the service away.
Every score shows its evidence
Tap a score for its reason and sources.
- Scored on paid use, paying the most private way each product allows. Where a score still depends on setup, the lower one is shown.
Two questions, one map
Each setup sits at its average score for each question.
Scroll sideways to see the whole map. Tap a dot for its scores.
- Across: the average of the eight scores on tying a prompt to you. Up: the average of the three on taking the service away. Dots at the same spot share a label.
- Not on the map: a model on your own machine, which would sit in the top right corner. Its limit is model size.
If the company quits tomorrow
What stops, and what keeps running.
How the scores work
One setup per row
Each row is one way of using a product, scored on paid use and the most private way to pay that the product allows. Where a score still depends on setup, the lower one is shown, and a row that covers two products shows the lower of the two.
Scores and sources
Each column is a statement. 5 means fully true and 0 means not at all. Every score links to the public sources it rests on, checked 22 October 2026. The sources describe the products. They don't issue these scores. Where the awesome-private-inference registry audits a product, the scores were checked against its findings too.
TEEs and attestation
A trusted execution environment is hardware that keeps data sealed from the machine's owner. Attestation is its signed proof of which code it runs, which software can check before sending a prompt.
Attestation shows which code reads a prompt first. It doesn't always show who runs the model after that, so the scores follow the prompt along the whole path.
Not scored
Model quality, speed and price. Physical attacks on servers, which researchers have shown work against attested hardware, apply to every attested row alike.
Common questions
Why does Confer score below Tinfoil?
Confer measures all of its code, but not its configuration or model. Every service reads an operator-supplied file outside the measurement, which also sets where a built-in log shipper sends the system logs, and the model weights load from an unmeasured disk. Tinfoil measures its configuration and pins the model weights by hash.
Why do the TEE companies score so low on the second question?
Each service depends on one company, which runs the gateway or router and decides which servers get work. However strong the hardware, the service ends if that company stops.
Is attested hardware enough?
It's strong, not absolute. TEE.fail, research presented at IEEE S&P 2026, showed that someone with physical access to a server and under $1,000 of parts can read secrets from Intel TDX and AMD SEV-SNP machines with DDR5 memory. On Intel it pulled out the machine's attestation key and forged reports that pass Intel's checks, and a faked machine can borrow a real NVIDIA GPU's attestation. That takes a hostile data center, not a remote attacker, and it applies to every attested row here.
The hardware is also only one part. The awesome-private-inference registry checks the software around it, route by route, and publishes dated findings rather than grades. Its companion DevProof audits show how software can undo the hardware: in a controlled test on Chutes, operator code passed one caller's decrypted prompts to another on genuine TEE hardware.
The registry doesn't cover every setup here yet. A service whose code is closed can't pass DevProof's Stage 1 checklist, the bar for a service whose operator can't change its code or take data without notice.
Can I use GPT, Claude or Gemini privately?
Not in the sense this page measures. GPT, Claude and Gemini are closed models. Their makers run them, and so do big clouds: OpenAI's models on Microsoft Azure, and Claude on Amazon Bedrock and Google Cloud. Those clouds don't pass your prompt to the model maker, but the cloud can read it, and only a contract limits what it does. OpenAI's open-weight gpt-oss models are the exception. Tinfoil, for one, runs them in attested hardware.
What's more private than everything here?
A model on your own machine. With an open-source app and web search off, nothing leaves it. There's no account or payment to trace, and no company can switch it off. The limit is model size, which is why this page compares cloud services.
Why score paid use only?
Free tiers change often and come with limits, and regular use is usually paid.
Why is open code its own column?
Attestation proves which code is running. Public code lets anyone read what that code does. Checking a privacy claim yourself takes both.
Who made this page?
ZeroSignal, one of the products compared, scored by the same rules as the rest. Every score shows its sources so you can check it.
How do I suggest a change?
Email [contact email] with the product, the column, the score you'd give and a link to your source.