Early access · Paid API credit is live. New accounts still get free starter credit.
PricingDocsModelsFAQEarnBlogAboutSign in →

Home / Docs / Trust

Private inference, verified.

The console stays operational. This document explains what gets verified, where the hard proof lives, and which pieces are still alpha. Unfamiliar terms are defined in the glossary.

The request path

Four checks separate a normal API call from an admitted private-inference request.

  1. 01

    Developer sends a prompt

    The API request reaches the coordinator through the OpenAI- or Anthropic-compatible surface.

  2. 02

    Coordinator checks its runtime

    The confidential coordinator path uses the SEV-SNP verifier before it makes a routing decision.

  3. 03

    Provider registers proof

    Mac trust is established on the WebSocket register frame with Managed Device Attestation material and freshness.

  4. 04

    Receipt work continues

    Server-signed response receipts are not live yet. The console labels that boundary honestly.

The attestation record

Everything the coordinator checks before a Mac may serve a private request, and everything that is not checked yet, on one sheet.

Umbra · attestation

Provider register frame

The one moment a Mac has to prove what it is. Everything below is checked before it may serve a private request.

document
attestation-record
scope
provider registration
verifier
coordinator/internal/verifier
revised

Part A · chain of custody

Five layers, checked in the order below on the WebSocket register frame. Every check fails closed: one failure rejects the registration and closes the socket. The mechanism behind each line is in provider attestation.

  1. Secure Enclave P-256signedThe provider signs the canonical register blob with a key generated inside the Enclave. The private key never leaves the chip, not even to RAM.
  2. Managed device identityMDM evidenceIdentity comes from Managed Device Attestation material the coordinator holds. Caller-supplied device inventory is not trusted for routing, pay, or UI proof.
  3. Apple MDA X.509 chainApple rootThe evidence chain is validated against the Apple Enterprise Attestation Root CA, then cross-checked against the serial inside the signed blob.
  4. Signed-blob freshness5 minBlobs older than five minutes are rejected, as is any prompt-encryption key that differs from the one covered by the signature.
  5. APNs running-code identitycode_attestedAn app-targeted APNs nonce proves the signed app is the code actually running. Authenticated private routing fails closed below this tier.

Part B · proof ledger

Implementation status. A control listed as pending is not a guarantee, and nothing on this page treats it as one.

Coordinator SEV-SNP verifier
live
Provider register-frame freshness
live
App signing and notarization
draft verified
Wallet and user APIs
coordinator-backed
Public provider DMG on /dl
pending
Server-signed response receipts
pending
Public payable routing tier
fail-closed
Authenticated private routing is refused below the code_attested tier rather than downgraded to it.
Cash-out settlement
rolling out
Wallet-gated until settlement is complete.

What this record does not cover. Per-request signed receipts are not live. Registration proves which machine is admitted to serve; it does not yet hand you a signature over an individual response. Alpha is labelled as alpha everywhere it appears.

What stays operator-trusted, and what is out of scope, is set out in the threat model.

Read the hard boundaries

Apple provider attestationSecure Enclave identity, Managed Device Attestation, signed freshness, and prompt-key binding at provider registration.Threat modelWhat Umbra is designed to protect, what remains operator-trusted, and what is explicitly out of scope during alpha.Live network statsCurrent model, provider, and request counts from the coordinator. No fabricated supply or traffic.