When you add -TEE to a model, your request runs in a sealed hardware enclave. Here is exactly what that protects, what it doesn't, and how you can check for yourself — no marketing words.
A Trusted Execution Environment (TEE) is a hardware-isolated region of a CPU and GPU — Intel TDX plus NVIDIA Confidential Computing on H100/H200-class hardware. Code and data inside it are encrypted in memory and shielded from the host operating system, the hypervisor, and the operator running the machine. Your prompt is decrypted only inside that sealed boundary, processed, and the result handed back — without the host being able to casually read it in between. On modern GPUs this runs large models at a single-digit-percent performance cost, which is why it's the one privacy technology viable for real-time, frontier-scale inference today.
You don't have to take our word that a request ran in a genuine enclave. The hardware produces a signed attestation quote — a cryptographic statement of which code, model, and hardware booted inside the TEE. A client can check that quote against reference measurements before trusting the endpoint with anything sensitive. Attestation proves the environment is genuine and the code is what was published; it does not, by itself, prove the code is bug-free or that no exotic physical attack exists. We're building a per-request attestation surface so this check is one call, not a research project — and so you verify against an independent reference, not just our say-so.
No single technology is "most private" for free — each trades capability, speed, or trust for confidentiality.
Zero-knowledge ML proves a result is correct but doesn't hide your prompt from the prover, and can't keep pace with interactive token generation. Fully homomorphic encryption is the strongest — computing on data that's never decrypted — but remains orders of magnitude too slow for large language models. For running a frontier-scale model that returns a token in real time, a TEE is the honest sweet spot, and that's where OpenTau's -TEE models run.
Same API, one suffix. Add -TEE to the model id (or flip Privacy on in DeChat / the playground) and the request routes to a sealed enclave instead of an ordinary node.