Privacy begins before the request
Encryption in transit is only one part of a private inference system. The client also needs evidence about the environment that will decrypt and process the request.
Enclave’s design puts the attestation check before inference dispatch. If a quote or measurement policy fails, the request does not reach the provider.
One composite boundary
A GPU confidential mode does not by itself describe the CPU environment that coordinates inference. The backend specification requires a composite CPU and GPU quote checked against vendor roots and the current policy.
A policy that can change
Measurement policy versioning allows approved serving images and security updates to evolve. Static measurement pinning is not the intended operating model. Registry changes and revocations must be enforced.
What the preview can demonstrate
The hosted backend has a NEAR adapter that checks remote hardware evidence before sending a prompt. Failed verification blocks inference. The application gateway processes requests before NEAR inference, and configuring a provider is not proof of a completed inference. Current deployment settings are published on the status page.