Secure, Private, and Isolated Compute
Models that report confidential_compute: true run inside trusted execution environments backed by Intel TDX and NVIDIA Protected PCIe, so request data is processed in hardware-isolated memory.
Intel TDX confidential VMs
TEE chutes run on sek8s, a security-hardened Kubernetes distribution, inside Intel Trust Domain Extensions (TDX) confidential virtual machines. The hypervisor is outside the trust boundary, so the host operator cannot inspect the CPU registers or memory of the trust domain.
NVIDIA Protected PCIe
The GPUs (such as the H100) run in NVIDIA Confidential Computing mode with Protected PCIe, so the CPU and GPU exchange data and code over an encrypted channel instead of the plain PCIe bus.
Attestation before execution
Before a TEE chute starts, the validator sends the node a fresh nonce, checks the Intel TD Quote that includes it and the NVIDIA GPU attestation report, and compares the measurements with a known-good sek8s configuration. The node’s encrypted root filesystem is only unlocked after attestation passes.
Signed images only
An admission controller in sek8s only schedules containers whose images were signed by Chutes’ cosign key, so a tampered image cannot run inside the TEE.
Check it yourself
The public model catalog at GET https://llm.chutes.ai/v1/models marks every TEE model with confidential_compute: true. Filter on that flag rather than the -TEE name suffix. In the live catalog (checked Nov 8, 2026), 10 of 18 models report confidential_compute: true.
Per-chute evidence comes from GET https://api.chutes.ai/chutes/<chute_id>/evidence with your API key and a fresh 64-hex-character nonce. Evidence that parses is not the same as a passed cryptographic (DCAP) verification; the private inference guide explains the difference.
No content logging
“Chutes does not log, store, or persist the content of your API requests or responses on Chutes systems, subject only to the limited exceptions in Section 6.3.”
“If you also use our end-to-end encryption mode, your content is encrypted on your device, decrypted only inside a verified TEE, and encrypted again before it leaves, so the Chutes application layer relays only ciphertext and a plaintext usage summary for billing.”
From the Privacy Policy, which also lists the request metadata Chutes does collect for billing and operations.
Go deeper
- Security architecture (docs)
- Private inference for agents
- Confidential Compute for AI Inference: How Chutes Delivers Verifiable Privacy with Trusted Execution Environments
- Private AI inference: what it means and how Chutes makes it verifiable
- End-to-End Encrypted AI Inference with Post-Quantum Cryptography
- I built an open-source TEE stack for confidential GPU compute
- Privacy Policy
- Data Processing Agreement
- sek8s on GitHub