Frequently asked questions

Umbra is a marketplace for private-prompt inference on attested Apple Silicon. It is an OpenAI- and Anthropic-compatible API to the open-weight, uncensored, and community GGUF models independent providers host when incumbents will not. Providers run the models on their own Apple Silicon Macs; developers reach them by swapping their SDK base URL.

Your prompt is decrypted in memory only, used to generate the response, then zeroized: never logged, written to disk, or stored. The design goal is that the machine owner cannot read it either. The design assumes the provider is adversarial and closes the software paths rather than relying on a promise. See attestation status below for what is live in alpha.

Hardware and running-code attestation are live for admitted providers: the coordinator runs in an attested SEV-SNP CVM, Apple Managed Device Attestation verifies provider Macs at the hardware tier, and an APNs app-targeted nonce challenge elevates the genuine provider app to code_attested. Authenticated private routing fails closed below that tier. Signed per-response receipts remain a separate alpha roadmap item.

From weakest to strongest: none < self_signed < hardware < code_attested. hardware means Secure Enclave identity plus Apple MDA validation, freshness, serial and prompt-key binding; code_attested adds an independent APNs challenge proving the running app identity. Authenticated private routing requires code_attested.

Pricing is pay-per-token and platform-set: the same per-model rate for every provider, served live from GET /v1/models, with free signup credit and no card required. Any "free tokens" figure is an estimate; the real token count depends on the model and your input/output mix.

Developer top-up is live: you buy prepaid inference credit with a card via Stripe, and the charges are real. Credit is spendable on inference only, non-refundable, non-withdrawable, and has no cash value.

Connect a payout account from the provider wallet when your wallet shows payouts available, and complete Stripe identity and bank verification. Withdrawals require at least $25 in settled withdrawable earnings. Eligibility is in the provider agreement; projections are not payable.

Earnings combine a projected base-pay floor (for being attested, online, and ready, scaled by resident model footprint) and an on-demand per-token component from catalog prices. Only settled earnings credited as withdrawable may be paid out through the provider wallet when eligible; see the provider agreement.

An Apple Silicon Mac (M1 or newer) running macOS 14 or newer; Intel is not supported. Models are matched to unified memory (the console shows each model's minimum), and machines with roughly 16 GB or more can host models that qualify for base pay. Review the verified installer, manual-DMG fallback, and removal disclosure at /download/ before installing.

Every model is a public, open-weight GGUF on Hugging Face, selected and pulled by a provider with their own HF key; there are no buyer uploads or secret weights. For each one, /v1/models and the console surface the HF repo, pinned revision, license, GGUF SHA-256, architecture, quant, and minimum memory.

Yes. Umbra is content-neutral with provider approval: many models are uncensored, and you may use them for any lawful purpose, including legitimate uses mainstream providers decline to serve. Clearly-illegal models and uses (CSAM, fraud, malware, attacks on the network) are prohibited under the Terms of Service.

Each catalog entry pins a Hugging Face revision and a GGUF SHA-256 digest, verified on every request, and you should review the model's HF page and license before using it. Attestation proves the machine is genuine Apple Silicon but does not warrant outputs: verifying the model is your responsibility.

No: prompts and outputs are never retained, so there is nothing to produce, sell, or hand over. Umbra keeps only content-free account and metering data (email, a one-way hash of each API key, request and token counts, model used, wallet entries), never prompt or response text.

Sign in, mint a scoped API key in the console, then point your OpenAI or Anthropic client at https://api.tryumbra.dev/v1 with your umbra- key. Call GET /v1/models first to pick a model id that is live now rather than hardcoding one, since the catalog is small during alpha.