{ "checked": "2026-10-22", "cols": [ { "key": "identity", "g": "tie", "name": "Identity", "head": [ "Identity" ], "q": "Your account, if any, says nothing about who you are.", "r": { "0": "Your main identity account, such as Google or Meta.", "1": "An account tied to your email and billing details.", "2": "An account tied to an email or a social login.", "3": "An account whose reach depends on how you sign in and pay.", "4": "A pseudonymous key or address that publicly links your sessions but carries no name.", "5": "No account, or only a key on your device that nothing public ties together." } }, { "key": "pii", "g": "tie", "name": "No PII to use", "head": [ "No PII", "to use" ], "q": "Needs no personal info at all, not even an email.", "r": { "0": "A phone number or your main identity account.", "1": "An email and billing details at minimum.", "2": "An email or social login, or card details to pay.", "3": "Personal details are optional, depending on how you sign in or pay.", "4": "Nothing is required, but a common way to pay shares some.", "5": "Nothing personal is asked for." } }, { "key": "payment", "g": "tie", "name": "Payment", "head": [ "Payment" ], "q": "Paying doesn't trace back to you.", "r": { "1": "Card billing on an account that also holds your chats.", "2": "Card or app-store billing, kept apart from what you asked.", "3": "Crypto is accepted, but tied to an account or visible on a public ledger.", "4": "Crypto you hold, with no account. The address is public but carries no name.", "5": "A privacy coin or cash, with nothing tied to you." } }, { "key": "prompt", "g": "tie", "name": "Prompt secrecy", "head": [ "Prompt", "secrecy" ], "q": "Whoever runs the model can't read your prompt.", "r": { "0": "The company reads it and can keep it or train on it.", "2": "The operator can read it. Only a policy or contract says it won't keep it.", "3": "Plaintext reaches a gateway, relay or other software that isn't attested, or whose code nothing compares to a public build. Transport encryption such as TLS doesn't count unless its key exists only inside the enclave.", "4": "Encrypted on your device to attested hardware, with a gap, such as only the CPU side attested or configuration outside the measurement.", "5": "Prompt and reply are encrypted on your device to a key only attested hardware holds, and open only there. Everything that handles them, including the GPU, the configuration and the model server, is measured and matches public builds. No relay or gateway in between can read them." } }, { "key": "split", "g": "tie", "name": "IP/Prompt split", "head": [ "IP/Prompt", "split" ], "q": "No single party sees both your IP and your prompt.", "r": { "0": "One company sees both and keeps your chats.", "1": "One company sees both. Only its policy keeps them apart.", "2": "Split only in an optional mode, or across servers one company runs.", "3": "The party that sees your IP sees only ciphertext. The prompt opens only inside attested hardware.", "5": "Different parties see your IP and your prompt, by design." } }, { "key": "history", "g": "tie", "name": "Local history", "head": [ "Local", "history" ], "q": "Your chat history stays on your device.", "r": { "0": "Kept on the company's servers, readable by it.", "2": "Stored by the company's apps, or kept locally while the company may keep your inputs.", "3": "Stored by the service, which can open it, or storage isn't documented.", "4": "On your device, with copies on the company's servers by default or in a mode the company can open.", "5": "On your device. Any sync is optional and opens only with your key." } }, { "key": "attested", "g": "tie", "name": "Hardware attested", "head": [ "Hardware", "attested" ], "q": "You can check the hardware that seals your prompt.", "r": { "0": "Nothing to check.", "1": "The host attests, but you have no way to check it.", "2": "Only on some nodes or models, which you have to choose.", "3": "You can check through an API or by hand, or part of the stack, such as its configuration or model, isn't measured or matched to a public build.", "4": "Your client checks before sending, with a gap, such as only the CPU side.", "5": "Before sending, your client checks the whole machine against public builds: boot chain, every service, its configuration and the model, with the GPU covered." } }, { "key": "opencode", "g": "tie", "name": "Open code", "head": [ "Open", "code" ], "q": "The code that handles your prompt is public to read.", "r": { "0": "None of it.", "1": "Only a small part, such as the enclave behind a closed relay.", "2": "Some parts, but not the service in between.", "4": "Most of it. Some parts are closed or unconfirmed.", "5": "All of it, with reproducible builds that match what runs." } }, { "key": "serve", "g": "take", "name": "Anyone can serve", "head": [ "Anyone", "can serve" ], "q": "Independent operators can run the models.", "r": { "0": "One company runs every model.", "1": "A few partner companies the service picks.", "2": "Outside providers can join, but the company vets them and assigns work.", "4": "Independent operators serve after an automated hardware check.", "5": "Anyone can join and serve, without approval." } }, { "key": "kill", "g": "take", "name": "Hard to kill", "head": [ "Hard", "to kill" ], "q": "It keeps running if the company behind it quits.", "r": { "1": "The product stops.", "2": "Every request passes through the company's API. Open code would let someone restart it.", "3": "The default gateway and app go, but documented direct paths still work.", "4": "The network keeps serving. Only the website, app or gateway goes.", "5": "Nothing central to stop." } }, { "key": "routing", "g": "take", "name": "Client routing", "head": [ "Client", "routing" ], "q": "Your app picks the server, not a central proxy.", "r": { "1": "A central proxy picks the server and passes your prompt along.", "2": "A central service picks the server, but your app verifies it before sending.", "5": "Your app reads a public registry or market and connects to the server it picks." } } ], "groups": [ { "key": "open", "name": "Open networks" }, { "key": "tee", "name": "TEE companies" }, { "key": "router", "name": "Routers and proxies" }, { "key": "main", "name": "Mainstream AI" } ], "groupNames": { "open": "Open networks", "tee": "TEE companies", "router": "Routers and proxies", "main": "Mainstream AI" }, "products": [ { "id": "zs-att", "name": "ZeroSignal", "mode": "TEE nodes", "group": "open", "reason": "Hidden from the operator. The model runs inside a CPU enclave, but the GPU isn't attested.", "setup": "Web app at zerosignal.ai or its IPFS copy, with Only use attested nodes on and a model its node runs inside the enclave (the model's details show this), or zs-proxy requiring attested nodes, funded with crypto, relays on (the default).", "quits": "The hosted web app and the ipfs.zerosignal.ai address stop. Operators, the public registry and zs-proxy keep working, and your recovery phrase opens your account on any copy of the web app someone pins. Chats saved under one address move by export or sync.", "notes": [ [ "Scored on a node that runs the model inside the enclave. The one TEE node live today instead forwards prompts to xAI, which confirms zero retention but isn't attested.", [ "zs-cc" ] ], [ "On a standard node, the operator can read the prompts it processes.", [ "zs-privacy" ] ], [ "Payments are publicly visible on a ledger, under a stable address that isn't your name.", [ "zs-privacy" ] ], [ "The default ledger node sees your IP next to that address. Your own node or a VPN avoids that.", [ "zs-privacy" ] ], [ "Web search is on by default. With it on, search queries and page addresses leave attested hardware.", [ "zs-limits" ] ], [ "An admin can evict an operator acting in bad faith, slash part of its stake and update the contracts.", [ "zs-staking", "zs-registry" ] ], [ "The network is small today, with three registered operators. The split relies on the relay and the node having different owners.", [ "zs-relays", "zs-registry" ] ], [ "If the company quit, the ipfs.zerosignal.ai address and its pin would lapse. The app keeps working from any copy someone pins.", [ "zs-ipfs" ] ] ], "s": { "identity": 4, "pii": 5, "payment": 4, "prompt": 4, "split": 5, "history": 5, "attested": 4, "opencode": 0, "serve": 5, "kill": 5, "routing": 5 }, "w": { "identity": "A passkey on your device is the account, with no email or password. Your balance has a public address that groups your payments together but carries no name.", "pii": "Nothing personal is needed when you fund with crypto. Card funding runs through Coinbase, which verifies your identity.", "payment": "You pay per message from a balance you hold. Payments settle on a public ledger under a stable address that isn't your name. Anyone can see which payments came from it, when and how much, but not what you asked.", "prompt": "The operator can't read it. The node opens it inside a CPU enclave and runs the model there, but the GPU isn't in confidential mode, so GPU memory isn't covered. Web searches leave the enclave.", "split": "A relay run by a different operator sees your IP but not the request. The answering node sees the prompt and only the relay's address.", "history": "Chats are stored encrypted on your device. Optional sync goes to a folder or bucket you choose, encrypted with a key from your passkey.", "attested": "Your browser checks each node's CPU attestation, including firmware and boot measurements, before sending and shows a badge. It also proves which model weights the node loaded, to the byte. The GPU isn't attested.", "opencode": "The node, the app and zs-proxy ship as binaries. Their source code isn't public yet.", "serve": "Anyone can register an operator by staking $250, with no application or approval step.", "kill": "Operators, the public registry and zs-proxy keep working without the company. The web app is also on IPFS, so anyone can keep pinning it or run it from their own IPFS node, and your recovery phrase restores your account on any copy. Today the company can still evict operators and update the contracts.", "routing": "Your app reads the public operator registry, probes each operator and picks one. Requests reach it through a relay, not a central proxy. The browser app does this itself: no gateway and no sign-up." }, "src": { "identity": [ "zs-passkeys", "zs-privacy" ], "pii": [ "zs-funding", "zs-pp" ], "payment": [ "zs-privacy", "zs-funding" ], "prompt": [ "zs-cc", "zs-privacy" ], "split": [ "zs-network", "zs-relays" ], "history": [ "zs-conv", "zs-sync" ], "attested": [ "zs-verify", "zs-cc" ], "opencode": [ "zs-node-repo", "zs-proxy-repo" ], "serve": [ "zs-network", "zs-staking" ], "kill": [ "zs-network", "zs-staking", "zs-registry", "zs-ipfs" ], "routing": [ "zs-network" ] }, "map": "ZeroSignal, TEE nodes" }, { "id": "zs-any", "name": "ZeroSignal", "mode": "any node", "group": "open", "reason": "Same network, any operator. That operator can read the prompt, not who sent it.", "setup": "Web app at zerosignal.ai or its IPFS copy, or zs-proxy, with any node allowed (the default), funded with crypto, relays on.", "quits": "The hosted web app and the ipfs.zerosignal.ai address stop. Operators, the public registry and zs-proxy keep working, and your recovery phrase opens your account on any copy of the web app someone pins. Chats saved under one address move by export or sync.", "notes": [ [ "On a standard node, the operator can read the prompts it processes.", [ "zs-privacy" ] ], [ "Payments are publicly visible on a ledger, under a stable address that isn't your name.", [ "zs-privacy" ] ], [ "The default ledger node sees your IP next to that address. Your own node or a VPN avoids that.", [ "zs-privacy" ] ], [ "Web search is on by default. With it on, search queries and page addresses leave attested hardware.", [ "zs-limits" ] ], [ "An admin can evict an operator acting in bad faith, slash part of its stake and update the contracts.", [ "zs-staking", "zs-registry" ] ], [ "The network is small today, with three registered operators. The split relies on the relay and the node having different owners.", [ "zs-relays", "zs-registry" ] ], [ "If the company quit, the ipfs.zerosignal.ai address and its pin would lapse. The app keeps working from any copy someone pins.", [ "zs-ipfs" ] ] ], "s": { "identity": 4, "pii": 5, "payment": 4, "prompt": 2, "split": 5, "history": 5, "attested": 2, "opencode": 0, "serve": 5, "kill": 5, "routing": 5 }, "w": { "identity": "A passkey on your device is the account, with no email or password. Your balance has a public address that groups your payments together but carries no name.", "pii": "Nothing personal is needed when you fund with crypto. Card funding runs through Coinbase, which verifies your identity.", "payment": "You pay per message from a balance you hold. Payments settle on a public ledger under a stable address that isn't your name. Anyone can see which payments came from it, when and how much, but not what you asked.", "prompt": "A standard node decrypts the prompt to run it, so its operator can read it, as can any hosted provider it forwards to. Its retention badge is the operator's own declaration.", "split": "A relay run by a different operator sees your IP but not the request. The answering node sees the prompt and only the relay's address.", "history": "Chats are stored encrypted on your device. Optional sync goes to a folder or bucket you choose, encrypted with a key from your passkey.", "attested": "TEE nodes exist, but standard nodes have nothing to check. A badge shows which is which.", "opencode": "The node, the app and zs-proxy ship as binaries. Their source code isn't public yet.", "serve": "Anyone can register an operator by staking $250, with no application or approval step.", "kill": "Operators, the public registry and zs-proxy keep working without the company. The web app is also on IPFS, so anyone can keep pinning it or run it from their own IPFS node, and your recovery phrase restores your account on any copy. Today the company can still evict operators and update the contracts.", "routing": "Your app reads the public operator registry, probes each operator and picks one. Requests reach it through a relay, not a central proxy. The browser app does this itself: no gateway and no sign-up." }, "src": { "identity": [ "zs-passkeys", "zs-privacy" ], "pii": [ "zs-funding", "zs-pp" ], "payment": [ "zs-privacy", "zs-funding" ], "prompt": [ "zs-privacy", "zs-models" ], "split": [ "zs-network", "zs-relays" ], "history": [ "zs-conv", "zs-sync" ], "attested": [ "zs-models", "zs-privacy" ], "opencode": [ "zs-node-repo", "zs-proxy-repo" ], "serve": [ "zs-network", "zs-staking" ], "kill": [ "zs-network", "zs-staking", "zs-registry", "zs-ipfs" ], "routing": [ "zs-network" ] }, "map": "ZeroSignal, any node" }, { "id": "morpheus", "name": "Morpheus", "mode": "native node", "group": "open", "reason": "Open providers anyone can join. Skip its hosted gateway, which is centralized.", "setup": "A consumer node you run yourself, opening sessions directly with providers on any model. Not the hosted gateway.", "quits": "The hosted gateway would stop. Providers, the contracts and your own node keep working.", "notes": [ [ "Scored on any model. TEE-tagged models are scored in their own row.", [ "mor-tee" ] ], [ "In a browser without your own node, chat goes through Morpheus's hosted gateway at app.mor.org, which needs a social-login account and an API key. This row scores the private path, which means running your own node.", [ "mor-full", "mor-signup" ] ] ], "s": { "identity": 4, "pii": 5, "payment": 4, "prompt": 2, "split": 2, "history": 5, "attested": 2, "opencode": 4, "serve": 5, "kill": 4, "routing": 5 }, "w": { "identity": "There is no account. Your node uses a key you create locally, and its public address links your sessions.", "pii": "Setup asks only for a local password. No email, account or identity check.", "payment": "Sessions lock tokens you hold, with no card or name involved. Each session is a public transaction.", "prompt": "Providers on standard models are unverified and can read your prompt. Optional TEE models run in sealed hardware your node checks first.", "split": "Your node connects straight to the provider, which sees your IP and, on standard models, your prompt. TEE models close that gap.", "history": "Your node saves chats as local files on your machine, with no sync and no Morpheus server in the path. The stock provider node doesn't store chat context.", "attested": "TEE models let your node check the provider's hardware at session start and on each prompt. Standard models offer nothing to check.", "opencode": "The node software on both ends is open source. Each provider runs a model server of its own choosing, which need not be public.", "serve": "Anyone can register as a provider by posting a refundable stake and bidding to serve a model. No approval step is documented.", "kill": "Bids, sessions and payments run on public contracts, and both ends run open-source nodes. Default sessions pay providers from a protocol fund that has to be topped up, but Direct Pay sessions don't need it.", "routing": "Your node takes the top-scored bid or the provider you pick, then connects straight to it." }, "src": { "identity": [ "mor-quick" ], "pii": [ "mor-quick" ], "payment": [ "mor-quick", "mor-repo" ], "prompt": [ "mor-myths", "mor-tee" ], "split": [ "mor-full" ], "history": [ "mor-router-env", "mor-tee-overview" ], "attested": [ "mor-tee", "mor-teeref" ], "opencode": [ "mor-repo", "mor-teeref" ], "serve": [ "mor-full", "mor-repo" ], "kill": [ "mor-repo", "mor-sessions" ], "routing": [ "mor-full" ] }, "map": "Morpheus" }, { "id": "morpheus-tee", "name": "Morpheus", "mode": "TEE models", "group": "open", "reason": "Attested hardware with the GPU checked, but the model server isn't matched to a public build, and no documented encryption of the prompt to a key only the enclave holds.", "setup": "A consumer node you run yourself, on TEE-tagged models only. Not the hosted gateway.", "quits": "The hosted gateway would stop. Providers, the contracts and your own node keep working.", "notes": [ [ "Prompts travel peer-to-peer over TCP. Morpheus pins the provider's TLS certificate into the attestation, but its docs don't say the private key is created inside the enclave, or that prompts travel over that pinned connection.", [ "mor-full", "mor-teeref" ] ], [ "Morpheus's docs say nothing proves which model serves a given request, or that it matches the model registered on-chain.", [ "mor-tee" ] ], [ "In a browser without your own node, chat goes through Morpheus's hosted gateway at app.mor.org, which needs a social-login account and an API key. This row scores the private path, which means running your own node.", [ "mor-full", "mor-signup" ] ] ], "s": { "identity": 4, "pii": 5, "payment": 4, "prompt": 3, "split": 2, "history": 5, "attested": 3, "opencode": 4, "serve": 5, "kill": 4, "routing": 5 }, "w": { "identity": "There is no account. Your node uses a key you create locally, and its public address links your sessions.", "pii": "Setup asks only for a local password. No email, account or identity check.", "payment": "Sessions lock tokens you hold, with no card or name involved. Each session is a public transaction.", "prompt": "The provider's node and model server run in attested hardware. The docs show no encryption of the prompt to a key only the enclave holds, so it may reach software outside it.", "split": "Your node connects straight to the provider, which sees your IP. Without documented encryption to the enclave, nothing shows the provider can't also read the prompt.", "history": "Your node saves chats as local files on your machine, with no sync and no Morpheus server in the path. The stock provider node doesn't store chat context.", "attested": "Your node checks the provider's node against signed public builds at session start and on every prompt, and that node checks the model server, GPU and boot measurements included. But the model server's address is unmeasured configuration, its software isn't compared to any public build, and nothing ties the model to the request.", "opencode": "The node software on both ends is open source. Each provider runs a model server of its own choosing, which need not be public.", "serve": "Anyone can register as a provider by posting a refundable stake and bidding to serve a model. No approval step is documented.", "kill": "Bids, sessions and payments run on public contracts, and both ends run open-source nodes. Default sessions pay providers from a protocol fund that has to be topped up, but Direct Pay sessions don't need it.", "routing": "Your node takes the top-scored bid or the provider you pick, then connects straight to it." }, "src": { "identity": [ "mor-quick" ], "pii": [ "mor-quick" ], "payment": [ "mor-quick", "mor-repo" ], "prompt": [ "mor-tee-overview", "mor-teeref" ], "split": [ "mor-full" ], "history": [ "mor-router-env", "mor-tee-overview" ], "attested": [ "mor-tee", "mor-tee-overview", "mor-teeref" ], "opencode": [ "mor-repo", "mor-teeref" ], "serve": [ "mor-full", "mor-repo" ], "kill": [ "mor-repo", "mor-sessions" ], "routing": [ "mor-full" ] }, "map": "Morpheus, TEE models" }, { "id": "libertai", "name": "LibertAI", "mode": "TEE models", "group": "open", "reason": "Community compute, pay per request with no account. Its gateway picks the node by default.", "setup": "API on TEE models, paid per request in crypto with no account. Scored on the default gateway path.", "quits": "The gateway, chat app and API keys would stop, so direct calls would fail too. Public code would let someone restart it.", "notes": [ [ "The optional attested client connects straight to the enclave and checks it first, which would raise split and routing. It needs a LibertAI API key instead of per-request payment.", [ "lib-trust" ] ] ], "s": { "identity": 4, "pii": 5, "payment": 4, "prompt": 3, "split": 2, "history": 5, "attested": 3, "opencode": 4, "serve": 4, "kill": 2, "routing": 1 }, "w": { "identity": "Pay-per-request use needs no account or API key. Payment comes from a crypto address you hold, which is public and links your requests.", "pii": "Pay-per-request API use needs no account or email. The chat app's sign-in takes an email, a social account or a wallet.", "payment": "You can pay per request in crypto with no account attached. Payments are visible on a public ledger.", "prompt": "On TEE models the node operator can't read prompts. The default gateway could in principle, which the optional attested client avoids.", "split": "By default, LibertAI's gateway sees your IP and could read your prompt. The optional attested client goes straight to the enclave.", "history": "The API keeps no prompt logs by stated policy, so history stays in your client. The chat app saves conversations only in your browser.", "attested": "An open client checks the signed attestation before sending. On the default path, LibertAI's gateway runs that check instead of your app, and browsers need a local verifying proxy.", "opencode": "Code for the API proxy, TEE backend, chat app and verifying client is public, and TEE images can be rebuilt against published measurements.", "serve": "Models run as virtual machines on independent compute nodes. A signed manifest lists the deployments clients use.", "kill": "Every node accepts only API keys that LibertAI's backend sends it, so direct calls depend on the company too. The code is public, so someone could restart it.", "routing": "By default, LibertAI's gateway picks the node and passes your prompt along. The optional attested client finds the enclave and checks it before sending." }, "src": { "identity": [ "lib-x402", "lib-what" ], "pii": [ "lib-x402", "lib-chat" ], "payment": [ "lib-what", "lib-trust" ], "prompt": [ "lib-trust", "lib-what" ], "split": [ "lib-trust" ], "history": [ "lib-trust", "lib-chat" ], "attested": [ "lib-trust", "lib-api" ], "opencode": [ "lib-gh", "lib-trust" ], "serve": [ "lib-what", "lib-trust" ], "kill": [ "lib-usage", "lib-gh" ], "routing": [ "lib-trust", "lib-api" ] }, "map": "LibertAI" }, { "id": "chutes", "name": "Chutes", "mode": "TEE models", "group": "open", "reason": "Independent miners run the models. Chutes' API sees each prompt on the default path.", "setup": "Chat or API on TEE models, paid. Scored without the optional end-to-end mode.", "quits": "Its API would stop, and every request passes through it. Miners and the public code remain.", "notes": [ [ "An optional end-to-end mode encrypts prompts to an instance's key. That key comes from Chutes' API, and no client Chutes ships checks it against the hardware first.", [ "chutes-e2e", "reg-chutes", "chutes-e2ee-3" ] ], [ "The awesome-private-inference registry's Chutes page says a passing attestation proves genuine hardware, not which model or code served you.", [ "reg-chutes", "chutes-75" ] ] ], "s": { "identity": 3, "pii": 4, "payment": 3, "prompt": 3, "split": 2, "history": 2, "attested": 3, "opencode": 4, "serve": 4, "kill": 2, "routing": 1 }, "w": { "identity": "The command-line client registers with a cryptographic key, not personal details. Paying by card can link the account to a name.", "pii": "Command-line sign-up uses a key for login, and the privacy policy lists no required email. Card payments share billing details with a processor.", "payment": "You can pay in crypto, which sits on a public ledger, or by card through a processor, which ties to your name.", "prompt": "Chutes' API reads your prompt before passing it to a miner's enclave. Inside, the code that handles it isn't measured, and an audit showed such code can pass one caller's prompts to another.", "split": "Chutes' API sees your IP and, without end-to-end mode, your prompt. Its policy says neither is stored in its core databases.", "history": "The API keeps no request content. The privacy policy says first-party apps, such as its chat app, may store what you send.", "attested": "You can request an instance's CPU and GPU attestation with your own nonce and check it by hand. It doesn't show which model or code serves you, and on 12 October one instance matched none of Chutes' published measurements.", "opencode": "The runtime, API, TEE image build and end-to-end clients are public. Several integrity components are closed.", "serve": "Miners run models on their own GPUs after the validator checks their hardware. TEE models need confidential-computing GPUs.", "kill": "Requests reach miners only through Chutes' own API, which also launches and checks every instance. The code is public, but no second operator is documented.", "routing": "Chutes' API chooses the miner for each request and relays it there. You choose the model, not the server." }, "src": { "identity": [ "chutes-gh", "chutes-privacy" ], "pii": [ "chutes-gh", "chutes-privacy" ], "payment": [ "chutes-privacy" ], "prompt": [ "reg-chutes", "chutes-exfil", "chutes-75" ], "split": [ "chutes-privacy", "chutes-e2e" ], "history": [ "chutes-privacy" ], "attested": [ "chutes-e2e", "chutes-private", "reg-chutes" ], "opencode": [ "chutes-sec", "chutes-gh" ], "serve": [ "chutes-sec", "chutes-tee" ], "kill": [ "chutes-sec" ], "routing": [ "chutes-sec", "chutes-e2e" ] }, "map": "Chutes" }, { "id": "confer", "name": "Confer", "mode": "", "group": "tee", "reason": "Prompts sealed in attested code, but the configuration and model aren't measured. One company runs all of it.", "setup": "Paid plan, $34.99 a month.", "quits": "The product stops.", "notes": [], "s": { "identity": 2, "pii": 1, "payment": 2, "prompt": 4, "split": 3, "history": 4, "attested": 3, "opencode": 4, "serve": 0, "kill": 1, "routing": 2 }, "w": { "identity": "Apple's privacy label lists your email address and a user ID as linked to you, so the account is tied to an email.", "pii": "Paying needs an email for the account plus card or App Store billing. A passkey then encrypts your data.", "payment": "The plan is $34.99 a month, sold through Apple on iOS, with no crypto option listed. Your chats are encrypted, so billing can't show what you asked.", "prompt": "Prompts are encrypted on your device to an enclave over a channel bound to its attestation, and all of its code is measured. Its configuration isn't: an operator-supplied file sets the environment of every service, including where a built-in log shipper sends the system logs.", "split": "Confer's host sees your IP but only encrypted traffic. The prompt opens only inside the enclave, so the split rests on the hardware.", "history": "History is encrypted with a passkey-derived key Confer never holds, then stored on Confer's servers so it syncs across devices.", "attested": "The enclave's attestation is part of the encrypted handshake, and your client checks it against releases in a public transparency log. The measured image checks the GPU at boot before serving. The configuration disk and the model weights sit outside the measurement, so nothing proves which model serves you.", "opencode": "The enclave proxy and image are public and build reproducibly. The apps that encrypt your prompt aren't published.", "serve": "Confer runs all inference itself. No outside operator can serve models.", "kill": "The enclave code is public, but only Confer runs the service. If it stops, the product stops.", "routing": "The app connects to Confer's endpoint, which picks the enclave. Your client verifies that enclave before sending." }, "src": { "identity": [ "confer-app" ], "pii": [ "confer-app", "confer-passkey" ], "payment": [ "confer-app", "confer-tc" ], "prompt": [ "confer-inf", "confer-fstab", "confer-vector" ], "split": [ "confer-inf" ], "history": [ "confer-passkey", "confer-folders" ], "attested": [ "confer-inf", "confer-gpu", "confer-fstab", "confer-vllm" ], "opencode": [ "confer-inf", "confer-gh" ], "serve": [], "kill": [], "routing": [ "confer-inf" ] }, "map": "Confer" }, { "id": "tinfoil", "name": "Tinfoil", "mode": "", "group": "tee", "reason": "Your app encrypts to attested hardware with the GPU covered. Needs an account; one company runs it.", "setup": "Paid plan.", "quits": "The product stops.", "notes": [ [ "The awesome-private-inference registry checks Tinfoil's router against its public releases every day, but not the model servers behind it.", [ "reg-tinfoil" ] ] ], "s": { "identity": 2, "pii": 1, "payment": 2, "prompt": 5, "split": 3, "history": 5, "attested": 5, "opencode": 5, "serve": 0, "kill": 1, "routing": 2 }, "w": { "identity": "Paid accounts are tied to an email or social login.", "pii": "Paid accounts need an email or social login plus card or app-store billing. Tinfoil's policy lists name and email among the data it collects.", "payment": "Tinfoil bills through Stripe or app stores. Billing can't show what you asked.", "prompt": "Your device encrypts each request to keys bound into the enclave's attestation, and it opens only inside attested hardware. The GPUs run in NVIDIA confidential computing mode.", "split": "Tinfoil's network sees your IP, but prompts open only inside the enclave. The split rests on the hardware.", "history": "History stays on your device. Optional sync is encrypted with a key only your devices hold, and Tinfoil has no way to decrypt it.", "attested": "Before sending, the client checks the boot chain, the image, its configuration and the model weights against builds published to a public transparency log, and sends nothing if a check fails. The enclaves check their GPUs at boot. Through Tinfoil's router, your client checks the router, and the router checks the model server against pinned public builds before forwarding.", "opencode": "The security-critical code is published, including the client and enclave images, and the router builds reproducibly.", "serve": "Tinfoil runs every enclave itself. No outside operator can join.", "kill": "The code is public, but only Tinfoil runs the service.", "routing": "Requests go through Tinfoil's router, which picks the model server. The client verifies the enclave before sending." }, "src": { "identity": [ "tinfoil-privacy" ], "pii": [ "tinfoil-privacy" ], "payment": [ "tinfoil-privacy" ], "prompt": [ "tinfoil-faq", "reg-tinfoil" ], "split": [ "tinfoil-faq" ], "history": [ "tinfoil-sync" ], "attested": [ "tinfoil-faq", "tinfoil-verify", "tinfoil-model", "reg-tinfoil" ], "opencode": [ "tinfoil-faq" ], "serve": [ "tinfoil-faq" ], "kill": [], "routing": [ "tinfoil-faq" ] }, "map": "Tinfoil" }, { "id": "maple", "name": "Maple", "mode": "", "group": "tee", "reason": "Your app encrypts to an attested enclave checked against Maple's own signed list. Past it, most routes rely on other companies' checks.", "setup": "No-email account, paid yearly in Bitcoin.", "quits": "The product stops.", "notes": [ [ "The awesome-private-inference registry lists Maple as a candidate it hasn't verified live, with neither GPU route proven.", [ "reg-maple" ] ], [ "Some Maple details come from a third-party review and Maple's published code.", [ "maple-review", "maple-repo" ] ] ], "s": { "identity": 4, "pii": 5, "payment": 3, "prompt": 3, "split": 3, "history": 3, "attested": 3, "opencode": 5, "serve": 1, "kill": 1, "routing": 2 }, "w": { "identity": "A no-email account is an Account ID and a password, with no name attached. It links your chats to one account.", "pii": "The no-email account asks for nothing personal.", "payment": "Bitcoin on yearly plans, or a subscription pass. The payment is tied to your account.", "prompt": "Your device encrypts chats to Maple's attested enclave, which forwards them to GPU providers. Inside the enclave, one route's plaintext passes through a sidecar committed as a prebuilt binary, with no documented way to rebuild it. The cited sources don't show every route's GPU runs in confidential computing mode.", "split": "Maple's network sees your IP, but prompts open only inside the enclave. The split rests on the hardware.", "history": "Maple stores history encrypted in its enclave backend, which can derive the keys.", "attested": "The app checks the enclave against measurements Maple signs, not a build you can reproduce, and sends nothing if a check fails. Past the enclave, Maple pins its own GPU nodes, but the shared Tinfoil and Continuum routes rely on reference values those companies publish, and nothing on Maple's side checks the GPU evidence.", "opencode": "Maple publishes the security-critical code, including the clients and enclave images.", "serve": "Maple uses partner GPU providers it picks. No outside operator can join.", "kill": "The code is public, but only Maple runs the service.", "routing": "Requests go through Maple's backend, which picks the GPU provider. The client verifies the enclave before sending." }, "src": { "identity": [ "maple-blog" ], "pii": [ "maple-blog" ], "payment": [ "maple-blog" ], "prompt": [ "maple-proof", "maple-flake", "maple-review", "reg-maple" ], "split": [ "maple-blog" ], "history": [ "maple-review" ], "attested": [ "maple-pcr", "opensecret-repo", "maple-tinfoil-rs", "reg-maple" ], "opencode": [ "maple-repo" ], "serve": [ "maple-review" ], "kill": [], "routing": [ "maple-repo" ] }, "map": "Maple" }, { "id": "near", "name": "NEAR AI", "mode": "TEE models", "group": "tee", "reason": "Attested hardware, but the model stack starts after the measurement. NEAR AI's gateway reads prompts by default.", "setup": "NEAR AI Cloud API and Playground on TEE models, paid credits.", "quits": "The product stops. Its public code would let someone rebuild it.", "notes": [ [ "NEAR AI Cloud also sells Incognito models from OpenAI, Anthropic, Google and others, which run outside a TEE. This row covers its TEE models, including some run by Chutes.", [ "near-models" ] ], [ "The awesome-private-inference registry finds no NEAR AI path fully proven yet. In May 2026, a model-name check caught NEAR AI's gateway serving a different model under one model's name.", [ "reg-near", "reg-obslog" ] ] ], "s": { "identity": 3, "pii": 3, "payment": 3, "prompt": 3, "split": 3, "history": 5, "attested": 3, "opencode": 4, "serve": 1, "kill": 1, "routing": 1 }, "w": { "identity": "Sign-in uses Google, GitHub or a NEAR wallet. Google and GitHub tie the account to an existing identity, and a wallet doesn't.", "pii": "Google and GitHub sign-in share your email. NEAR wallet sign-in stores only a placeholder, and a contact email is optional.", "payment": "Staked NEAR can fund inference credits, so you need not use a card in your name. Crypto on a public ledger can still be traced.", "prompt": "Encrypting the prompt on your device is off by default, so NEAR AI's gateway reads it, inside its own TEE. Each model server's measurement covers only a deploy manager, which starts the model stack afterwards with settings sent over an API, so NEAR AI could change what handles your prompt without your app noticing.", "split": "NEAR AI's gateway runs in a TEE and handles your key and prompt, while its network sees your IP. The split rests on the hardware.", "history": "NEAR AI Cloud keeps no chat history. The Playground stores none and the Responses API is stateless, so history stays in your own client.", "attested": "You can check gateway and model reports through the API, and NEAR AI's SDKs check them before sending. Plain OpenAI clients check nothing. The measurement covers a deploy manager, not the model stack it starts later, and by default nothing compares it to a public build.", "opencode": "The gateway source is public, and each build is checked for reproducibility. The SDKs are public too. Reproducible builds for the model servers are unconfirmed.", "serve": "NEAR AI runs its own TEE models on its own GPUs. Other TEE models run at a few outside providers it picks, such as Chutes and Tinfoil.", "kill": "NEAR AI runs the gateway and routing. Public code would let others rebuild it, but no one else runs it.", "routing": "NEAR AI's gateway, itself in a TEE, picks the model server and checks its hardware, not its code. Only NEAR AI's SDKs check before sending. Direct model endpoints skip the gateway but are experimental." }, "src": { "identity": [ "near-cloud", "near-email" ], "pii": [ "near-email" ], "payment": [ "near-staking" ], "prompt": [ "near-sdk", "near-cm", "near-private" ], "split": [ "near-private" ], "history": [ "near-stateless", "near-sunset" ], "attested": [ "near-sdk", "near-sdk-guide", "near-cm" ], "opencode": [ "near-repro", "near-sdk" ], "serve": [ "near-models" ], "kill": [], "routing": [ "near-private", "near-sdk", "near-verify-src" ] }, "map": "NEAR AI" }, { "id": "nanogpt", "name": "NanoGPT", "mode": "TEE models", "group": "router", "reason": "No account, anonymous pay. On standard TEE routes, its gateway sees the prompt first.", "setup": "No account, paid in Monero, TEE models only.", "quits": "The product stops. Chats saved in your browser remain.", "notes": [ [ "NanoGPT also routes to many models outside TEEs. This row covers its TEE models on standard routes.", [ "nano-tee" ] ], [ "An optional Private Mode for Tinfoil models checks the enclave and encrypts the prompt in your browser, so NanoGPT never sees it. It would raise prompt secrecy, split and attestation.", [ "nano-private" ] ] ], "s": { "identity": 5, "pii": 5, "payment": 5, "prompt": 3, "split": 1, "history": 4, "attested": 3, "opencode": 1, "serve": 1, "kill": 1, "routing": 1 }, "w": { "identity": "You can use NanoGPT with a generated user ID instead of an account tied to an email or name.", "pii": "The privacy policy says you can use a generated ID and skip giving an email.", "payment": "NanoGPT accepts Monero, so a balance can be funded without card or bank details.", "prompt": "TEE models run in enclaves the model host can't read. NanoGPT's docs warn that plaintext may exist at its gateway first.", "split": "NanoGPT's gateway receives your connection and the plaintext prompt. Its policy says IPs aren't attached to prompts and are deleted after rate limiting.", "history": "Chats are stored in your browser by default. Optional sync keeps encrypted copies that NanoGPT can open in its convenience mode.", "attested": "NanoGPT returns a CPU quote and NVIDIA GPU evidence per model, plus signed responses you can check through the API.", "opencode": "NanoGPT's app and gateway code isn't public. Its TEE models run on named hosts such as Tinfoil and Redpill/Phala, which publish their enclave code.", "serve": "Open models run on third-party inference services NanoGPT picks. Outside operators can't sign up to serve.", "kill": "One company runs the service and its gateway. If NanoGPT stops, inference stops.", "routing": "Every request goes to NanoGPT's API, which picks the provider and forwards the prompt." }, "src": { "identity": [ "nano-privacy" ], "pii": [ "nano-privacy" ], "payment": [ "nano-crypto" ], "prompt": [ "nano-tee", "teep" ], "split": [ "nano-privacy", "nano-tee" ], "history": [ "nano-privacy" ], "attested": [ "nano-tee", "nano-attest" ], "opencode": [ "nano-privacy", "nano-tee-blog" ], "serve": [ "nano-privacy" ], "kill": [], "routing": [ "nano-privacy" ] }, "map": "NanoGPT" }, { "id": "venice-e2ee", "name": "Venice", "mode": "E2EE mode", "group": "router", "reason": "Encrypted to an enclave, then read by GPU hosts whose software nobody measures. Pro plan, text only.", "setup": "Pro plan in E2EE mode, text models only.", "quits": "The product stops. Chats saved on your device remain.", "notes": [ [ "The security review cited here was generated by an AI model (Qwen) with live experiments, and published in August 2026 in the repository it reviews.", [ "venice-audit" ] ], [ "The awesome-private-inference registry adopted its findings. Its Venice page lists two unresolved defects on the prompt path, even when a third-party proxy runs the client checks.", [ "reg-venice" ] ] ], "s": { "identity": 3, "pii": 3, "payment": 3, "prompt": 3, "split": 3, "history": 5, "attested": 3, "opencode": 2, "serve": 1, "kill": 1, "routing": 1 }, "w": { "identity": "Pro needs a Venice account. What it reveals depends on how you sign in and pay.", "pii": "Pro is a paid account plan. You can sign in with an email or a crypto wallet. Paying by card shares card details, and paying in Bitcoin doesn't.", "payment": "Pro can be paid by card, or in Bitcoin through BTCPay on yearly plans. Bitcoin avoids card details but lands on a public ledger.", "prompt": "Your device encrypts the prompt, so Venice sees only ciphertext. An enclave then decrypts it and hands plaintext to GPU hosts running unmeasured software, and attestation can't rule out an operator's root login to that enclave.", "split": "Venice sees your IP but only ciphertext. The enclave that decrypts the prompt receives it from Venice, not from you.", "history": "Venice says conversation history stays on your device and is never stored on its servers.", "attested": "Venice returns a CPU quote and NVIDIA evidence for your client to check, and its docs leave the checks to you. Third-party proxies run them and refuse to send on failure. In the registry's daily checks from 12 to 21 October, one or two of the five models it tracks returned no attestation.", "opencode": "The enclave stack comes from Phala and NEAR AI, and a review found parts of it not reproducible. Venice's own app and proxy code isn't public.", "serve": "TEE inference runs on partners NEAR AI Cloud and Phala Network, chosen by Venice. Outside operators can't join.", "kill": "Venice runs the account system and the proxy every request uses. If Venice stops, the service stops.", "routing": "Every request goes through Venice's API to a partner gateway, where a control plane outside the enclave picks the GPU route." }, "src": { "identity": [ "venice-privacy", "venice-faq" ], "pii": [ "venice-faq" ], "payment": [ "venice-faq" ], "prompt": [ "venice-tee", "venice-audit", "reg-venice" ], "split": [ "venice-audit" ], "history": [ "venice-privacy" ], "attested": [ "venice-tee", "reg-venice", "reg-dash" ], "opencode": [ "venice-audit" ], "serve": [ "venice-privacy" ], "kill": [], "routing": [ "venice-audit" ] }, "map": "Venice E2EE" }, { "id": "duck", "name": "Duck.ai", "mode": "Tinfoil models", "group": "router", "reason": "No account, even on the paid plan. DuckDuckGo's servers pass your prompt to Tinfoil.", "setup": "Paid DuckDuckGo subscription, using the models Tinfoil hosts.", "quits": "The product stops. Chats saved on your device remain.", "notes": [ [ "If DuckDuckGo encrypted prompts from your browser to Tinfoil's enclave, prompt secrecy and attestation would score higher. No public page says it does.", [ "duck-terms" ] ] ], "s": { "identity": 5, "pii": 2, "payment": 2, "prompt": 3, "split": 1, "history": 5, "attested": 1, "opencode": 1, "serve": 1, "kill": 1, "routing": 1 }, "w": { "identity": "The subscription needs no account. An email is optional, only for using it across devices.", "pii": "No account, but paying means giving card or app-store details to Stripe, Apple or Google.", "payment": "Payment runs through Stripe or an app store. DuckDuckGo says the subscription's random ID isn't connected to your card.", "prompt": "Tinfoil runs these models in attested hardware it can't read. DuckDuckGo's servers pass the prompt along first, and no browser-to-enclave encryption is documented.", "split": "DuckDuckGo's servers receive your IP and the prompt, then forward the prompt without your metadata. Only policy keeps the two apart there.", "history": "Recent chats are saved on your device. Optional sync stores them encrypted with a key DuckDuckGo doesn't hold.", "attested": "Tinfoil attests its enclaves, and DuckDuckGo says it checks this itself, but Duck.ai gives you no way to check that your prompt reached one.", "opencode": "DuckDuckGo's relay code isn't public. Tinfoil, which runs the enclaves, publishes its code.", "serve": "Tinfoil, a separate company DuckDuckGo picked, hosts these models. Outside operators can't join.", "kill": "DuckDuckGo runs the relay every chat passes through. If it stops, chat stops.", "routing": "DuckDuckGo's servers call the model providers for you. Your browser never connects to Tinfoil directly." }, "src": { "identity": [ "duck-sub" ], "pii": [ "duck-sub" ], "payment": [ "duck-sub" ], "prompt": [ "duck-ai-privacy", "duck-terms", "reg-tinfoil" ], "split": [ "duck-terms", "duck-providers" ], "history": [ "duck-terms" ], "attested": [ "duck-ai-privacy", "duck-terms" ], "opencode": [ "tinfoil-faq" ], "serve": [ "duck-help" ], "kill": [], "routing": [ "duck-terms" ] }, "map": "Duck.ai" }, { "id": "venice-private", "name": "Venice", "mode": "Private mode", "group": "router", "reason": "Private by policy, not hardware. History stays in your browser.", "setup": "Pro plan in the default Private mode.", "quits": "The product stops. Chats saved on your device remain.", "notes": [], "s": { "identity": 3, "pii": 3, "payment": 3, "prompt": 2, "split": 1, "history": 5, "attested": 0, "opencode": 0, "serve": 1, "kill": 1, "routing": 1 }, "w": { "identity": "Pro needs a Venice account. What it reveals depends on how you sign in and pay.", "pii": "Pro is a paid account plan. You can sign in with an email or a crypto wallet. Paying by card shares card details, and paying in Bitcoin doesn't.", "payment": "Pro can be paid by card, or in Bitcoin through BTCPay on yearly plans. Bitcoin avoids card details but lands on a public ledger.", "prompt": "Prompts reach Venice's proxy and then GPU hosts in plaintext. Venice says this mode relies on contractual commitments.", "split": "Venice's proxy receives your IP and your plaintext prompt together. Its policy says prompts are relayed without being stored.", "history": "Venice says conversation history stays on your device and is never stored on its servers.", "attested": "This mode runs on GPUs without an enclave, so there's nothing to check.", "opencode": "Venice's proxy code isn't public, and nothing shows which software its GPU hosts run.", "serve": "Models run on Venice's GPUs or on partners Venice picks. Outside operators can't join.", "kill": "Venice runs the account system and the proxy every request uses. If Venice stops, the service stops.", "routing": "Every request goes through Venice's proxy, which picks the GPU host." }, "src": { "identity": [ "venice-privacy", "venice-faq" ], "pii": [ "venice-faq" ], "payment": [ "venice-faq" ], "prompt": [ "venice-privacy", "venice-audit" ], "split": [ "venice-privacy" ], "history": [ "venice-privacy" ], "attested": [ "venice-privacy", "reg-venice" ], "opencode": [], "serve": [ "venice-privacy" ], "kill": [], "routing": [ "venice-privacy" ] }, "map": "Venice Private" }, { "id": "lumo-leo", "name": "Lumo / Leo", "mode": "", "group": "router", "reason": "Private by policy from Proton and Brave. Paid plans need an account.", "setup": "Lumo Plus and Leo Premium. Each score is the lower of the two products.", "quits": "Each product stops with its company. Chats saved on your device remain.", "notes": [ [ "Scored on its own, Lumo would get a 3 on payment, and Leo a 5 on history and a 1 on serve.", [ "proton-payopts", "brave-privacy", "brave-e2ee" ] ], [ "Since October 2026, Leo's GLM 5.3 Flash model is end-to-end encrypted to NEAR AI enclaves. It's opt-in and in beta, so this row scores Leo's default models.", [ "brave-e2ee" ] ] ], "s": { "identity": 2, "pii": 1, "payment": 2, "prompt": 2, "split": 2, "history": 4, "attested": 0, "opencode": 2, "serve": 0, "kill": 1, "routing": 1 }, "w": { "identity": "Lumo Plus needs a Proton account, and Leo Premium needs a Brave account tied to an email.", "pii": "Both paid plans need an account. Lumo Plus can be paid in Bitcoin or cash, and Leo Premium needs an email and payment details.", "payment": "Brave says it can't link Premium purchases to Leo use, but the purchase ties to your account. Proton also takes Bitcoin and cash, credited to your account.", "prompt": "Proton runs Lumo's models with no hardware enclave, under a no-logs policy. Leo's backend receives prompts, and Brave says it doesn't keep them.", "split": "Brave proxies Leo requests so your address and request can't be linked. Proton encrypts prompts to its GPU servers but runs both ends.", "history": "Leo keeps history on your device. Lumo keeps it on your device and syncs it to Proton with zero-access encryption.", "attested": "Lumo offers no attestation. Leo's opt-in GLM 5.3 Flash model runs in attested NEAR AI enclaves, but Brave's gateway runs the check, not your browser.", "opencode": "Proton says Lumo's code is open but doesn't say which parts. Brave's browser and Leo's backend are open source.", "serve": "Proton runs Lumo only on its own servers, and Brave picks the hosts for Leo. Outside operators can't join.", "kill": "Each runs only on its company's servers. If the company stops, the assistant stops.", "routing": "Requests go through Proton's or Brave's servers, which choose the model server." }, "src": { "identity": [ "proton-pay", "brave-leo" ], "pii": [ "proton-payopts", "brave-privacy" ], "payment": [ "brave-privacy", "proton-payopts" ], "prompt": [ "lumo-privacy", "brave-privacy" ], "split": [ "brave-leo", "lumo-privacy" ], "history": [ "brave-privacy", "lumo-privacy" ], "attested": [ "lumo-privacy", "brave-e2ee" ], "opencode": [ "lumo-privacy", "brave-gateway" ], "serve": [ "lumo-privacy", "brave-e2ee" ], "kill": [], "routing": [ "brave-leo" ] }, "map": "Lumo / Leo" }, { "id": "chatgpt", "name": "ChatGPT", "mode": "Plus", "group": "main", "reason": "Trains on chats unless you opt out. Temporary Chats are kept up to 30 days.", "setup": "Plus plan.", "quits": "The product stops.", "notes": [], "s": { "identity": 1, "pii": 1, "payment": 1, "prompt": 0, "split": 0, "history": 0, "attested": 0, "opencode": 0, "serve": 0, "kill": 1, "routing": 1 }, "w": { "identity": "Plus requires an OpenAI account tied to your billing details.", "pii": "An account needs at least an email, and Plus adds payment details.", "payment": "Plus is billed by card or app store to your account, which also holds your chats.", "prompt": "OpenAI processes prompts in plaintext on its servers. Chats may train its models unless you turn off Improve the model for everyone.", "split": "One company runs every server and receives your prompt and IP together.", "history": "Chats are stored on OpenAI's servers. Temporary Chats stay out of your history but can be kept up to 30 days.", "attested": "OpenAI offers no way to check the hardware that processes your prompt.", "opencode": "The code that serves ChatGPT is closed.", "serve": "Only OpenAI serves ChatGPT. Microsoft Azure also runs OpenAI's models, but only for its own API customers.", "kill": "ChatGPT chats run only on OpenAI's service, so they stop if OpenAI does.", "routing": "The app sends every request to OpenAI, which picks the server." }, "src": { "identity": [], "pii": [], "payment": [], "prompt": [ "oai-train" ], "split": [], "history": [ "oai-controls" ], "attested": [], "opencode": [], "serve": [ "azure-oai" ], "kill": [], "routing": [] }, "map": "ChatGPT" }, { "id": "gemini", "name": "Gemini", "mode": "AI Pro", "group": "main", "reason": "Human reviewers read some chats. Kept 72 hours even with Keep Activity off.", "setup": "Google AI Pro plan.", "quits": "The product stops.", "notes": [], "s": { "identity": 0, "pii": 0, "payment": 1, "prompt": 0, "split": 0, "history": 0, "attested": 0, "opencode": 0, "serve": 0, "kill": 1, "routing": 1 }, "w": { "identity": "Gemini runs under your Google account, and chats are kept with it.", "pii": "Gemini needs your Google account, which is your main identity account, and Google AI Pro adds payment details.", "payment": "Google AI Pro is billed to your Google account, which also holds your chats.", "prompt": "Google processes chats on its servers. With Keep Activity on, chats can train its models and human reviewers read a subset.", "split": "One company runs every server and receives your prompt and IP together.", "history": "Chats are stored with your Google account. With Keep Activity off they're still kept 72 hours, and reviewed chats up to three years.", "attested": "Google offers no way to check the hardware that processes your prompt.", "opencode": "The code that serves Gemini is closed.", "serve": "Only Google serves Gemini chats.", "kill": "Gemini chats run only on Google's service, so they stop if Google does.", "routing": "The app sends every request to Google, which picks the server." }, "src": { "identity": [ "gem-hub" ], "pii": [ "gem-hub" ], "payment": [], "prompt": [ "gem-hub" ], "split": [], "history": [ "gem-hub" ], "attested": [], "opencode": [], "serve": [], "kill": [], "routing": [] }, "map": "Gemini" }, { "id": "meta", "name": "Meta AI", "mode": "", "group": "main", "reason": "Uses your chats to personalize ads. Opt-in Incognito Chat runs in sealed hardware.", "setup": "Standard chats. Meta One plans add paid features.", "quits": "The product stops.", "notes": [ [ "Incognito Chat, an opt-in mode Meta began rolling out in May 2026, runs on sealed hardware behind outside relays, with attestation the app checks. These scores cover standard chats.", [ "meta-incog", "meta-pp" ] ] ], "s": { "identity": 0, "pii": 0, "payment": 1, "prompt": 0, "split": 0, "history": 0, "attested": 0, "opencode": 0, "serve": 0, "kill": 1, "routing": 1 }, "w": { "identity": "Meta AI runs under your Meta, Facebook, Instagram or WhatsApp account, and chats can shape ads across linked accounts.", "pii": "You need a Meta, Facebook, Instagram or WhatsApp account, and WhatsApp requires a phone number.", "payment": "Meta One plans, launched in September 2026, are paid subscriptions tied to your Meta account, which also holds your chats.", "prompt": "Meta processes standard chats and uses them to personalize ads in most regions. Opt-in Incognito Chat runs in sealed hardware instead.", "split": "Standard chats reach Meta with your IP. Incognito Chat goes through outside relays that hide your IP from Meta.", "history": "Meta stores standard chats. Incognito Chat conversations aren't saved.", "attested": "Standard chats have nothing to check. In Incognito Chat, the app checks the server's attestation before sending.", "opencode": "Meta's service code is closed. In 2025 Meta said it would publish some Private Processing components.", "serve": "Only Meta serves Meta AI chats.", "kill": "Meta AI chats run only on Meta's service, so they stop if Meta does.", "routing": "The app sends every request to Meta, which picks the server." }, "src": { "identity": [ "meta-ads" ], "pii": [], "payment": [ "meta-one" ], "prompt": [ "meta-ads", "meta-incog" ], "split": [ "meta-pp", "meta-incog" ], "history": [ "meta-incog" ], "attested": [ "meta-pp" ], "opencode": [ "meta-pp" ], "serve": [], "kill": [], "routing": [] }, "map": "Meta AI" }, { "id": "claude", "name": "Claude", "mode": "Pro", "group": "main", "reason": "Trains on chats if the training setting is on. Incognito chats are kept 30 days.", "setup": "Pro plan.", "quits": "The product stops.", "notes": [], "s": { "identity": 1, "pii": 0, "payment": 1, "prompt": 0, "split": 0, "history": 0, "attested": 0, "opencode": 0, "serve": 0, "kill": 1, "routing": 1 }, "w": { "identity": "Pro requires an Anthropic account tied to your phone number and billing details.", "pii": "An account needs an email and a verified phone number, and Pro adds payment details.", "payment": "Pro is billed by card or app store to your account, which also holds your chats.", "prompt": "Anthropic processes prompts in plaintext on its servers. Chats train its models when the training setting is on, which it was by default when Anthropic asked existing users in 2025.", "split": "One company runs every server and receives your prompt and IP together.", "history": "Chats are stored on Anthropic's servers, up to five years with training on. Incognito chats stay out of history but are kept 30 days.", "attested": "Anthropic offers no way to check the hardware that processes your prompt.", "opencode": "The code that serves Claude is closed.", "serve": "Only Anthropic serves Claude Pro chats. Cloud partners such as Amazon Bedrock run Claude models only for their own API customers.", "kill": "Claude chats run only on Anthropic's service, so they stop if Anthropic does.", "routing": "The app sends every request to Anthropic, which picks the server." }, "src": { "identity": [ "ant-phone" ], "pii": [ "ant-phone" ], "payment": [], "prompt": [ "ant-terms", "ant-train-tc" ], "split": [], "history": [ "ant-terms", "ant-incog" ], "attested": [], "opencode": [], "serve": [ "bedrock-claude" ], "kill": [], "routing": [] }, "map": "Claude" }, { "id": "grok", "name": "Grok", "mode": "SuperGrok", "group": "main", "reason": "Trains on chats unless you opt out. Private Chats are deleted within 30 days.", "setup": "SuperGrok plan.", "quits": "The product stops.", "notes": [], "s": { "identity": 1, "pii": 1, "payment": 1, "prompt": 0, "split": 0, "history": 0, "attested": 0, "opencode": 0, "serve": 0, "kill": 1, "routing": 1 }, "w": { "identity": "SuperGrok requires an account tied to your billing details.", "pii": "An account needs at least an email or another login, and SuperGrok adds payment details.", "payment": "SuperGrok is billed by card or app store to your account, which also holds your chats.", "prompt": "SpaceXAI, which runs Grok, processes prompts on its servers, and authorized staff may review them. Chats train Grok unless you opt out.", "split": "One company runs every server and receives your prompt and IP together.", "history": "Chats are stored on SpaceXAI's servers. Private Chats are deleted within 30 days, except for safety or legal holds.", "attested": "SpaceXAI offers no way to check the hardware that processes your prompt.", "opencode": "The code that serves Grok is closed.", "serve": "Only SpaceXAI serves SuperGrok chats. Microsoft Azure also runs Grok models, but only for its own API customers.", "kill": "Grok chats run only on SpaceXAI's service, so they stop if SpaceXAI does.", "routing": "The app sends every request to SpaceXAI, which picks the server." }, "src": { "identity": [], "pii": [], "payment": [], "prompt": [ "xai-faq" ], "split": [], "history": [ "xai-faq" ], "attested": [], "opencode": [], "serve": [ "azure-grok" ], "kill": [], "routing": [] }, "map": "Grok" }, { "id": "deepseek", "name": "DeepSeek", "mode": "API", "group": "main", "reason": "Paid through its API. Stores your data on servers in China.", "setup": "Paid API. DeepSeek's chat app has no paid plan.", "quits": "The product stops.", "notes": [ [ "DeepSeek's model weights are public, so other hosts run the same models as separate services.", [ "ds-hf" ] ] ], "s": { "identity": 1, "pii": 1, "payment": 1, "prompt": 0, "split": 0, "history": 2, "attested": 0, "opencode": 0, "serve": 0, "kill": 1, "routing": 1 }, "w": { "identity": "Your API account is tied to an email or phone number and to payment records.", "pii": "Registration needs an email, a phone number, or an Apple or Google login.", "payment": "API credit is bought from your account, and DeepSeek records payment and transaction data.", "prompt": "DeepSeek processes prompts on its servers and stores data in China. Its policy allows training on inputs, with opt-out by email request.", "split": "One company runs every server and receives your prompt and IP together.", "history": "The API keeps no conversation state, so your app holds the history. DeepSeek still receives every message and may keep inputs.", "attested": "DeepSeek offers no way to check the hardware that processes your prompt.", "opencode": "The model weights are public, but the service code behind the API is closed.", "serve": "Others can run DeepSeek's public weights, but this API runs only on DeepSeek's servers.", "kill": "The API stops if DeepSeek does, though other hosts could keep serving the public weights.", "routing": "The app sends every request to DeepSeek, which picks the server." }, "src": { "identity": [ "ds-privacy" ], "pii": [ "ds-privacy" ], "payment": [ "ds-privacy" ], "prompt": [ "ds-privacy" ], "split": [], "history": [ "ds-multi", "ds-privacy" ], "attested": [], "opencode": [ "ds-hf" ], "serve": [ "ds-hf" ], "kill": [ "ds-hf" ], "routing": [] }, "map": "DeepSeek" } ], "sources": { "zs-ipfs": [ "ZeroSignal web app on IPFS", "https://ipfs.zerosignal.ai" ], "mor-signup": [ "Morpheus gateway sign-up", "https://app.mor.org/signup" ], "confer-fstab": [ "confer-image: config and model disks", "https://github.com/ConferLabs/confer-image/blob/fef7e3aebf573a0b2d3667b68bb5228e0c0db1c2/mkosi.skeleton/etc/fstab" ], "confer-vector": [ "confer-image: log shipping", "https://github.com/ConferLabs/confer-image/blob/fef7e3aebf573a0b2d3667b68bb5228e0c0db1c2/mkosi.skeleton/etc/vector/vector.yaml" ], "confer-vllm": [ "confer-image: model launch", "https://github.com/ConferLabs/confer-image/blob/fef7e3aebf573a0b2d3667b68bb5228e0c0db1c2/mkosi.skeleton/usr/local/bin/confer-vllm" ], "tinfoil-verify": [ "tinfoil-go verifier", "https://github.com/tinfoilsh/tinfoil-go/blob/main/verify/README.md" ], "tinfoil-model": [ "Tinfoil model enclave config", "https://github.com/tinfoilsh/confidential-gemma4-31b/blob/main/tinfoil-config.yml" ], "maple-pcr": [ "Maple SDK: PCR check", "https://github.com/MaplePrivacyLabs/Maple/blob/master/sdk/src/lib/pcr.ts" ], "maple-flake": [ "OpenSecret enclave build", "https://github.com/MaplePrivacyLabs/Maple/blob/master/services/opensecret/flake.nix" ], "maple-tinfoil-rs": [ "Maple's tinfoil-rs fork: GPU evidence", "https://github.com/MaplePrivacyLabs/tinfoil-rs/blob/f0fef79eec6a5a2c8592cf8aff4b90ab556acfbc/src/verifier/v3_document.rs" ], "near-cm": [ "NEAR AI compose-manager", "https://github.com/nearai/compose-manager/blob/master/README.md" ], "near-sdk-guide": [ "NEAR AI SDK verification guide", "https://github.com/nearai/inference-sdk/blob/main/js/docs/verification-guide.md" ], "zs-privacy": [ "ZeroSignal docs: Privacy", "https://docs.zerosignal.ai/for-users/privacy" ], "zs-passkeys": [ "ZeroSignal docs: Passkeys", "https://docs.zerosignal.ai/for-users/passkeys" ], "zs-funding": [ "ZeroSignal docs: Funding", "https://docs.zerosignal.ai/for-users/funding" ], "zs-network": [ "ZeroSignal docs: The operator network", "https://docs.zerosignal.ai/for-users/the-operator-network" ], "zs-relays": [ "ZeroSignal docs: Relays", "https://docs.zerosignal.ai/concepts/relays" ], "zs-staking": [ "ZeroSignal docs: Staking and economics", "https://docs.zerosignal.ai/concepts/staking-and-economics" ], "zs-models": [ "ZeroSignal docs: Retention and attestation badges", "https://docs.zerosignal.ai/for-users/models#retention-and-attestation-badges" ], "zs-verify": [ "ZeroSignal docs: Verifying an attestation", "https://docs.zerosignal.ai/concepts/verifying-attestation" ], "zs-conv": [ "ZeroSignal docs: Conversations and history", "https://docs.zerosignal.ai/for-users/conversations" ], "zs-sync": [ "ZeroSignal docs: Syncing", "https://docs.zerosignal.ai/for-users/syncing" ], "zs-pp": [ "ZeroSignal privacy policy", "https://zerosignal.ai/privacy-policy" ], "zs-cc": [ "ZeroSignal docs: Confidential compute", "https://docs.zerosignal.ai/concepts/confidential-compute" ], "zs-limits": [ "ZeroSignal docs: What attestation does not prove", "https://docs.zerosignal.ai/concepts/verifying-attestation#what-this-does-not-prove" ], "zs-registry": [ "ZeroSignal registry contract on the public ledger", "https://lora.algokit.io/mainnet/application/3628061142" ], "zs-node-repo": [ "zs-node on GitHub (release binaries)", "https://github.com/TxnLab/zs-node" ], "zs-proxy-repo": [ "zs-proxy on GitHub (release binaries)", "https://github.com/TxnLab/zs-proxy" ], "mor-quick": [ "Morpheus node docs: Consumer quickstart", "https://nodedocs.mor.org/get-started/quickstart-consumer" ], "mor-repo": [ "Morpheus-Lumerin-Node on GitHub", "https://github.com/MorpheusAIs/Morpheus-Lumerin-Node" ], "mor-tee": [ "Morpheus node docs: TEE backend verification", "https://nodedocs.mor.org/providers/full/tee-backend-verification" ], "mor-teeref": [ "Morpheus node docs: TEE reference", "https://nodedocs.mor.org/providers/full/tee-reference" ], "mor-full": [ "Morpheus node docs, full text", "https://nodedocs.mor.org/llms-full.txt" ], "mor-myths": [ "Morpheus node docs: Myths", "https://nodedocs.mor.org/ai/myths" ], "mor-router-env": [ "Morpheus node docs: Proxy-router settings", "https://nodedocs.mor.org/reference/env-proxy-router" ], "mor-tee-overview": [ "Morpheus node docs: TEE overview", "https://nodedocs.mor.org/concepts/tee-overview" ], "mor-sessions": [ "Morpheus node docs: Sessions, stake and close", "https://nodedocs.mor.org/concepts/sessions-stake-close-recover" ], "lib-trust": [ "LibertAI docs: Trust model", "https://docs.libertai.io/concepts/trust-model.html" ], "lib-what": [ "LibertAI docs: What is LibertAI", "https://docs.libertai.io/what-is-libertai.html" ], "lib-gh": [ "LibertAI on GitHub", "https://github.com/Libertai" ], "lib-x402": [ "LibertAI docs: Pay per request with x402", "https://docs.libertai.io/apis/x402.html" ], "lib-usage": [ "LibertAI docs: Direct model interaction", "https://docs.libertai.io/apis/text/usage.html#direct-model-interaction" ], "lib-chat": [ "libertai-chat on GitHub", "https://github.com/Libertai/libertai-chat" ], "lib-api": [ "libertai-api on GitHub", "https://github.com/Libertai/libertai-api" ], "chutes-e2e": [ "Chutes: End-to-end encrypted AI inference", "https://chutes.ai/news/end-to-end-encrypted-ai-inference-with-post-quantum-cryptography" ], "chutes-sec": [ "Chutes docs: Security and integrity", "https://chutes.ai/docs/core-concepts/security-architecture" ], "chutes-privacy": [ "Chutes privacy policy", "https://chutes.ai/privacy" ], "chutes-private": [ "Chutes: Private inference", "https://chutes.ai/agents/private" ], "chutes-tee": [ "Chutes: Confidential compute with TEEs", "https://chutes.ai/news/confidential-compute-for-ai-inference-how-chutes-delivers-verifiable-privacy-with-trusted-execution-environments" ], "chutes-gh": [ "Chutes on GitHub", "https://github.com/chutesai/chutes" ], "confer-inf": [ "Confer blog: Private inference", "https://confer.to/blog/2026/01/private-inference/" ], "confer-passkey": [ "Confer blog: Making encrypted AI chat feel like logging in", "https://confer.to/blog/2025/12/passkey-encryption/" ], "confer-app": [ "Confer on the App Store", "https://apps.apple.com/app/id6760171224" ], "confer-tc": [ "TechCrunch: Moxie Marlinspike's privacy-conscious alternative to ChatGPT", "https://techcrunch.com/2026/01/18/moxie-marlinspike-has-a-privacy-conscious-alternative-to-chatgpt/" ], "confer-folders": [ "Confer blog: Encrypted folders", "https://confer.to/blog/2026/01/encrypted-folders/" ], "confer-gpu": [ "confer-image: GPU attestation at boot", "https://github.com/conferlabs/confer-image/blob/master/mkosi.skeleton/etc/systemd/system/nvidia-cc-attestation.service" ], "confer-gh": [ "Confer Labs on GitHub", "https://github.com/conferlabs" ], "maple-blog": [ "Maple blog: How to use AI privately", "https://maple.ai/blog/how-to-use-ai-privately" ], "maple-proof": [ "Maple: Proof of privacy", "https://maple.ai/proof" ], "maple-repo": [ "Maple on GitHub", "https://github.com/MaplePrivacyLabs/Maple" ], "opensecret-repo": [ "Maple docs: How clients verify the enclave backend", "https://github.com/MaplePrivacyLabs/Maple/blob/master/services/opensecret/docs/PCR_VERIFICATION.md" ], "maple-review": [ "BitcoinProducts: Maple AI review (2026)", "https://www.bitcoinproducts.com/blog/maple-ai-review" ], "tinfoil-faq": [ "Tinfoil: Security and privacy FAQ", "https://tinfoil.sh/security-and-privacy-faq" ], "tinfoil-privacy": [ "Tinfoil privacy policy", "https://tinfoil.sh/privacy" ], "tinfoil-sync": [ "Tinfoil docs: Cloud sync", "https://docs.tinfoil.sh/chat/cloud-sync" ], "near-private": [ "NEAR AI docs: Private inference", "https://docs.near.ai/cloud/private-inference" ], "near-cloud": [ "NEAR AI Cloud sign-in", "https://cloud.near.ai/" ], "near-staking": [ "NEAR AI docs: Staking for inference", "https://docs.near.ai/cloud/staking-for-inference/overview" ], "near-sdk": [ "NEAR AI docs: Inference SDKs", "https://docs.near.ai/cloud/inference-sdk" ], "near-stateless": [ "NEAR AI docs: Stateless responses", "https://docs.near.ai/cloud/guides/stateless-responses" ], "near-sunset": [ "NEAR AI Private Chat: sunset notice in its source", "https://github.com/nearai/private-chat/blob/main/src/components/common/SunsetBanner.tsx" ], "near-email": [ "NEAR AI cloud-api: optional contact email", "https://github.com/nearai/cloud-api/blob/main/crates/services/src/contact_email.rs" ], "near-verify-src": [ "NEAR AI cloud-api: backend attestation check", "https://github.com/nearai/cloud-api/blob/main/crates/services/src/attestation/verification.rs" ], "near-repro": [ "NEAR AI cloud-api: reproducible build check", "https://github.com/nearai/cloud-api/blob/main/.github/workflows/verify-reproducible-build.yml" ], "near-models": [ "NEAR AI docs: Models", "https://docs.near.ai/cloud/models" ], "nano-privacy": [ "NanoGPT privacy policy", "https://nano-gpt.com/privacy" ], "nano-tee": [ "NanoGPT docs: TEE verification", "https://docs.nano-gpt.com/api-reference/tee-verification" ], "nano-attest": [ "NanoGPT docs: TEE attestation endpoint", "https://docs.nano-gpt.com/api-reference/endpoint/tee-attestation" ], "nano-crypto": [ "NanoGPT docs: Crypto deposits", "https://docs.nano-gpt.com/api-reference/endpoint/crypto-deposits.md" ], "nano-tee-blog": [ "NanoGPT blog: Trusted execution environments on NanoGPT", "https://nano-gpt.com/blog/trusted-execution-environments-and-confidential-ai-on-nanogpt" ], "nano-private": [ "NanoGPT: Private Mode verification", "https://nano-gpt.com/private-mode-verification" ], "teep": [ "teep: a TEE attestation verifier", "https://pkg.go.dev/github.com/13rac1/teep" ], "venice-privacy": [ "Venice privacy", "https://venice.ai/privacy" ], "venice-tee": [ "Venice docs: TEE and E2EE models", "https://docs.venice.ai/guides/features/tee-e2ee-models" ], "venice-audit": [ "Automated security review of Venice's E2EE path", "https://github.com/jooray/venice-e2ee-proxy/blob/main/docs/SECURITY-AUDIT.md" ], "venice-faq": [ "Venice FAQs", "https://venice.ai/faqs" ], "duck-help": [ "DuckDuckGo help: Duck.ai", "https://safe.duckduckgo.com/duckduckgo-help-pages/duckai" ], "duck-terms": [ "Duck.ai privacy policy and terms", "https://duckduckgo.com/duckai/privacy-terms" ], "duck-sub": [ "DuckDuckGo subscription privacy policy and terms", "https://duckduckgo.com/pro/privacy-terms" ], "duck-ai-privacy": [ "DuckDuckGo help: Duck.ai privacy", "https://duckduckgo.com/duckduckgo-help-pages/duckai/ai-chat-privacy" ], "duck-providers": [ "DuckDuckGo help: Do any of these providers see my prompts?", "https://safe.duckduckgo.com/duckduckgo-help-pages/privacy-pro/duck-ai/do-any-of-these-providers-see-my-prompts" ], "lumo-privacy": [ "Proton: Lumo privacy", "https://proton.me/support/lumo-privacy" ], "proton-pay": [ "Proton: How to pay with Bitcoin", "https://proton.me/support/pay-with-bitcoin" ], "brave-privacy": [ "Brave browser privacy policy", "https://brave.com/privacy/browser/" ], "brave-leo": [ "Brave: Leo launch post", "https://brave.com/leo-launch" ], "brave-gateway": [ "brave/ai-gateway on GitHub: Leo's backend", "https://github.com/brave/ai-gateway" ], "brave-e2ee": [ "Brave: End-to-end encrypted AI in the browser", "https://brave.com/blog/browser-ai-e2ee/" ], "proton-payopts": [ "Proton: Payment options", "https://proton.me/support/payment-options" ], "oai-train": [ "OpenAI: How your data is used to improve model performance", "https://help.openai.com/en/articles/5722486-how-your-data-is-used-to-improve-model-performance" ], "oai-controls": [ "OpenAI: Data controls FAQ", "https://help.openai.com/en/articles/7730893-data-controls-faq" ], "gem-hub": [ "Google: Gemini Apps privacy hub", "https://support.google.com/gemini/answer/13594961?hl=en" ], "meta-ads": [ "Meta: Improving your recommendations with AI at Meta", "https://about.fb.com/news/2025/10/improving-your-recommendations-apps-ai-meta/" ], "meta-one": [ "Meta: Introducing Meta One", "https://about.fb.com/news/2026/09/introducing-meta-one-subscription-service-more-features-ai/" ], "meta-incog": [ "Meta: A completely private way to chat with AI", "https://about.fb.com/news/2026/05/incognito-chat-whatsapp-meta-ai/" ], "meta-pp": [ "Meta Engineering: Building Private Processing", "https://engineering.fb.com/2025/04/29/security/building-private-processing-for-ai-tools-on-whatsapp/" ], "ant-terms": [ "Anthropic: Updates to consumer terms and privacy policy", "https://www.anthropic.com/news/updates-to-our-consumer-terms" ], "ant-incog": [ "Claude help: Using incognito chats", "https://support.claude.com/en/articles/12260368-using-incognito-chats" ], "ant-phone": [ "Claude help: Why am I being asked to verify my phone number?", "https://support.claude.com/en/articles/8287232-why-am-i-being-asked-to-verify-my-phone-number" ], "ant-train-tc": [ "TechCrunch: Anthropic users face a new choice, opt out or share data for training", "https://techcrunch.com/2025/08/28/anthropic-users-face-a-new-choice-opt-out-or-share-your-data-for-ai-training/" ], "azure-oai": [ "Microsoft: Data, privacy and security for Azure models", "https://learn.microsoft.com/en-us/legal/cognitive-services/openai/data-privacy" ], "bedrock-claude": [ "AWS: Anthropic's Claude in Amazon Bedrock", "https://aws.amazon.com/bedrock/anthropic/" ], "azure-grok": [ "Microsoft: Grok 4 in Azure AI Foundry", "https://azure.microsoft.com/en-us/blog/grok-4-is-now-available-in-azure-ai-foundry/" ], "xai-faq": [ "Grok consumer FAQ", "https://x.ai/legal/faq" ], "ds-privacy": [ "DeepSeek privacy policy", "https://cdn.deepseek.com/policies/en-US/deepseek-privacy-policy.html" ], "ds-multi": [ "DeepSeek API docs: Multi-round conversation", "https://api-docs.deepseek.com/guides/multi_round_chat" ], "ds-hf": [ "DeepSeek on Hugging Face", "https://huggingface.co/deepseek-ai" ], "reg-dash": [ "awesome-private-inference: live attestation dashboard", "https://amiller.github.io/awesome-private-inference/" ], "reg-near": [ "awesome-private-inference: NEAR AI", "https://github.com/amiller/awesome-private-inference/blob/main/providers/near-ai.md" ], "reg-chutes": [ "awesome-private-inference: Chutes", "https://github.com/amiller/awesome-private-inference/blob/main/providers/chutes.md" ], "reg-venice": [ "awesome-private-inference: Venice", "https://github.com/amiller/awesome-private-inference/blob/main/providers/venice.md" ], "reg-maple": [ "awesome-private-inference: Maple", "https://github.com/amiller/awesome-private-inference/blob/main/providers/maple.md" ], "reg-obslog": [ "awesome-private-inference: Observation log", "https://github.com/amiller/awesome-private-inference/blob/main/research/observation-log.md" ], "reg-tinfoil": [ "awesome-private-inference: Tinfoil", "https://github.com/amiller/awesome-private-inference/blob/main/providers/tinfoil.md" ], "chutes-75": [ "Chutes GitHub issue 75: measure the serving code", "https://github.com/chutesai/chutes/issues/75" ], "chutes-e2ee-3": [ "Chutes GitHub issue: verify the end-to-end key against the quote", "https://github.com/chutesai/e2ee-proxy/issues/3" ], "chutes-exfil": [ "DevProof audit: prompt exfiltration from a verified Chutes enclave", "https://github.com/amiller/devproof-audits-guide/blob/main/case-studies/chutes-confidential-inference/OPERATOR-EXFIL-POC.md" ] }, "quits": [ { "who": "A model on your own machine", "stops": "Nothing", "keeps": "Everything. It never depended on a company." }, { "who": "ZeroSignal", "stops": "The hosted web app and its IPFS address", "keeps": "Operators, the public registry, zs-proxy and any copy of the web app someone pins" }, { "who": "Morpheus", "stops": "The hosted gateway", "keeps": "Providers, the contracts and your own node" }, { "who": "LibertAI", "stops": "The gateway, chat app and the API keys every node checks", "keeps": "The public code" }, { "who": "Chutes", "stops": "Its API, which every request passes through", "keeps": "The miners and the public code" }, { "who": "Everyone else on this page", "stops": "The product", "keeps": "At most, chats saved on your device", "list": "Confer, Maple, Tinfoil, NEAR AI, NanoGPT, Venice, Duck.ai, Lumo, Leo, ChatGPT, Gemini, Meta AI, Claude, Grok and DeepSeek" } ], "mapPref": { "zs-att": [ "tr", "r", "br" ], "zs-any": [ "tl", "l", "bl" ], "morpheus": [ "bl", "b", "l" ], "libertai": [ "r", "l" ], "chutes": [ "r", "l", "br" ], "near": [ "r", "tr", "t" ], "confer": [ "r", "br", "tr" ], "tinfoil": [ "b", "bl", "br" ], "maple": [ "l", "bl", "tl" ], "venice-e2ee": [ "t", "tl", "l" ], "duck": [ "t", "b", "tr", "tl" ], "venice-private": [ "tl", "l", "t" ], "lumo-leo": [ "l", "bl", "b", "r" ], "morpheus-tee": [ "br", "b", "r" ] } }