Every inference API says your data is “private.” Almost none let you check. “We don’t log prompts” is a policy, not a proof - you’re trusting a screenshot of a dashboard toggle. Umbra’s bet is different: you should be able to verify the hardware and software boundary that handled a prompt, and if the evidence is missing, you should not treat the request as private. The alpha has registration-level evidence today, including live APNs running-code identity; signed per-response receipts are still pending.
Here’s the whole chain, from the silicon up.
1. The prompt is decrypted only inside a hardened process
Models run in-process (llama.cpp) on a provider’s Apple-Silicon Mac. Your prompt
is re-encrypted to that specific provider’s attested key and decrypted only inside
a process that requires PT_DENY_ATTACH, Apple’s Hardened Runtime, SIP, and
authenticated root before a hardware-backed provider starts. Prompt and output
buffers stay in memory and the provider does not intentionally log them. This
reduces the local attack surface; it is not yet a per-response proof.
2. Provider registration proves hardware identity
The provider holds a hardware-bound key in the Secure Enclave. At registration, the coordinator validates Apple Managed Device Attestation evidence, freshness, serial binding, and the provider’s prompt-encryption key. The console can expose that network state. Individual responses do not yet carry a signed receipt, so registration evidence must not be presented as proof for a particular response.
3. The operator can’t read it either
The usual hole in “private inference” is the broker in the middle - the company routing your traffic. Umbra’s coordinator runs inside an AMD SEV-SNP confidential VM. Its attestation endpoint reports the current SEV-SNP posture. That is coordinator-level evidence; the receipt work needed to bind a particular request to both coordinator and provider evidence is still in progress.
4. Private buyer routing fails closed
Authenticated buyer traffic fails closed unless a non-self provider reaches the
code_attested tier. During alpha, that can mean a request returns unavailable
when no code-attested provider has capacity. A caller
cannot turn an authenticated private request into a weaker public-provider route
by asking for a lower tier.
client.chat.completions.create(
model=model_id, # an id from GET /v1/models (the catalog rotates)
messages=[{"role": "user", "content": "..."}],
# no trust downgrade is needed or accepted for private buyer routing
)Why this matters more than price (even though we’re also cheaper)
If you’re building in legal, medical, security, or finance - or any product where “we sent your users’ text to a vendor who logs it” is a non-starter - a policy promise isn’t enough. A verifiable chain is. That’s the difference between “trust us” and “check for yourself.”
Swap your base_url, keep your SDK: quickstart. Read the
adversary model in the threat model.
(Umbra is an experimental alpha. Treat unavailable receipt or attestation evidence as unavailable privacy proof.)