Zero-Trust Attestation

TEE
Verification

Independent cryptographic verification of hardware attestation evidence from confidential inference providers. Raw quotes are parsed and verified against vendor roots of trust — no server-side claims are trusted.

122 Total Checks
35 Verified
50 Partial
29 Failed
8 Unreachable
6 TEE-Terminated TLS 46 Attested E2EE 33 TEE-only Gateway
Last checked: Jul 11, 2026, 10:00 PM 🔔 Alerts RSS Methodology: Raw TDX/SNP quotes verified via Intel DCAP quote verification (dcap-qvl) using Intel PCS (default) / AMD KDS VCEK path; compose hashes are recomputed and compared against claimed `tcb_info`; image digests are checked through OCI registry evidence where available or verified policy initdata for Privatemode. Hardware-verified checks with incomplete image or Sigstore provenance are reported as partial, not failed. Privatemode requires independent Contrast Coordinator attestation and active-manifest matching; public manifest metadata or proxy liveness alone is not counted as verification. Trust model: Zero-trust — verified channels are categorized as TEE-Terminated TLS, Attested E2EE, or TEE-only Gateway

Chutes

0+9/15 Alerts RSS
Critical trust failures At least one check failed a quote, freshness, key-binding, measurement, or policy gate.
0 verified 9 partial 3 failed 3 unavailable
Intel TDX Attested E2EE
Hardware 3 bad Freshness 1 bad Key binding 9/15 good Workload Not shown Provenance 9 warning Availability 3 warning
Hardware policy rejected 2 Verifier policy failed 1 Image not pinned 9 Endpoint unavailable 3
◐ Deepseek Ai/DeepSeek V3.2 TEE (TEE) Intel TDX Attested E2EE Details
Image not pinned Hardware/channel passed; the container image is not pinned to a verified digest.
Quote Intel TDX (DCAP QVL)
TCB Level status=UpToDate, advisories=[]
Report Data 8539efb40f86d99b173eb3c3db4f298b657d33bb48414ea864843cd3958d98f1bc2f15d26912aba3b9ffbc750cedb236c7f9057e2d6e6e830134352ee91ef1a5
Signature ECDSA-P384 ✓
Confidential Channel E2EE to attested enclave key ✓
Signer Bound Yes ✓
Nonce Bound Yes ✓
registry.chutes.ai/chutes/sglang:nightly-2026031300-7f2b15c9e6e9
Security Model Attested E2EE
What This Means Payloads are encrypted to an attested enclave key; gateway TLS termination is expected
E2EE Protocol ML-KEM-768 E2E
Signing Key ml-kem-768:ef947600-5838-4b97-a6f6-9d9a19cf57cc
chute:deepseek-ai/DeepSeek-V3.2-TEEinstance:ef947600-5838-4b97-a6f6-9d9a19cf57cccertificate-present:truegpu-evidence-count:8revision:a7e62ac04ecb2c0a54d736dc46601c5606cf10a6lock-modules:trueexternal-egress:falsechutes-version:0.6.6image-id:d63d064c-4add-5213-b278-d3125c8078fdimage-status:built and pushedimage-chutes-version:0.6.6
◐ Google/gemma 4 31B Turbo TEE (TEE) Intel TDX Attested E2EE Details
Image not pinned Hardware/channel passed; the container image is not pinned to a verified digest.
Quote Intel TDX (DCAP QVL)
TCB Level status=UpToDate, advisories=[]
Report Data 0d4989dbc3eb5c42eb4f5a6c91bf4cc0ba30c51d1b80d6deeb75e1e58621068e10e7fec6345109965fe245e43c186e5d29fa1828ad567507c673933488f82048
Signature ECDSA-P384 ✓
Confidential Channel E2EE to attested enclave key ✓
Signer Bound Yes ✓
Nonce Bound Yes ✓
registry.chutes.ai/chutes/sglang:0.5.13-post1c
Security Model Attested E2EE
What This Means Payloads are encrypted to an attested enclave key; gateway TLS termination is expected
E2EE Protocol ML-KEM-768 E2E
Signing Key ml-kem-768:a5c09c0b-e7ba-481d-ad6f-fb4f35a63572
chute:google/gemma-4-31B-turbo-TEEinstance:a5c09c0b-e7ba-481d-ad6f-fb4f35a63572certificate-present:truegpu-evidence-count:1revision:e5ef03afa233c35cb000323ff098d4291e1dd07clock-modules:trueexternal-egress:falsechutes-version:0.6.11.rc2image-id:a3028618-6f8f-5afc-9a51-8eff25f2e5c8image-status:built and pushedimage-chutes-version:0.6.11.rc2
◐ MiniMaxAI/MiniMax M2.5 TEE (TEE) Intel TDX Attested E2EE Details
Image not pinned Hardware/channel passed; the container image is not pinned to a verified digest.
Quote Intel TDX (DCAP QVL)
TCB Level status=UpToDate, advisories=[]
Report Data 05a968dea8d23ce67bd63ffd1b2262c561e0eee60c46baa2fe6d5a331833c2c50d0b765901c6e4bbd48905799f4909828eda0551a5fe96315b6b4d109b3dd8f0
Signature ECDSA-P384 ✓
Confidential Channel E2EE to attested enclave key ✓
Signer Bound Yes ✓
Nonce Bound Yes ✓
registry.chutes.ai/chutes/sglang:nightly-2026043000
Security Model Attested E2EE
What This Means Payloads are encrypted to an attested enclave key; gateway TLS termination is expected
E2EE Protocol ML-KEM-768 E2E
Signing Key ml-kem-768:2a9e1f8d-0a43-48f0-a055-c1bf4781b1c8
chute:MiniMaxAI/MiniMax-M2.5-TEEinstance:2a9e1f8d-0a43-48f0-a055-c1bf4781b1c8certificate-present:truegpu-evidence-count:8revision:37649bdaab7de76902236a546b2df436a93a33balock-modules:trueexternal-egress:falsechutes-version:0.6.5image-id:fef3b089-b516-5c04-bf72-ae56ad48492aimage-status:built and pushedimage-chutes-version:0.6.5
✗ Moonshotai/Kimi K2.5 TEE (TEE) Details
Hardware policy rejected The hardware quote did not satisfy the configured verifier policy.
Check No public attestation endpoint
◐ Moonshotai/Kimi K2.6 TEE (TEE) Intel TDX Attested E2EE Details
Image not pinned Hardware/channel passed; the container image is not pinned to a verified digest.
Quote Intel TDX (DCAP QVL)
TCB Level status=UpToDate, advisories=[]
Report Data 80f7acd7e099def61b8a65b156ea1dfd6488758a70214947f208b060e0ef9126e71e38b82ecd02d81a0fe55dc6ea5b47488ff8d78a6dbf9e3f90e25c0d905258
Signature ECDSA-P384 ✓
Confidential Channel E2EE to attested enclave key ✓
Signer Bound Yes ✓
Nonce Bound Yes ✓
registry.chutes.ai/chutes/vllm:nightly-2026031400-03df6abfe49f
Security Model Attested E2EE
What This Means Payloads are encrypted to an attested enclave key; gateway TLS termination is expected
E2EE Protocol ML-KEM-768 E2E
Signing Key ml-kem-768:0ff2f6f6-c66b-4931-8366-a57547304db0
chute:moonshotai/Kimi-K2.6-TEEinstance:0ff2f6f6-c66b-4931-8366-a57547304db0certificate-present:truegpu-evidence-count:8revision:d9cb81bc88b9bd2dc89877599f23c614ded72b9clock-modules:trueexternal-egress:falsechutes-version:0.6.6image-id:5bbb13bc-c050-518d-bb55-79994b540ec2image-status:built and pushedimage-chutes-version:0.6.6
✗ Nvidia/NVIDIA Nemotron 3 Ultra 550B A55B TEE (TEE) Details
Hardware policy rejected The hardware quote did not satisfy the configured verifier policy.
Check No public attestation endpoint
⚠ Qwen/Qwen3 235B A22B Thinking 2507 TEE (TEE) Details
Endpoint unavailable Fresh evidence could not be fetched in this run.
Check No public attestation endpoint
◐ Qwen/Qwen3 32B TEE (TEE) Intel TDX Attested E2EE Details
Image not pinned Hardware/channel passed; the container image is not pinned to a verified digest.
Quote Intel TDX (DCAP QVL)
TCB Level status=UpToDate, advisories=[]
Report Data 3bfbaee1aaeec7d0fa0bdceb37ce527e4f252e9f247e62f59c94ce329f8cb41a4f4faabd8b2b377ae0ab96f8f5a32ea6b076c35496d2e0bc66154b51f504825f
Signature ECDSA-P384 ✓
Confidential Channel E2EE to attested enclave key ✓
Signer Bound Yes ✓
Nonce Bound Yes ✓
registry.chutes.ai/chutes/sglang:0.5.13-post1c
Security Model Attested E2EE
What This Means Payloads are encrypted to an attested enclave key; gateway TLS termination is expected
E2EE Protocol ML-KEM-768 E2E
Signing Key ml-kem-768:e21c6c9d-3b73-4421-a0ff-08abe799a159
chute:Qwen/Qwen3-32B-TEEinstance:e21c6c9d-3b73-4421-a0ff-08abe799a159certificate-present:truegpu-evidence-count:8revision:aa55da1ecc13d006e8b8e4f54579b1ea8c3db2dflock-modules:trueexternal-egress:falsechutes-version:0.6.11.rc2image-id:a3028618-6f8f-5afc-9a51-8eff25f2e5c8image-status:built and pushedimage-chutes-version:0.6.11.rc2
◐ Qwen/Qwen3.5 397B A17B TEE (TEE) Intel TDX Attested E2EE Details
Image not pinned Hardware/channel passed; the container image is not pinned to a verified digest.
Quote Intel TDX (DCAP QVL)
TCB Level status=UpToDate, advisories=[]
Report Data c3c65e011c85b1d980b271fdbacb492c227d2a6f6a8c79df06efe7dccb2c7108f37a4829cbeeaf94cc73c0fd58a85588d7ff266796216bbc14ef84aa8853a77b
Signature ECDSA-P384 ✓
Confidential Channel E2EE to attested enclave key ✓
Signer Bound Yes ✓
Nonce Bound Yes ✓
registry.chutes.ai/chutes/sglang:0.5.13-post1b
Security Model Attested E2EE
What This Means Payloads are encrypted to an attested enclave key; gateway TLS termination is expected
E2EE Protocol ML-KEM-768 E2E
Signing Key ml-kem-768:0b056432-ab15-4a6f-92bf-56ccc0e40d26
chute:Qwen/Qwen3.5-397B-A17B-TEEinstance:0b056432-ab15-4a6f-92bf-56ccc0e40d26certificate-present:truegpu-evidence-count:8revision:9f1f3de9a3a48cfd340fd73ca98c02625b7afb3block-modules:trueexternal-egress:falsechutes-version:0.6.11.rc2image-id:cc46d5fd-9059-59f4-b208-83ff6ff11c31image-status:built and pushedimage-chutes-version:0.6.11.rc2
◐ Qwen/Qwen3.6 27B TEE (TEE) Intel TDX Attested E2EE Details
Image not pinned Hardware/channel passed; the container image is not pinned to a verified digest.
Quote Intel TDX (DCAP QVL)
TCB Level status=UpToDate, advisories=[]
Report Data 33769e040488de0352f06589cef2f26a9dc704ad8841e1cefb81e57399a174b5c659171c1e0dff9169f2a0a26805670ee83a2a1d10bf0dc4a7effb19522bd421
Signature ECDSA-P384 ✓
Confidential Channel E2EE to attested enclave key ✓
Signer Bound Yes ✓
Nonce Bound Yes ✓
registry.chutes.ai/chutes/sglang:0.5.13-post1c
Security Model Attested E2EE
What This Means Payloads are encrypted to an attested enclave key; gateway TLS termination is expected
E2EE Protocol ML-KEM-768 E2E
Signing Key ml-kem-768:e43b8e22-2185-4276-9e92-25e287940588
chute:Qwen/Qwen3.6-27B-TEEinstance:e43b8e22-2185-4276-9e92-25e287940588certificate-present:truegpu-evidence-count:1revision:e89b16ebf1988b3d6befa7de50abc2d76f26eb09lock-modules:trueexternal-egress:falsechutes-version:0.6.11.rc2image-id:a3028618-6f8f-5afc-9a51-8eff25f2e5c8image-status:built and pushedimage-chutes-version:0.6.11.rc2
◐ Unsloth/Mistral Nemo Instruct 2407 TEE (TEE) Intel TDX Attested E2EE Details
Image not pinned Hardware/channel passed; the container image is not pinned to a verified digest.
Quote Intel TDX (DCAP QVL)
TCB Level status=UpToDate, advisories=[]
Report Data 68102db8665033915b55d5adb6f1aecf1093be34546d84819564debd90a94ae93d52db5071df543ae1e178de6866ca978a2da4867299aa3417ccd3f66d12f1ae
Signature ECDSA-P384 ✓
Confidential Channel E2EE to attested enclave key ✓
Signer Bound Yes ✓
Nonce Bound Yes ✓
registry.chutes.ai/chutes/sglang:nightly-2026050600-9bf2c6dee5f7
Security Model Attested E2EE
What This Means Payloads are encrypted to an attested enclave key; gateway TLS termination is expected
E2EE Protocol ML-KEM-768 E2E
Signing Key ml-kem-768:1a90fbe0-0ab1-4e2f-aa15-f76cf7f9cdfc
chute:unsloth/Mistral-Nemo-Instruct-2407-TEEinstance:1a90fbe0-0ab1-4e2f-aa15-f76cf7f9cdfccertificate-present:truegpu-evidence-count:1revision:e9976040f42d8a5590ed58cefe973061b3f973b5lock-modules:trueexternal-egress:falsechutes-version:0.6.8image-id:e8a097de-bebd-5dfe-b69f-532a6c06a57eimage-status:built and pushedimage-chutes-version:0.6.8
⚠ Zai Org/GLM 5 NVFP4 TEE (TEE) Details
Endpoint unavailable Fresh evidence could not be fetched in this run.
Check No public attestation endpoint
◐ Zai Org/GLM 5 TEE (TEE) Intel TDX Attested E2EE Details
Image not pinned Hardware/channel passed; the container image is not pinned to a verified digest.
Quote Intel TDX (DCAP QVL)
TCB Level status=UpToDate, advisories=[]
Report Data d3c387d5254702fc46232c445f57e6a9422517d6419b8bf629e22053197c3407f4ce20f618ea7000dc9e5412aaedef6d663b8dd81b18fd0800c4cb2665109451
Signature ECDSA-P384 ✓
Confidential Channel E2EE to attested enclave key ✓
Signer Bound Yes ✓
Nonce Bound Yes ✓
registry.chutes.ai/chutes/sglang:nightly-2026050600-9bf2c6dee5f7
Security Model Attested E2EE
What This Means Payloads are encrypted to an attested enclave key; gateway TLS termination is expected
E2EE Protocol ML-KEM-768 E2E
Signing Key ml-kem-768:76181b82-ed2d-4c22-95b4-262c189409f0
chute:zai-org/GLM-5-TEEinstance:76181b82-ed2d-4c22-95b4-262c189409f0certificate-present:truegpu-evidence-count:8revision:949e09d70b611943740a3d79a0f46a63947498a6lock-modules:trueexternal-egress:falsechutes-version:0.6.8image-id:e8a097de-bebd-5dfe-b69f-532a6c06a57eimage-status:built and pushedimage-chutes-version:0.6.8
⚠ Zai Org/GLM 5.1 TEE (TEE) Details
Endpoint unavailable Fresh evidence could not be fetched in this run.
Check No public attestation endpoint
✗ Zai Org/GLM 5.2 TEE (TEE) Details
Verifier policy failed TDX quote verification failed: Quote verification failed: No matching TCB level found
Check No public attestation endpoint

Maple

0+1/1 Alerts RSS
Hardware verified, provenance incomplete TEE/channel evidence passed for partial checks; workload provenance is not fully pinned.
0 verified 1 partial 0 failed 0 unavailable
Attested E2EE
Hardware 1/1 good Freshness Not shown Key binding 1/1 good Workload Not shown Provenance 1 warning Availability 1/1 good
Source provenance incomplete 1
◐ Maple Enclave (AWS Nitro) Attested E2EE Details
Source provenance incomplete Hardware/channel passed; source or image provenance is incomplete.
Check No public attestation endpoint

NanoGPT

0+32/32 Alerts RSS
Hardware verified, provenance incomplete TEE/channel evidence passed for partial checks; workload provenance is not fully pinned.
0 verified 32 partial 0 failed 0 unavailable
TDX + SNP TEE-only Gateway
Hardware 32/32 good Freshness 1/32 good Key binding 22/32 good Workload 26 bad Provenance 32 warning Availability 32/32 good
Source provenance incomplete 31 Image not pinned 1
◐ DeepSeek V3.2 (TEE) Intel TDX TEE-only Gateway Details
Source provenance incomplete Hardware/channel passed; source or image provenance is incomplete.
Quote Intel TDX (DCAP QVL)
TCB Level status=UpToDate, advisories=[]
Report Data 79a5061efe5a46b0d1f33b11cf1c5adbedae6b79000000000000000000000000ad5760c3e0087bca47e0fa53be5b1e87d0e012171c31f20aa05bf46dbd305e7c
Signature ECDSA-P384 ✓
Compose Hash Mismatch ✗
Signer Bound Yes ✓
Enclave TLS Pin 993daa286650eedd76f6c7d11d6ddd9bb0bf4e160fd4ba2f146eba0f9ff06aa7 ✗
Security Model TEE-only Gateway
What This Means Model runs in TEE but gateway sees plaintext prompts
◐ DeepSeek V4 Pro (TEE) Intel TDX TEE-only Gateway Details
Source provenance incomplete Hardware/channel passed; source or image provenance is incomplete.
Quote Intel TDX (DCAP QVL)
TCB Level status=UpToDate, advisories=[]
Report Data 1ec62d8eaa2bfb4b942df6f69ce30efe8fe3a400c8da813e831415fca5f5b17c23dc187af23ba8bd2a998aec4ef28e18692a179c8cec7f255c8f9fd0d459356a
Signature ECDSA-P384 ✓
Enclave TLS Pin 993daa286650eedd76f6c7d11d6ddd9bb0bf4e160fd4ba2f146eba0f9ff06aa7 ✗
Security Model TEE-only Gateway
What This Means Model runs in TEE but gateway sees plaintext prompts
◐ Gemma 4 31B (TEE) Intel TDX TEE-only Gateway Details
Source provenance incomplete Hardware/channel passed; source or image provenance is incomplete.
Quote Intel TDX (DCAP QVL)
TCB Level status=UpToDate, advisories=[]
Report Data e7840b68358c853b1c252487db6a5a2de360c64b4129c83053d4bb8feb73cfca18504e2e4dcf6b5cb9faae17b7aaaf396a7fe3332af627846587a6267a23ec4f
Signature ECDSA-P384 ✓
Enclave TLS Pin 993daa286650eedd76f6c7d11d6ddd9bb0bf4e160fd4ba2f146eba0f9ff06aa7 ✗
Security Model TEE-only Gateway
What This Means Model runs in TEE but gateway sees plaintext prompts
◐ GLM 5.1 (TEE) Intel TDX TEE-only Gateway Details
Source provenance incomplete Hardware/channel passed; source or image provenance is incomplete.
Quote Intel TDX (DCAP QVL)
TCB Level status=UpToDate, advisories=[]
Report Data 79a5061efe5a46b0d1f33b11cf1c5adbedae6b790000000000000000000000005bcf8f0d0b4455db3c2634dbca8f865d3447937c25a1a9d4cbc243e61f7f6438
Signature ECDSA-P384 ✓
Compose Hash Mismatch ✗
Signer Bound Yes ✓
Enclave TLS Pin 993daa286650eedd76f6c7d11d6ddd9bb0bf4e160fd4ba2f146eba0f9ff06aa7 ✗
Security Model TEE-only Gateway
What This Means Model runs in TEE but gateway sees plaintext prompts
◐ GPT-OSS 120B (TEE) Intel TDX TEE-only Gateway Details
Source provenance incomplete Hardware/channel passed; source or image provenance is incomplete.
Quote Intel TDX (DCAP QVL)
TCB Level status=UpToDate, advisories=[]
Report Data 79a5061efe5a46b0d1f33b11cf1c5adbedae6b790000000000000000000000009c95f99d72a1f5de2f0ff44682b3c55fbda72d8b1d7bf0fcc3b5d717dbd3d46f
Signature ECDSA-P384 ✓
Compose Hash Mismatch ✗
Signer Bound Yes ✓
Enclave TLS Pin 993daa286650eedd76f6c7d11d6ddd9bb0bf4e160fd4ba2f146eba0f9ff06aa7 ✗
Security Model TEE-only Gateway
What This Means Model runs in TEE but gateway sees plaintext prompts
◐ Kimi K2.6 (TEE) Intel TDX TEE-only Gateway Details
Source provenance incomplete Hardware/channel passed; source or image provenance is incomplete.
Quote Intel TDX (DCAP QVL)
TCB Level status=UpToDate, advisories=[]
Report Data 79a5061efe5a46b0d1f33b11cf1c5adbedae6b7900000000000000000000000021b7503325d9dc0d00f8406a41dfe6cea79eea471860805b50099360fa993f4c
Signature ECDSA-P384 ✓
Compose Hash Mismatch ✗
Signer Bound Yes ✓
Enclave TLS Pin 993daa286650eedd76f6c7d11d6ddd9bb0bf4e160fd4ba2f146eba0f9ff06aa7 ✗
Security Model TEE-only Gateway
What This Means Model runs in TEE but gateway sees plaintext prompts
◐ Llama 3.3 70B (TEE) AMD SEV-SNP TEE-only Gateway Details
Source provenance incomplete Hardware/channel passed; source or image provenance is incomplete.
Quote AMD SEV-SNP (VCEK)
Policy 0x30000
Report Data 281ad7bea31b1c428d5100ee142478e76ab48f091b84e4f9505df75b1cde68840e1d011d09c176637d27a2c2b62406d2d0795f88c0c452b4a9d561d3bbaaea3d
Signature ECDSA-P384 ✓
Enclave TLS Pin 993daa286650eedd76f6c7d11d6ddd9bb0bf4e160fd4ba2f146eba0f9ff06aa7 ✗
Security Model TEE-only Gateway
What This Means Model runs in TEE but gateway sees plaintext prompts
◐ Qwen3.5 397B (TEE) Intel TDX TEE-only Gateway Details
Source provenance incomplete Hardware/channel passed; source or image provenance is incomplete.
Quote Intel TDX (DCAP QVL)
TCB Level status=UpToDate, advisories=[]
Report Data 72b30645b801484bde6b6a96ebf98cf031691f107bc34a18aa964cde9df14852bf7c9092c0d3ff872dc8dc6b593e73aae6e5e41f862e5b507015fb678b5caaa3
Signature ECDSA-P384 ✓
Compose Hash Mismatch ✗
Enclave TLS Pin 993daa286650eedd76f6c7d11d6ddd9bb0bf4e160fd4ba2f146eba0f9ff06aa7 ✗
Security Model TEE-only Gateway
What This Means Model runs in TEE but gateway sees plaintext prompts
◐ TEE/deepseek V3.1 (TEE) Intel TDX TEE-only Gateway Details
Source provenance incomplete Hardware/channel passed; source or image provenance is incomplete.
Quote Intel TDX (DCAP QVL)
TCB Level status=UpToDate, advisories=[]
Report Data 79a5061efe5a46b0d1f33b11cf1c5adbedae6b79000000000000000000000000758b27f3bb470332ae8ebfaf4cd5d2b242f45c9767646c75162b2f8fcb865125
Signature ECDSA-P384 ✓
Compose Hash Mismatch ✗
Signer Bound Yes ✓
Enclave TLS Pin 993daa286650eedd76f6c7d11d6ddd9bb0bf4e160fd4ba2f146eba0f9ff06aa7 ✗
Security Model TEE-only Gateway
What This Means Model runs in TEE but gateway sees plaintext prompts
◐ TEE/deepseek V4 Flash (TEE) Intel TDX TEE-only Gateway Details
Source provenance incomplete Hardware/channel passed; source or image provenance is incomplete.
Quote Intel TDX (DCAP QVL)
TCB Level status=UpToDate, advisories=[]
Report Data 79a5061efe5a46b0d1f33b11cf1c5adbedae6b790000000000000000000000005b3936925a6a34f6b7db40211ea39cd60e2c062a58abc194d43876c48c05ede4
Signature ECDSA-P384 ✓
Compose Hash Mismatch ✗
Signer Bound Yes ✓
Enclave TLS Pin 993daa286650eedd76f6c7d11d6ddd9bb0bf4e160fd4ba2f146eba0f9ff06aa7 ✗
Security Model TEE-only Gateway
What This Means Model runs in TEE but gateway sees plaintext prompts
◐ TEE/deepseek V4 Pro:thinking (TEE) Intel TDX TEE-only Gateway Details
Source provenance incomplete Hardware/channel passed; source or image provenance is incomplete.
Quote Intel TDX (DCAP QVL)
TCB Level status=UpToDate, advisories=[]
Report Data 1ec62d8eaa2bfb4b942df6f69ce30efe8fe3a400c8da813e831415fca5f5b17c23dc187af23ba8bd2a998aec4ef28e18692a179c8cec7f255c8f9fd0d459356a
Signature ECDSA-P384 ✓
Enclave TLS Pin 993daa286650eedd76f6c7d11d6ddd9bb0bf4e160fd4ba2f146eba0f9ff06aa7 ✗
Security Model TEE-only Gateway
What This Means Model runs in TEE but gateway sees plaintext prompts
◐ TEE/gemma 3 27b It (TEE) Intel TDX TEE-only Gateway Details
Source provenance incomplete Hardware/channel passed; source or image provenance is incomplete.
Quote Intel TDX (DCAP QVL)
TCB Level status=UpToDate, advisories=[]
Report Data 79a5061efe5a46b0d1f33b11cf1c5adbedae6b79000000000000000000000000488233766bf5b3d12d95e2eb5731e6a9c038a1f491fdc55266d695d062a4cc30
Signature ECDSA-P384 ✓
Compose Hash Mismatch ✗
Signer Bound Yes ✓
Enclave TLS Pin 993daa286650eedd76f6c7d11d6ddd9bb0bf4e160fd4ba2f146eba0f9ff06aa7 ✗
Security Model TEE-only Gateway
What This Means Model runs in TEE but gateway sees plaintext prompts
◐ TEE/gemma 4 26b A4b Uncensored (TEE) Intel TDX TEE-only Gateway Details
Source provenance incomplete Hardware/channel passed; source or image provenance is incomplete.
Quote Intel TDX (DCAP QVL)
TCB Level status=UpToDate, advisories=[]
Report Data 79a5061efe5a46b0d1f33b11cf1c5adbedae6b790000000000000000000000005fa8c58b4f3bda28eb7d65f8389544935aba85c581d2d8dc9e1d451fbc529648
Signature ECDSA-P384 ✓
Compose Hash Mismatch ✗
Signer Bound Yes ✓
Enclave TLS Pin 993daa286650eedd76f6c7d11d6ddd9bb0bf4e160fd4ba2f146eba0f9ff06aa7 ✗
Security Model TEE-only Gateway
What This Means Model runs in TEE but gateway sees plaintext prompts
◐ TEE/gemma 4 31b It (TEE) Intel TDX TEE-only Gateway Details
Source provenance incomplete Hardware/channel passed; source or image provenance is incomplete.
Quote Intel TDX (DCAP QVL)
TCB Level status=UpToDate, advisories=[]
Report Data 79a5061efe5a46b0d1f33b11cf1c5adbedae6b79000000000000000000000000d2e6f33af4966ed34d72fa01b453ea111e1e4150de68a97b7b8f346e522ee200
Signature ECDSA-P384 ✓
Compose Hash Mismatch ✗
Signer Bound Yes ✓
Enclave TLS Pin 993daa286650eedd76f6c7d11d6ddd9bb0bf4e160fd4ba2f146eba0f9ff06aa7 ✗
Security Model TEE-only Gateway
What This Means Model runs in TEE but gateway sees plaintext prompts
◐ TEE/gemma4 31b:thinking (TEE) Intel TDX TEE-only Gateway Details
Source provenance incomplete Hardware/channel passed; source or image provenance is incomplete.
Quote Intel TDX (DCAP QVL)
TCB Level status=UpToDate, advisories=[]
Report Data 91dc5efe4959b4d8e34e0817c1f4ed0515dec4ee90c70763f13155b5e9934f4231e7cf478ada3dac804ef6f3bb749b7a2b85ecdb3c8147ead95339c4fc524e0a
Signature ECDSA-P384 ✓
Enclave TLS Pin 993daa286650eedd76f6c7d11d6ddd9bb0bf4e160fd4ba2f146eba0f9ff06aa7 ✗
Security Model TEE-only Gateway
What This Means Model runs in TEE but gateway sees plaintext prompts
◐ TEE/glm 4.7 (TEE) Intel TDX TEE-only Gateway Details
Source provenance incomplete Hardware/channel passed; source or image provenance is incomplete.
Quote Intel TDX (DCAP QVL)
TCB Level status=UpToDate, advisories=[]
Report Data 79a5061efe5a46b0d1f33b11cf1c5adbedae6b7900000000000000000000000072e67e7d205d1c7d821914678e726df3b21d7e3fb339da1ecec2e49f0dd8d407
Signature ECDSA-P384 ✓
Compose Hash Mismatch ✗
Signer Bound Yes ✓
Enclave TLS Pin 993daa286650eedd76f6c7d11d6ddd9bb0bf4e160fd4ba2f146eba0f9ff06aa7 ✗
Security Model TEE-only Gateway
What This Means Model runs in TEE but gateway sees plaintext prompts
◐ TEE/glm 4.7 Flash (TEE) Intel TDX TEE-only Gateway Details
Image not pinned Hardware/channel passed; the container image is not pinned to a verified digest.
Quote Intel TDX (DCAP QVL)
TCB Level status=UpToDate, advisories=[]
Report Data ae8a26ad17ca676e555280ea3bb9b8f6e83061ff000000000000000000000000d8d11815e4feb54197ebf16b9938ebb2c675f23e336d28c93dc42033b32182df
Signature ECDSA-P384 ✓
Compose Hash Verified ✓
TCB Consistent sha256 match ✓
Signer Bound Yes ✓
Nonce Bound Yes ✓
Enclave TLS Pin 993daa286650eedd76f6c7d11d6ddd9bb0bf4e160fd4ba2f146eba0f9ff06aa7 ✗
Images 6 containers
dstacktee/dstack-ingress:2.2python:3.10-slimdstacktee/vllm-proxy:v0.2.20zozyo/phala-vllm-customs:pvc-v0.7.10lmsysorg/sglang:v0.5.10haproxy:2.9-alpine
RTMR0 6ffe4a2c12f07eccb857f70f370a5af848a7062905cd95adc43abb1f62c39e330aa3c8aeb8f162656c025f3f527600f1
OS Image 806a352e16175d90568de97dff563f31f680239e6b90e9b5b2e9141d0955b0d9
Security Model TEE-only Gateway
What This Means Model runs in TEE but gateway sees plaintext prompts
Infrastructure unknown-dstack
◐ TEE/glm 5 (TEE) Intel TDX TEE-only Gateway Details
Source provenance incomplete Hardware/channel passed; source or image provenance is incomplete.
Quote Intel TDX (DCAP QVL)
TCB Level status=UpToDate, advisories=[]
Report Data 79a5061efe5a46b0d1f33b11cf1c5adbedae6b79000000000000000000000000fdc4a6d5bbbaf85d631251c38b71eb566117a34e117dc669478e5fc26e0df08c
Signature ECDSA-P384 ✓
Compose Hash Mismatch ✗
Signer Bound Yes ✓
Enclave TLS Pin 993daa286650eedd76f6c7d11d6ddd9bb0bf4e160fd4ba2f146eba0f9ff06aa7 ✗
Security Model TEE-only Gateway
What This Means Model runs in TEE but gateway sees plaintext prompts
◐ TEE/glm 5.1 Thinking (TEE) Intel TDX TEE-only Gateway Details
Source provenance incomplete Hardware/channel passed; source or image provenance is incomplete.
Quote Intel TDX (DCAP QVL)
TCB Level status=UpToDate, advisories=[]
Report Data 79a5061efe5a46b0d1f33b11cf1c5adbedae6b79000000000000000000000000e5aab42556518d3ff713cfca1b7c0b958e05e92b61cefd797477b0cdf716d9d0
Signature ECDSA-P384 ✓
Compose Hash Mismatch ✗
Signer Bound Yes ✓
Enclave TLS Pin 993daa286650eedd76f6c7d11d6ddd9bb0bf4e160fd4ba2f146eba0f9ff06aa7 ✗
Security Model TEE-only Gateway
What This Means Model runs in TEE but gateway sees plaintext prompts
◐ TEE/glm 5.2 (TEE) Intel TDX TEE-only Gateway Details
Source provenance incomplete Hardware/channel passed; source or image provenance is incomplete.
Quote Intel TDX (DCAP QVL)
TCB Level status=UpToDate, advisories=[]
Report Data 79a5061efe5a46b0d1f33b11cf1c5adbedae6b790000000000000000000000005a6654754f9149f020fc7f3c72f5de7f3b119c862f22f9bf059f44a2ad2823f9
Signature ECDSA-P384 ✓
Compose Hash Mismatch ✗
Signer Bound Yes ✓
Enclave TLS Pin 993daa286650eedd76f6c7d11d6ddd9bb0bf4e160fd4ba2f146eba0f9ff06aa7 ✗
Security Model TEE-only Gateway
What This Means Model runs in TEE but gateway sees plaintext prompts
◐ TEE/glm 5.2:thinking (TEE) Intel TDX TEE-only Gateway Details
Source provenance incomplete Hardware/channel passed; source or image provenance is incomplete.
Quote Intel TDX (DCAP QVL)
TCB Level status=UpToDate, advisories=[]
Report Data 79a5061efe5a46b0d1f33b11cf1c5adbedae6b7900000000000000000000000050563aa928166534d20b5efe5a7d1da06edd17568f514d4dbb4d7579ef4e34df
Signature ECDSA-P384 ✓
Compose Hash Mismatch ✗
Signer Bound Yes ✓
Enclave TLS Pin 993daa286650eedd76f6c7d11d6ddd9bb0bf4e160fd4ba2f146eba0f9ff06aa7 ✗
Security Model TEE-only Gateway
What This Means Model runs in TEE but gateway sees plaintext prompts
◐ TEE/gpt Oss 20b (TEE) Intel TDX TEE-only Gateway Details
Source provenance incomplete Hardware/channel passed; source or image provenance is incomplete.
Quote Intel TDX (DCAP QVL)
TCB Level status=UpToDate, advisories=[]
Report Data 79a5061efe5a46b0d1f33b11cf1c5adbedae6b790000000000000000000000006dd8fb67b4653c5c06c4bf7d9734daafe8bd4f944d6e1c266dc819da4da99cc4
Signature ECDSA-P384 ✓
Compose Hash Mismatch ✗
Signer Bound Yes ✓
Enclave TLS Pin 993daa286650eedd76f6c7d11d6ddd9bb0bf4e160fd4ba2f146eba0f9ff06aa7 ✗
Security Model TEE-only Gateway
What This Means Model runs in TEE but gateway sees plaintext prompts
◐ TEE/kimi K2.5 (TEE) Intel TDX TEE-only Gateway Details
Source provenance incomplete Hardware/channel passed; source or image provenance is incomplete.
Quote Intel TDX (DCAP QVL)
TCB Level status=UpToDate, advisories=[]
Report Data 39e95bbcf5702285d6516661c7a19e7389f0ca875b006086ab2d99f24e1ce67f4099311254c0ed4caee7e3da654b5551ab7c563b862e3f09eda05892ca46988f
Signature ECDSA-P384 ✓
Compose Hash Mismatch ✗
Enclave TLS Pin 993daa286650eedd76f6c7d11d6ddd9bb0bf4e160fd4ba2f146eba0f9ff06aa7 ✗
Security Model TEE-only Gateway
What This Means Model runs in TEE but gateway sees plaintext prompts
◐ TEE/kimi K2.5 Thinking (TEE) Intel TDX TEE-only Gateway Details
Source provenance incomplete Hardware/channel passed; source or image provenance is incomplete.
Quote Intel TDX (DCAP QVL)
TCB Level status=UpToDate, advisories=[]
Report Data 071d064f38841f0f7b38a5c5cfb29673eb5db1339827a9cf8d941bb9b7a31e454099311254c0ed4caee7e3da654b5551ab7c563b862e3f09eda05892ca46988f
Signature ECDSA-P384 ✓
Compose Hash Mismatch ✗
Enclave TLS Pin 993daa286650eedd76f6c7d11d6ddd9bb0bf4e160fd4ba2f146eba0f9ff06aa7 ✗
Security Model TEE-only Gateway
What This Means Model runs in TEE but gateway sees plaintext prompts
◐ TEE/minimax M2.5 (TEE) Intel TDX TEE-only Gateway Details
Source provenance incomplete Hardware/channel passed; source or image provenance is incomplete.
Quote Intel TDX (DCAP QVL)
TCB Level status=UpToDate, advisories=[]
Report Data 7fcbe442b7c55374306f5699f1bd82e9a85763daa0b7e81287c7fc3f2f72fa530d0b765901c6e4bbd48905799f4909828eda0551a5fe96315b6b4d109b3dd8f0
Signature ECDSA-P384 ✓
Compose Hash Mismatch ✗
Enclave TLS Pin 993daa286650eedd76f6c7d11d6ddd9bb0bf4e160fd4ba2f146eba0f9ff06aa7 ✗
Security Model TEE-only Gateway
What This Means Model runs in TEE but gateway sees plaintext prompts
◐ TEE/qwen2.5 Vl 72b Instruct (TEE) Intel TDX TEE-only Gateway Details
Source provenance incomplete Hardware/channel passed; source or image provenance is incomplete.
Quote Intel TDX (DCAP QVL)
TCB Level status=UpToDate, advisories=[]
Report Data 79a5061efe5a46b0d1f33b11cf1c5adbedae6b79000000000000000000000000c67a13298b4e5b992cdb99aeda56ea215bda7dbc3646fac8cbee1ee2ec6bdced
Signature ECDSA-P384 ✓
Compose Hash Mismatch ✗
Signer Bound Yes ✓
Enclave TLS Pin 993daa286650eedd76f6c7d11d6ddd9bb0bf4e160fd4ba2f146eba0f9ff06aa7 ✗
Security Model TEE-only Gateway
What This Means Model runs in TEE but gateway sees plaintext prompts
◐ TEE/qwen3 30b A3b Instruct 2507 (TEE) Intel TDX TEE-only Gateway Details
Source provenance incomplete Hardware/channel passed; source or image provenance is incomplete.
Quote Intel TDX (DCAP QVL)
TCB Level status=UpToDate, advisories=[]
Report Data 79a5061efe5a46b0d1f33b11cf1c5adbedae6b79000000000000000000000000dbb6ee9faf4ab98da3d2eb5a338a8f24476d519e86ea27885c83edba5ce78a10
Signature ECDSA-P384 ✓
Compose Hash Mismatch ✗
Signer Bound Yes ✓
Enclave TLS Pin 993daa286650eedd76f6c7d11d6ddd9bb0bf4e160fd4ba2f146eba0f9ff06aa7 ✗
Security Model TEE-only Gateway
What This Means Model runs in TEE but gateway sees plaintext prompts
◐ TEE/qwen3.5 122b A10b (TEE) Intel TDX TEE-only Gateway Details
Source provenance incomplete Hardware/channel passed; source or image provenance is incomplete.
Quote Intel TDX (DCAP QVL)
TCB Level status=UpToDate, advisories=[]
Report Data 79a5061efe5a46b0d1f33b11cf1c5adbedae6b79000000000000000000000000a8be0c034db3159f0e214726001872290b7cf9ad340d143d34d2025ce60f8b70
Signature ECDSA-P384 ✓
Compose Hash Mismatch ✗
Signer Bound Yes ✓
Enclave TLS Pin 993daa286650eedd76f6c7d11d6ddd9bb0bf4e160fd4ba2f146eba0f9ff06aa7 ✗
Security Model TEE-only Gateway
What This Means Model runs in TEE but gateway sees plaintext prompts
◐ TEE/qwen3.5 27b (TEE) Intel TDX TEE-only Gateway Details
Source provenance incomplete Hardware/channel passed; source or image provenance is incomplete.
Quote Intel TDX (DCAP QVL)
TCB Level status=UpToDate, advisories=[]
Report Data 14690ab937148fb82895da9495ccb0d334c03472c6f1536e28bee6bf9c58bee7d97802b76c1e85685460bbb91d01c64e623b39a618569d1c509764b988027945
Signature ECDSA-P384 ✓
Compose Hash Mismatch ✗
Enclave TLS Pin 993daa286650eedd76f6c7d11d6ddd9bb0bf4e160fd4ba2f146eba0f9ff06aa7 ✗
Security Model TEE-only Gateway
What This Means Model runs in TEE but gateway sees plaintext prompts
◐ TEE/qwen3.6 27b (TEE) Intel TDX TEE-only Gateway Details
Source provenance incomplete Hardware/channel passed; source or image provenance is incomplete.
Quote Intel TDX (DCAP QVL)
TCB Level status=UpToDate, advisories=[]
Report Data 79a5061efe5a46b0d1f33b11cf1c5adbedae6b79000000000000000000000000f25c197046db1d54fc7fd3793c3555e252a39f8786e42ca5023f7060c64b7a6d
Signature ECDSA-P384 ✓
Compose Hash Mismatch ✗
Signer Bound Yes ✓
Enclave TLS Pin 993daa286650eedd76f6c7d11d6ddd9bb0bf4e160fd4ba2f146eba0f9ff06aa7 ✗
Security Model TEE-only Gateway
What This Means Model runs in TEE but gateway sees plaintext prompts
◐ TEE/qwen3.6 35b A3b (TEE) Intel TDX TEE-only Gateway Details
Source provenance incomplete Hardware/channel passed; source or image provenance is incomplete.
Quote Intel TDX (DCAP QVL)
TCB Level status=UpToDate, advisories=[]
Report Data 79a5061efe5a46b0d1f33b11cf1c5adbedae6b79000000000000000000000000f4768f33b81c867dd6f41a8b8368ea3cabfbebb4dfedaed4cb8895bd8027e2e4
Signature ECDSA-P384 ✓
Compose Hash Mismatch ✗
Signer Bound Yes ✓
Enclave TLS Pin 993daa286650eedd76f6c7d11d6ddd9bb0bf4e160fd4ba2f146eba0f9ff06aa7 ✗
Security Model TEE-only Gateway
What This Means Model runs in TEE but gateway sees plaintext prompts
◐ TEE/qwen3.6 35b A3b Uncensored (TEE) Intel TDX TEE-only Gateway Details
Source provenance incomplete Hardware/channel passed; source or image provenance is incomplete.
Quote Intel TDX (DCAP QVL)
TCB Level status=UpToDate, advisories=[]
Report Data 79a5061efe5a46b0d1f33b11cf1c5adbedae6b7900000000000000000000000038d323606995ecebbdc12ff0bd56e6b9b13d2d01bd4bbcfc7c0ac348dae93b4c
Signature ECDSA-P384 ✓
Compose Hash Mismatch ✗
Signer Bound Yes ✓
Enclave TLS Pin 993daa286650eedd76f6c7d11d6ddd9bb0bf4e160fd4ba2f146eba0f9ff06aa7 ✗
Security Model TEE-only Gateway
What This Means Model runs in TEE but gateway sees plaintext prompts

NEAR AI

8/8 Alerts RSS
Fully verified Every check passed its required attestation, channel, and provenance gates.
8 verified 0 partial 0 failed 0 unavailable
Intel TDX Attested E2EE Phala/dstack
Hardware 8/8 good Freshness 8/8 good Key binding 8/8 good Workload 7 bad Provenance 8/8 good Availability 8/8 good
No open issues
✓ Gemma 4 31B (TEE) Intel TDX Attested E2EE Details
Verified All required verifier gates passed for this check.
Quote Intel TDX (DCAP QVL)
TCB Level status=UpToDate, advisories=[]
Report Data 2ad96997ac5762e37f81b72c404c21f0d6baa53a9c6b8872113fb42716710b9b72ae59929e66c21aeb3caf4e98fdb7436d7db4026b3093cab0091efcf515633e
Signature ECDSA-P384 ✓
Compose Hash Mismatch ✗
TCB Consistent sha256 match ✓
Images Registry verified ✓
Confidential Channel E2EE to attested enclave key ✓
Signer Bound Yes ✓
Nonce Bound Yes ✓
Last Deploy v0.0.309
Gateway TLS aaeaf5a20b5bd17c44641be93072b07d48c78588b709d22bfa1690c921320475 (external termination)
App dstack-nvidia-0.5.5
Images 6 containers
datadog/agent@sha256:5556fb80b952832719a76b016f905616c76ee0989a239c4680c6220148e865d6otel/opentelemetry-collector-contrib@sha256:85ac41c2db88d0df9bd6145e608a3cb023f5d8443868adbfbbf66efb51087917certbot/dns-cloudflare@sha256:742dbd2e61c8709b930712c38958386c3cb3928e09eeb1f1e490600c127e2edbcertbot/dns-cloudflare@sha256:742dbd2e61c8709b930712c38958386c3cb3928e09eeb1f1e490600c127e2edbnearaidev/compose-manager@sha256:b487f39160e9a53c3d98943a9c709d28e12babef75e0bb5a6cd5692abc8b2db6nearaidev/compose-manager-launcher@sha256:78afb82330137c2fd90a9c8c6e452f8f178c15d863f87c079a11c13e92216e00
RTMR0 bc122d143ab768565ba5c3774ff5f03a63c89a4df7c1f5ea38d3bd173409d14f8cbdcc36d40e703cccb996a9d9687590
OS Image 9b69bb1698bacbb6985409a2c272bcb892e09cdcea63d5399c6768b67d3ff677
Security Model Attested E2EE
What This Means Payloads are encrypted to an attested enclave key; gateway TLS termination is expected
Infrastructure Phala/dstack
E2EE Protocol ed25519
Signing Key 2ad96997ac5762e37f81b72c404c21f0d6baa53a9c6b8872113fb42716710b9b
✓ GLM 5.1 (TEE) Intel TDX Attested E2EE Details
Verified All required verifier gates passed for this check.
Quote Intel TDX (DCAP QVL)
TCB Level status=UpToDate, advisories=[]
Report Data 40ef1aadbb12f26cf4c2d499b9e7a7b043da4388200715abed573fa135a561bb04df5d676cab35fb586a4aee4d716963ca4eaf9c85b53fe487c8b01234094d57
Signature ECDSA-P384 ✓
Compose Hash Mismatch ✗
TCB Consistent sha256 match ✓
Images Registry verified ✓
Confidential Channel E2EE to attested enclave key ✓
Signer Bound Yes ✓
Nonce Bound Yes ✓
Gateway TLS aaeaf5a20b5bd17c44641be93072b07d48c78588b709d22bfa1690c921320475 (external termination)
App dstack-nvidia-0.5.5
Images 6 containers
datadog/agent@sha256:5556fb80b952832719a76b016f905616c76ee0989a239c4680c6220148e865d6otel/opentelemetry-collector-contrib@sha256:85ac41c2db88d0df9bd6145e608a3cb023f5d8443868adbfbbf66efb51087917certbot/dns-cloudflare@sha256:742dbd2e61c8709b930712c38958386c3cb3928e09eeb1f1e490600c127e2edbcertbot/dns-cloudflare@sha256:742dbd2e61c8709b930712c38958386c3cb3928e09eeb1f1e490600c127e2edbnearaidev/compose-manager@sha256:b487f39160e9a53c3d98943a9c709d28e12babef75e0bb5a6cd5692abc8b2db6nearaidev/compose-manager-launcher@sha256:78afb82330137c2fd90a9c8c6e452f8f178c15d863f87c079a11c13e92216e00
RTMR0 bc122d143ab768565ba5c3774ff5f03a63c89a4df7c1f5ea38d3bd173409d14f8cbdcc36d40e703cccb996a9d9687590
OS Image 9b69bb1698bacbb6985409a2c272bcb892e09cdcea63d5399c6768b67d3ff677
Security Model Attested E2EE
What This Means Payloads are encrypted to an attested enclave key; gateway TLS termination is expected
Infrastructure Phala/dstack
E2EE Protocol ed25519
Signing Key 40ef1aadbb12f26cf4c2d499b9e7a7b043da4388200715abed573fa135a561bb
✓ GPT-OSS 120B (TEE) Intel TDX Attested E2EE Details
Verified All required verifier gates passed for this check.
Quote Intel TDX (DCAP QVL)
TCB Level status=UpToDate, advisories=[]
Report Data 21189bb96e2e0ff7598bd618bed473045cd6da886ddc844dc23f30bd2bfdb62d3e9b4c76f6d702b283aaae6eab1b1051bd5ec1bed3d4e3007be5c42d49b8e09b
Signature ECDSA-P384 ✓
Compose Hash Mismatch ✗
TCB Consistent sha256 match ✓
Images Registry verified ✓
Confidential Channel E2EE to attested enclave key ✓
Signer Bound Yes ✓
Nonce Bound Yes ✓
Gateway TLS aaeaf5a20b5bd17c44641be93072b07d48c78588b709d22bfa1690c921320475 (external termination)
App dstack-nvidia-0.5.5
Images 6 containers
datadog/agent@sha256:5556fb80b952832719a76b016f905616c76ee0989a239c4680c6220148e865d6otel/opentelemetry-collector-contrib@sha256:85ac41c2db88d0df9bd6145e608a3cb023f5d8443868adbfbbf66efb51087917certbot/dns-cloudflare@sha256:742dbd2e61c8709b930712c38958386c3cb3928e09eeb1f1e490600c127e2edbcertbot/dns-cloudflare@sha256:742dbd2e61c8709b930712c38958386c3cb3928e09eeb1f1e490600c127e2edbnearaidev/compose-manager@sha256:5165400d9eb43ab5da36986a85de0ba55f3fb4d05211c4397ecc4bde3ef0113bnearaidev/compose-manager-launcher@sha256:d652f92b64f57ef8aa086bd77a4cf932c1976965b3cea2814a7ee82fe73aa993
RTMR0 bc122d143ab768565ba5c3774ff5f03a63c89a4df7c1f5ea38d3bd173409d14f8cbdcc36d40e703cccb996a9d9687590
OS Image 9b69bb1698bacbb6985409a2c272bcb892e09cdcea63d5399c6768b67d3ff677
Security Model Attested E2EE
What This Means Payloads are encrypted to an attested enclave key; gateway TLS termination is expected
Infrastructure Phala/dstack
E2EE Protocol ed25519
Signing Key 21189bb96e2e0ff7598bd618bed473045cd6da886ddc844dc23f30bd2bfdb62d
✓ Qwen 3.5 122B (TEE) Intel TDX Attested E2EE Details
Verified All required verifier gates passed for this check.
Quote Intel TDX (DCAP QVL)
TCB Level status=UpToDate, advisories=[]
Report Data d0aa20bcf567cc0c7c914608967dbd4c7a17e10b600802d45923434ce323f823fb54722f20e1aea542590e648e569d9fff9c4ab02a6e561423c5f3ad19ab9531
Signature ECDSA-P384 ✓
Compose Hash Mismatch ✗
TCB Consistent sha256 match ✓
Images Registry verified ✓
Confidential Channel E2EE to attested enclave key ✓
Signer Bound Yes ✓
Nonce Bound Yes ✓
Last Deploy v0.0.309
Gateway TLS aaeaf5a20b5bd17c44641be93072b07d48c78588b709d22bfa1690c921320475 (external termination)
App dstack-nvidia-0.5.5
Images 6 containers
datadog/agent@sha256:5556fb80b952832719a76b016f905616c76ee0989a239c4680c6220148e865d6otel/opentelemetry-collector-contrib@sha256:85ac41c2db88d0df9bd6145e608a3cb023f5d8443868adbfbbf66efb51087917certbot/dns-cloudflare@sha256:742dbd2e61c8709b930712c38958386c3cb3928e09eeb1f1e490600c127e2edbcertbot/dns-cloudflare@sha256:742dbd2e61c8709b930712c38958386c3cb3928e09eeb1f1e490600c127e2edbnearaidev/compose-manager@sha256:b487f39160e9a53c3d98943a9c709d28e12babef75e0bb5a6cd5692abc8b2db6nearaidev/compose-manager-launcher@sha256:78afb82330137c2fd90a9c8c6e452f8f178c15d863f87c079a11c13e92216e00
RTMR0 bc122d143ab768565ba5c3774ff5f03a63c89a4df7c1f5ea38d3bd173409d14f8cbdcc36d40e703cccb996a9d9687590
OS Image 9b69bb1698bacbb6985409a2c272bcb892e09cdcea63d5399c6768b67d3ff677
Security Model Attested E2EE
What This Means Payloads are encrypted to an attested enclave key; gateway TLS termination is expected
Infrastructure Phala/dstack
E2EE Protocol ed25519
Signing Key d0aa20bcf567cc0c7c914608967dbd4c7a17e10b600802d45923434ce323f823
✓ Qwen/Qwen3.6 27B FP8 (TEE) Intel TDX Attested E2EE Details
Verified All required verifier gates passed for this check.
Quote Intel TDX (DCAP QVL)
TCB Level status=UpToDate, advisories=[]
Report Data 052233b7fb537337f2f4f9c8a239297f8a5d8876b2ccce49dfa684bb53361c24f1212ebf2842f634534e4aa000b59109364158ef8051c88cf79b305fef000b6b
Signature ECDSA-P384 ✓
Compose Hash Mismatch ✗
TCB Consistent sha256 match ✓
Images Registry verified ✓
Confidential Channel E2EE to attested enclave key ✓
Signer Bound Yes ✓
Nonce Bound Yes ✓
Last Deploy v0.0.309
Gateway TLS aaeaf5a20b5bd17c44641be93072b07d48c78588b709d22bfa1690c921320475 (external termination)
App dstack-nvidia-0.5.5
Images 6 containers
datadog/agent@sha256:5556fb80b952832719a76b016f905616c76ee0989a239c4680c6220148e865d6otel/opentelemetry-collector-contrib@sha256:85ac41c2db88d0df9bd6145e608a3cb023f5d8443868adbfbbf66efb51087917certbot/dns-cloudflare@sha256:742dbd2e61c8709b930712c38958386c3cb3928e09eeb1f1e490600c127e2edbcertbot/dns-cloudflare@sha256:742dbd2e61c8709b930712c38958386c3cb3928e09eeb1f1e490600c127e2edbnearaidev/compose-manager@sha256:b487f39160e9a53c3d98943a9c709d28e12babef75e0bb5a6cd5692abc8b2db6nearaidev/compose-manager-launcher@sha256:78afb82330137c2fd90a9c8c6e452f8f178c15d863f87c079a11c13e92216e00
RTMR0 bc122d143ab768565ba5c3774ff5f03a63c89a4df7c1f5ea38d3bd173409d14f8cbdcc36d40e703cccb996a9d9687590
OS Image 9b69bb1698bacbb6985409a2c272bcb892e09cdcea63d5399c6768b67d3ff677
Security Model Attested E2EE
What This Means Payloads are encrypted to an attested enclave key; gateway TLS termination is expected
Infrastructure Phala/dstack
E2EE Protocol ed25519
Signing Key 052233b7fb537337f2f4f9c8a239297f8a5d8876b2ccce49dfa684bb53361c24
✓ Qwen3 30B (TEE) Intel TDX Attested E2EE Details
Verified All required verifier gates passed for this check.
Quote Intel TDX (DCAP QVL)
TCB Level status=UpToDate, advisories=[]
Report Data 0e404219b15ff256eb82078223a4697d6ebc69d5182dc69a835837bac14f0595a76fcac7230fade46260bd99a4cfcfb03fdbd0f3c52716897270e9b5efd709f5
Signature ECDSA-P384 ✓
Compose Hash Verified ✓
TCB Consistent sha256 match ✓
Images Registry verified ✓
Confidential Channel E2EE to attested enclave key ✓
Signer Bound Yes ✓
Nonce Bound Yes ✓
Gateway TLS aaeaf5a20b5bd17c44641be93072b07d48c78588b709d22bfa1690c921320475 (external termination)
App dstack-nvidia-0.5.5
Images 5 containers
datadog/agent@sha256:5556fb80b952832719a76b016f905616c76ee0989a239c4680c6220148e865d6certbot/dns-cloudflare@sha256:742dbd2e61c8709b930712c38958386c3cb3928e09eeb1f1e490600c127e2edbcertbot/dns-cloudflare@sha256:742dbd2e61c8709b930712c38958386c3cb3928e09eeb1f1e490600c127e2edbnearaidev/compose-manager@sha256:44aa2344d68609700074a8076ed177bb1989c7f5fd1e175a13084d512be475e9nearaidev/compose-manager-launcher@sha256:171c1cffea23625628fc11038a590173745d83e3570d855e53ab5a91279f95bf
RTMR0 bc122d143ab768565ba5c3774ff5f03a63c89a4df7c1f5ea38d3bd173409d14f8cbdcc36d40e703cccb996a9d9687590
OS Image 9b69bb1698bacbb6985409a2c272bcb892e09cdcea63d5399c6768b67d3ff677
Security Model Attested E2EE
What This Means Payloads are encrypted to an attested enclave key; gateway TLS termination is expected
Infrastructure Phala/dstack
E2EE Protocol ed25519
Signing Key 0e404219b15ff256eb82078223a4697d6ebc69d5182dc69a835837bac14f0595
✓ Qwen3-VL 30B (TEE) Intel TDX Attested E2EE Details
Verified All required verifier gates passed for this check.
Quote Intel TDX (DCAP QVL)
TCB Level status=UpToDate, advisories=[]
Report Data 31ddf80d420921b91ff4a41d933a15b46a3840e80031804c1c5ba4f25c4e88cc334da55725713f2c4f66a9198d9a9b07df3054a4ead522dabc5ce368f78f2a15
Signature ECDSA-P384 ✓
Compose Hash Mismatch ✗
TCB Consistent sha256 match ✓
Images Registry verified ✓
Confidential Channel E2EE to attested enclave key ✓
Signer Bound Yes ✓
Nonce Bound Yes ✓
Gateway TLS aaeaf5a20b5bd17c44641be93072b07d48c78588b709d22bfa1690c921320475 (external termination)
App dstack-nvidia-0.5.5
Images 6 containers
datadog/agent@sha256:5556fb80b952832719a76b016f905616c76ee0989a239c4680c6220148e865d6otel/opentelemetry-collector-contrib@sha256:85ac41c2db88d0df9bd6145e608a3cb023f5d8443868adbfbbf66efb51087917certbot/dns-cloudflare@sha256:742dbd2e61c8709b930712c38958386c3cb3928e09eeb1f1e490600c127e2edbcertbot/dns-cloudflare@sha256:742dbd2e61c8709b930712c38958386c3cb3928e09eeb1f1e490600c127e2edbnearaidev/compose-manager@sha256:5165400d9eb43ab5da36986a85de0ba55f3fb4d05211c4397ecc4bde3ef0113bnearaidev/compose-manager-launcher@sha256:d652f92b64f57ef8aa086bd77a4cf932c1976965b3cea2814a7ee82fe73aa993
RTMR0 bc122d143ab768565ba5c3774ff5f03a63c89a4df7c1f5ea38d3bd173409d14f8cbdcc36d40e703cccb996a9d9687590
OS Image 9b69bb1698bacbb6985409a2c272bcb892e09cdcea63d5399c6768b67d3ff677
Security Model Attested E2EE
What This Means Payloads are encrypted to an attested enclave key; gateway TLS termination is expected
Infrastructure Phala/dstack
E2EE Protocol ed25519
Signing Key 31ddf80d420921b91ff4a41d933a15b46a3840e80031804c1c5ba4f25c4e88cc
✓ Qwen3.6 35B (TEE) Intel TDX Attested E2EE Details
Verified All required verifier gates passed for this check.
Quote Intel TDX (DCAP QVL)
TCB Level status=UpToDate, advisories=[]
Report Data aba45f0b8f90869baab26db02e8b01354bb8f8730769c60650cb7a635da602d4c8acfb8fe5ffbd6ba80886d473e366d756cc4b273e48953d4d29f4f200cf5ec8
Signature ECDSA-P384 ✓
Compose Hash Mismatch ✗
TCB Consistent sha256 match ✓
Images Registry verified ✓
Confidential Channel E2EE to attested enclave key ✓
Signer Bound Yes ✓
Nonce Bound Yes ✓
Gateway TLS aaeaf5a20b5bd17c44641be93072b07d48c78588b709d22bfa1690c921320475 (external termination)
App dstack-nvidia-0.5.5
Images 6 containers
datadog/agent@sha256:5556fb80b952832719a76b016f905616c76ee0989a239c4680c6220148e865d6otel/opentelemetry-collector-contrib@sha256:85ac41c2db88d0df9bd6145e608a3cb023f5d8443868adbfbbf66efb51087917certbot/dns-cloudflare@sha256:742dbd2e61c8709b930712c38958386c3cb3928e09eeb1f1e490600c127e2edbcertbot/dns-cloudflare@sha256:742dbd2e61c8709b930712c38958386c3cb3928e09eeb1f1e490600c127e2edbnearaidev/compose-manager@sha256:5165400d9eb43ab5da36986a85de0ba55f3fb4d05211c4397ecc4bde3ef0113bnearaidev/compose-manager-launcher@sha256:d652f92b64f57ef8aa086bd77a4cf932c1976965b3cea2814a7ee82fe73aa993
RTMR0 bc122d143ab768565ba5c3774ff5f03a63c89a4df7c1f5ea38d3bd173409d14f8cbdcc36d40e703cccb996a9d9687590
OS Image 9b69bb1698bacbb6985409a2c272bcb892e09cdcea63d5399c6768b67d3ff677
Security Model Attested E2EE
What This Means Payloads are encrypted to an attested enclave key; gateway TLS termination is expected
Infrastructure Phala/dstack
E2EE Protocol ed25519
Signing Key aba45f0b8f90869baab26db02e8b01354bb8f8730769c60650cb7a635da602d4

PPQ.AI

4/6 Alerts RSS
Availability issue The verifier could not fetch fresh evidence for every check in this run.
4 verified 0 partial 0 failed 2 unavailable
AMD SEV-SNP Attested E2EE
Hardware 4/6 good Freshness Not shown Key binding Not shown Workload Not shown Provenance 4/6 good Availability 2 warning
Endpoint unavailable 2
✓ Gemma 4 31B (TEE) AMD SEV-SNP Attested E2EE Details
Verified All required verifier gates passed for this check.
Quote AMD SEV-SNP (VCEK)
Policy 0x30000
Report Data d2338e82cfc88f9e8acdd7a24ccaefd358a1358f9516f19b1ddaa528609f72cc4936fa8435da6cf8897e5de6eccfadc2fe525d0fc270986558988942f0644467
Signature ECDSA-P384 ✓
Images Registry verified ✓
Sigstore Bundle Crypto Verified ✓
Measurements Match ✓
Release v0.0.118
Sigstore Repo tinfoilsh/confidential-model-router
Confidential Channel E2EE to attested enclave key ✓
ghcr.io/tinfoilsh/confidential-model-router@sha256:33fa7f02784751a6ea19a3ae1b32cb22ff34ac354ecab697ed475234215f3372ghcr.io/tinfoilsh/confidential-gemma4-31b@sha256:73cec121874dd0a40192d1e5074f9a674f74fe0749d58eb0aee76d5cc351257b
Security Model Attested E2EE
What This Means Payloads are encrypted to an attested enclave key; gateway TLS termination is expected
E2EE Protocol hpke
Signing Key 4936fa8435da6cf8897e5de6eccfadc2fe525d0fc270986558988942f0644467
✓ GLM 5.1 (TEE) AMD SEV-SNP Attested E2EE Details
Verified All required verifier gates passed for this check.
Quote AMD SEV-SNP (VCEK)
Policy 0x30000
Report Data c0260400d7da5a237d60a1da0271ee9ce06a3c4966a44d1ddc573a3a164f837e988823a55c9a554bdd2692ccb4c381c59fb1c0bb21882aacf090e0513e9a9365
Signature ECDSA-P384 ✓
Images Registry verified ✓
Sigstore Bundle Crypto Verified ✓
Measurements Match ✓
Release v0.0.107
Sigstore Repo tinfoilsh/confidential-model-router
Confidential Channel E2EE to attested enclave key ✓
ghcr.io/tinfoilsh/confidential-model-router@sha256:74ebba82a01fbbbcd9b5c095402286b62c76a1048bc272cfe6741c245df0f5f2vllm/vllm-openai:v0.22.0@sha256:0fec7ec5f3e6bc168e54899935fb0557da908a4832a1dbc88e2debcf2f889416
Security Model Attested E2EE
What This Means Payloads are encrypted to an attested enclave key; gateway TLS termination is expected
E2EE Protocol hpke
Signing Key 988823a55c9a554bdd2692ccb4c381c59fb1c0bb21882aacf090e0513e9a9365
✓ GPT-OSS 120B (TEE) AMD SEV-SNP Attested E2EE Details
Verified All required verifier gates passed for this check.
Quote AMD SEV-SNP (VCEK)
Policy 0x30000
Report Data 1bcb53d34e1856d0c22eb0c55d4ae24d0607b9d45e677ef55003b975128ea8ae40802eee8b552ff2fc06ea29206cb6efc64bcc63f61063aca105f651ee871b75
Signature ECDSA-P384 ✓
Images Registry verified ✓
Sigstore Bundle Crypto Verified ✓
Measurements Match ✓
Release v0.0.118
Sigstore Repo tinfoilsh/confidential-model-router
Confidential Channel E2EE to attested enclave key ✓
ghcr.io/tinfoilsh/confidential-model-router@sha256:33fa7f02784751a6ea19a3ae1b32cb22ff34ac354ecab697ed475234215f3372vllm/vllm-openai:v0.22.0@sha256:0fec7ec5f3e6bc168e54899935fb0557da908a4832a1dbc88e2debcf2f889416
Security Model Attested E2EE
What This Means Payloads are encrypted to an attested enclave key; gateway TLS termination is expected
E2EE Protocol hpke
Signing Key 40802eee8b552ff2fc06ea29206cb6efc64bcc63f61063aca105f651ee871b75
⚠ Kimi K2.6 (TEE) Details
Endpoint unavailable Fresh evidence could not be fetched in this run.
Check No public attestation endpoint
✓ Llama 3.3 70B (TEE) AMD SEV-SNP Attested E2EE Details
Verified All required verifier gates passed for this check.
Quote AMD SEV-SNP (VCEK)
Policy 0x30000
Report Data 1bcb53d34e1856d0c22eb0c55d4ae24d0607b9d45e677ef55003b975128ea8ae40802eee8b552ff2fc06ea29206cb6efc64bcc63f61063aca105f651ee871b75
Signature ECDSA-P384 ✓
Images Registry verified ✓
Sigstore Bundle Crypto Verified ✓
Measurements Match ✓
Release v0.0.118
Sigstore Repo tinfoilsh/confidential-model-router
Confidential Channel E2EE to attested enclave key ✓
ghcr.io/tinfoilsh/confidential-model-router@sha256:33fa7f02784751a6ea19a3ae1b32cb22ff34ac354ecab697ed475234215f3372vllm/vllm-openai:v0.22.0@sha256:0fec7ec5f3e6bc168e54899935fb0557da908a4832a1dbc88e2debcf2f889416
Security Model Attested E2EE
What This Means Payloads are encrypted to an attested enclave key; gateway TLS termination is expected
E2EE Protocol hpke
Signing Key 40802eee8b552ff2fc06ea29206cb6efc64bcc63f61063aca105f651ee871b75
⚠ Qwen3-VL 30B (TEE) Details
Endpoint unavailable Fresh evidence could not be fetched in this run.
Check No public attestation endpoint

Privatemode

8/8 Alerts RSS
Fully verified Every check passed its required attestation, channel, and provenance gates.
8 verified 0 partial 0 failed 0 unavailable
Attested E2EE
Hardware 8/8 good Freshness Not shown Key binding 8/8 good Workload 8/8 good Provenance 8/8 good Availability 8/8 good
No open issues
✓ Gemma 4 31b Attested E2EE Details
Verified All required verifier gates passed for this check.
Check Liveness only
✓ Gemma Latest Attested E2EE Details
Verified All required verifier gates passed for this check.
Check Liveness only
✓ Gpt Oss 120b Attested E2EE Details
Verified All required verifier gates passed for this check.
Check Liveness only
✓ Gpt Oss Latest Attested E2EE Details
Verified All required verifier gates passed for this check.
Check Liveness only
✓ Kimi K2.6 Attested E2EE Details
Verified All required verifier gates passed for this check.
Check Liveness only
✓ Qwen3 Embedding 4b Attested E2EE Details
Verified All required verifier gates passed for this check.
Check Liveness only
✓ Voxtral Mini 3b Attested E2EE Details
Verified All required verifier gates passed for this check.
Check Liveness only
✓ Whisper Large V3 Attested E2EE Details
Verified All required verifier gates passed for this check.
Check Liveness only

Redpill

3+7/26 Alerts RSS
Critical trust failures At least one check failed a quote, freshness, key-binding, measurement, or policy gate.
3 verified 7 partial 15 failed 1 unavailable
Intel TDX Attested E2EE Phala/dstack
Hardware 25/26 good Freshness 2 bad Key binding 1 bad Workload 18 bad Provenance 22 warning Availability 1 warning
Measurement mismatch 15 Signer not bound 1 Nonce not bound 1 Image not pinned 22
✗ DeepSeek V3.2 (TEE) Intel TDX Details
Measurement mismatch The measured deployment could not be tied to the expected workload configuration.
Quote Intel TDX (DCAP QVL)
TCB Level status=UpToDate, advisories=[]
Report Data 79a5061efe5a46b0d1f33b11cf1c5adbedae6b790000000000000000000000006c98195c581e70bd9d8235319adf088b7a9889fa314acfc7db18be6736e8d525
Signature ECDSA-P384 ✓
Compose Hash Mismatch ✗
Signer Bound Yes ✓
Nonce Bound Yes ✓
Enclave TLS Pin c2ebede7c2c632381123e3193b01f5f3fa45cc6c6327b2d0536749348ceeb408 ✗
Security Model No Verified Channel
What This Means No hardware attestation verified
E2EE Protocol ecdsa
Signing Key 04943cea0b4babf60f6e2031e9a00866a37c4ae696fb45895b3a9b38ab8cbb898f42c85b704aceaa0a396cf26f7fdf79d83205be7e11d3a5d70419a68277158c3d
✗ Gemma 4 31B (TEE) Intel TDX Details
Measurement mismatch The measured deployment could not be tied to the expected workload configuration.
Quote Intel TDX (DCAP QVL)
TCB Level status=UpToDate, advisories=[]
Report Data 79a5061efe5a46b0d1f33b11cf1c5adbedae6b79000000000000000000000000674a9730c70ef4e5a0cc54d61b58c87a6c10c03bcb2fba8ca8843e601d2d8e1c
Signature ECDSA-P384 ✓
Compose Hash Mismatch ✗
Signer Bound Yes ✓
Nonce Bound Yes ✓
Enclave TLS Pin c2ebede7c2c632381123e3193b01f5f3fa45cc6c6327b2d0536749348ceeb408 ✗
Security Model No Verified Channel
What This Means No hardware attestation verified
E2EE Protocol ecdsa
Signing Key 04943cea0b4babf60f6e2031e9a00866a37c4ae696fb45895b3a9b38ab8cbb898f42c85b704aceaa0a396cf26f7fdf79d83205be7e11d3a5d70419a68277158c3d
✗ GLM 4.7 (TEE) Intel TDX Details
Measurement mismatch The measured deployment could not be tied to the expected workload configuration.
Quote Intel TDX (DCAP QVL)
TCB Level status=UpToDate, advisories=[]
Report Data 79a5061efe5a46b0d1f33b11cf1c5adbedae6b79000000000000000000000000f4ea5e9ab3e885fac75407a7edccb86d5e1a1d266d228fd2ed4fc479e90c46a8
Signature ECDSA-P384 ✓
Compose Hash Mismatch ✗
Signer Bound Yes ✓
Nonce Bound Yes ✓
Enclave TLS Pin c2ebede7c2c632381123e3193b01f5f3fa45cc6c6327b2d0536749348ceeb408 ✗
Security Model No Verified Channel
What This Means No hardware attestation verified
E2EE Protocol ecdsa
Signing Key 04943cea0b4babf60f6e2031e9a00866a37c4ae696fb45895b3a9b38ab8cbb898f42c85b704aceaa0a396cf26f7fdf79d83205be7e11d3a5d70419a68277158c3d
✗ GLM 5.1 (TEE) Intel TDX Details
Measurement mismatch The measured deployment could not be tied to the expected workload configuration.
Quote Intel TDX (DCAP QVL)
TCB Level status=UpToDate, advisories=[]
Report Data 79a5061efe5a46b0d1f33b11cf1c5adbedae6b790000000000000000000000008fbdc9ae6a54173febf1ac28455e8995b1718141936d232c82d3a5688c7ea012
Signature ECDSA-P384 ✓
Compose Hash Mismatch ✗
Signer Bound Yes ✓
Nonce Bound Yes ✓
Enclave TLS Pin c2ebede7c2c632381123e3193b01f5f3fa45cc6c6327b2d0536749348ceeb408 ✗
Security Model No Verified Channel
What This Means No hardware attestation verified
E2EE Protocol ecdsa
Signing Key 04943cea0b4babf60f6e2031e9a00866a37c4ae696fb45895b3a9b38ab8cbb898f42c85b704aceaa0a396cf26f7fdf79d83205be7e11d3a5d70419a68277158c3d
✗ GPT-OSS 120B (TEE) Intel TDX Details
Measurement mismatch The measured deployment could not be tied to the expected workload configuration.
Quote Intel TDX (DCAP QVL)
TCB Level status=UpToDate, advisories=[]
Report Data 79a5061efe5a46b0d1f33b11cf1c5adbedae6b79000000000000000000000000061fcb7cc1ebc56f75cdf69f5df661d75374b485016465813be09323fe30b249
Signature ECDSA-P384 ✓
Compose Hash Mismatch ✗
Signer Bound Yes ✓
Nonce Bound Yes ✓
Enclave TLS Pin c2ebede7c2c632381123e3193b01f5f3fa45cc6c6327b2d0536749348ceeb408 ✗
Security Model No Verified Channel
What This Means No hardware attestation verified
E2EE Protocol ecdsa
Signing Key 04943cea0b4babf60f6e2031e9a00866a37c4ae696fb45895b3a9b38ab8cbb898f42c85b704aceaa0a396cf26f7fdf79d83205be7e11d3a5d70419a68277158c3d
✗ GPT-OSS 20B (TEE) Intel TDX Details
Measurement mismatch The measured deployment could not be tied to the expected workload configuration.
Quote Intel TDX (DCAP QVL)
TCB Level status=UpToDate, advisories=[]
Report Data 79a5061efe5a46b0d1f33b11cf1c5adbedae6b7900000000000000000000000059c4f0104ac98a4636d489efe7f3d936d25d8ace10c3bd6ca3f8134f166865c5
Signature ECDSA-P384 ✓
Compose Hash Mismatch ✗
Signer Bound Yes ✓
Nonce Bound Yes ✓
Enclave TLS Pin c2ebede7c2c632381123e3193b01f5f3fa45cc6c6327b2d0536749348ceeb408 ✗
Security Model No Verified Channel
What This Means No hardware attestation verified
E2EE Protocol ecdsa
Signing Key 04943cea0b4babf60f6e2031e9a00866a37c4ae696fb45895b3a9b38ab8cbb898f42c85b704aceaa0a396cf26f7fdf79d83205be7e11d3a5d70419a68277158c3d
✗ Kimi K2.5 (TEE) Intel TDX Details
Measurement mismatch The measured deployment could not be tied to the expected workload configuration.
Quote Intel TDX (DCAP QVL)
TCB Level status=UpToDate, advisories=[]
Report Data 79a5061efe5a46b0d1f33b11cf1c5adbedae6b79000000000000000000000000419ce5ccbd74dabb38c529806aa1dfe99283245e1d959f66ba0a19d9b63607ed
Signature ECDSA-P384 ✓
Compose Hash Mismatch ✗
Signer Bound Yes ✓
Nonce Bound Yes ✓
Enclave TLS Pin c2ebede7c2c632381123e3193b01f5f3fa45cc6c6327b2d0536749348ceeb408 ✗
Security Model No Verified Channel
What This Means No hardware attestation verified
E2EE Protocol ecdsa
Signing Key 04943cea0b4babf60f6e2031e9a00866a37c4ae696fb45895b3a9b38ab8cbb898f42c85b704aceaa0a396cf26f7fdf79d83205be7e11d3a5d70419a68277158c3d
✗ Kimi K2.6 (TEE) Intel TDX Details
Measurement mismatch The measured deployment could not be tied to the expected workload configuration.
Quote Intel TDX (DCAP QVL)
TCB Level status=UpToDate, advisories=[]
Report Data 79a5061efe5a46b0d1f33b11cf1c5adbedae6b790000000000000000000000000ab510ca0017cbe5904d2a0e1118b40118f15f51bd9b9796b3f12efa7a9329ee
Signature ECDSA-P384 ✓
Compose Hash Mismatch ✗
Signer Bound Yes ✓
Nonce Bound Yes ✓
Enclave TLS Pin c2ebede7c2c632381123e3193b01f5f3fa45cc6c6327b2d0536749348ceeb408 ✗
Security Model No Verified Channel
What This Means No hardware attestation verified
E2EE Protocol ecdsa
Signing Key 04943cea0b4babf60f6e2031e9a00866a37c4ae696fb45895b3a9b38ab8cbb898f42c85b704aceaa0a396cf26f7fdf79d83205be7e11d3a5d70419a68277158c3d
✓ Phala/deepseek Chat V3.1 (TEE) Intel TDX Attested E2EE Details
Verified All required verifier gates passed for this check.
Quote Intel TDX (DCAP QVL)
TCB Level status=UpToDate, advisories=[]
Report Data 6525e128afcffebf7eed05d485d7be983cdae9340000000000000000000000005b489c83484bec49603bbc3ac43d05af1e53579c2667a955f8010ea256db0dc2
Signature ECDSA-P384 ✓
Compose Hash Mismatch ✗
TCB Consistent sha256 match ✓
Images Registry verified ✓
Confidential Channel E2EE to attested enclave key ✓
Signer Bound Yes ✓
Nonce Bound Yes ✓
Gateway TLS ffe9580f917878c208fd0f404c2bf1f683acd351ee8ecf6604f642dbe5cd4bf6 (external termination)
App dstack-nvidia-0.5.5
Images 5 containers
datadog/agent@sha256:5556fb80b952832719a76b016f905616c76ee0989a239c4680c6220148e865d6certbot/dns-cloudflare@sha256:742dbd2e61c8709b930712c38958386c3cb3928e09eeb1f1e490600c127e2edbcertbot/dns-cloudflare@sha256:742dbd2e61c8709b930712c38958386c3cb3928e09eeb1f1e490600c127e2edbnearaidev/compose-manager@sha256:44aa2344d68609700074a8076ed177bb1989c7f5fd1e175a13084d512be475e9nearaidev/compose-manager-launcher@sha256:171c1cffea23625628fc11038a590173745d83e3570d855e53ab5a91279f95bf
RTMR0 bc122d143ab768565ba5c3774ff5f03a63c89a4df7c1f5ea38d3bd173409d14f8cbdcc36d40e703cccb996a9d9687590
OS Image 9b69bb1698bacbb6985409a2c272bcb892e09cdcea63d5399c6768b67d3ff677
Security Model Attested E2EE
What This Means Payloads are encrypted to an attested enclave key; gateway TLS termination is expected
Infrastructure Phala/dstack
E2EE Protocol ecdsa
Signing Key 1d9bbc96671c3fbc983867bd7a6b5c83298e040801764b7085352d84f3f095125db36956caed8c84bfefca635c3c455f409c79a3889d679af688f4aded542fd5
✓ Phala/deepseek V4 Flash (TEE) Intel TDX Attested E2EE Details
Verified All required verifier gates passed for this check.
Quote Intel TDX (DCAP QVL)
TCB Level status=UpToDate, advisories=[]
Report Data c5f6bf2f1bc666569157ec1bb4066cdaf48d026c000000000000000000000000ad06725304ac1c08f5638ec810e7dbcb6b086f664b66217466ad316ca3dd1b4c
Signature ECDSA-P384 ✓
Compose Hash Mismatch ✗
TCB Consistent sha256 match ✓
Images Registry verified ✓
Confidential Channel E2EE to attested enclave key ✓
Signer Bound Yes ✓
Nonce Bound Yes ✓
Gateway TLS ffe9580f917878c208fd0f404c2bf1f683acd351ee8ecf6604f642dbe5cd4bf6 (external termination)
App dstack-nvidia-0.5.5
Images 5 containers
datadog/agent@sha256:5556fb80b952832719a76b016f905616c76ee0989a239c4680c6220148e865d6certbot/dns-cloudflare@sha256:742dbd2e61c8709b930712c38958386c3cb3928e09eeb1f1e490600c127e2edbcertbot/dns-cloudflare@sha256:742dbd2e61c8709b930712c38958386c3cb3928e09eeb1f1e490600c127e2edbnearaidev/compose-manager@sha256:44aa2344d68609700074a8076ed177bb1989c7f5fd1e175a13084d512be475e9nearaidev/compose-manager-launcher@sha256:171c1cffea23625628fc11038a590173745d83e3570d855e53ab5a91279f95bf
RTMR0 bc122d143ab768565ba5c3774ff5f03a63c89a4df7c1f5ea38d3bd173409d14f8cbdcc36d40e703cccb996a9d9687590
OS Image 9b69bb1698bacbb6985409a2c272bcb892e09cdcea63d5399c6768b67d3ff677
Security Model Attested E2EE
What This Means Payloads are encrypted to an attested enclave key; gateway TLS termination is expected
Infrastructure Phala/dstack
E2EE Protocol ecdsa
Signing Key 34ba223c3175c4debee8cd12d72f55869b6cf1ccc5ff578e940a23c7bf9dcf3abd6530ce8d8624ffd150900fd31bae802eb75367a154a75e39cc87f748b63b84
◐ Phala/gemma 3 27b It (TEE) Intel TDX Attested E2EE Details
Image not pinned Hardware/channel passed; the container image is not pinned to a verified digest.
Quote Intel TDX (DCAP QVL)
TCB Level status=UpToDate, advisories=[]
Report Data fcd14620c5d6f05091ee685fc00d96060b5d4d683176d3dd6b09bb0b0576c8b2801ec26b9e2539bbac15f95521f1a348e24a56e6a8a8855cca3a95ac1a7e6082
Signature ECDSA-P384 ✓
Confidential Channel E2EE to attested enclave key ✓
Signer Bound Yes ✓
Nonce Bound Yes ✓
Security Model Attested E2EE
What This Means Payloads are encrypted to an attested enclave key; gateway TLS termination is expected
Infrastructure unknown-dstack
E2EE Protocol ML-KEM-768 E2E
Signing Key ml-kem-768:43e91c6f-be4b-486f-a510-606567aae492
✗ Phala/gemma 4 26b A4b Uncensored (TEE) Intel TDX Details
Measurement mismatch The measured deployment could not be tied to the expected workload configuration.
Quote Intel TDX (DCAP QVL)
TCB Level status=UpToDate, advisories=[]
Report Data 79a5061efe5a46b0d1f33b11cf1c5adbedae6b7900000000000000000000000019c86c37feeca17d60849e1836c0b8f9efd65c3f973f74c5f5d3cbe7ca55056a
Signature ECDSA-P384 ✓
Compose Hash Mismatch ✗
Signer Bound Yes ✓
Nonce Bound Yes ✓
Enclave TLS Pin c2ebede7c2c632381123e3193b01f5f3fa45cc6c6327b2d0536749348ceeb408 ✗
Security Model No Verified Channel
What This Means No hardware attestation verified
E2EE Protocol ecdsa
Signing Key 04943cea0b4babf60f6e2031e9a00866a37c4ae696fb45895b3a9b38ab8cbb898f42c85b704aceaa0a396cf26f7fdf79d83205be7e11d3a5d70419a68277158c3d
◐ Phala/glm 4.7 Flash (TEE) Intel TDX Attested E2EE Details
Image not pinned Hardware/channel passed; the container image is not pinned to a verified digest.
Quote Intel TDX (DCAP QVL)
TCB Level status=UpToDate, advisories=[]
Report Data b188df9eba6a1be42d062adea075c43125e5c2560000000000000000000000001356e0f605c4a92171e704338b10f9cc61d04ee10ef39dd15beb072ac82ce4c6
Signature ECDSA-P384 ✓
Compose Hash Verified ✓
TCB Consistent sha256 match ✓
Confidential Channel E2EE to attested enclave key ✓
Signer Bound Yes ✓
Nonce Bound Yes ✓
Gateway TLS ffe9580f917878c208fd0f404c2bf1f683acd351ee8ecf6604f642dbe5cd4bf6 (external termination)
Images 6 containers
dstacktee/dstack-ingress:2.2python:3.10-slimdstacktee/vllm-proxy:v0.2.20zozyo/phala-vllm-customs:pvc-v0.6.3lmsysorg/sglang:v0.5.10haproxy:2.9-alpine
RTMR0 6ffe4a2c12f07eccb857f70f370a5af848a7062905cd95adc43abb1f62c39e330aa3c8aeb8f162656c025f3f527600f1
OS Image 806a352e16175d90568de97dff563f31f680239e6b90e9b5b2e9141d0955b0d9
Security Model Attested E2EE
What This Means Payloads are encrypted to an attested enclave key; gateway TLS termination is expected
Infrastructure unknown-dstack
E2EE Protocol ecdsa
Signing Key 13762d19cf20ab2a67fdd4b014763a77964bb2b210f4f0423cc87bf891bfe76d69da7ae91fc4039d56c2e3c44aa5bd39ebdde4ebee793573a0a6d46b07013f7a
◐ Phala/glm 5 (TEE) Intel TDX Attested E2EE Details
Image not pinned Hardware/channel passed; the container image is not pinned to a verified digest.
Quote Intel TDX (DCAP QVL)
TCB Level status=UpToDate, advisories=[]
Report Data 3ca3c36b78fc2e4370a88f4308b6b2ee6577df4082008cbd6c64a2dbf14e3d1ba2127ae7359034bd914b81f3ad66dd2e59227e77651423d35752c9a7ee8db288
Signature ECDSA-P384 ✓
Confidential Channel E2EE to attested enclave key ✓
Signer Bound Yes ✓
Nonce Bound Yes ✓
Security Model Attested E2EE
What This Means Payloads are encrypted to an attested enclave key; gateway TLS termination is expected
Infrastructure unknown-dstack
E2EE Protocol ML-KEM-768 E2E
Signing Key ml-kem-768:440ff03f-142e-40a1-823c-a6cd2bd7d192
◐ Phala/glm 5.2 (TEE) Intel TDX Attested E2EE Details
Image not pinned Hardware/channel passed; the container image is not pinned to a verified digest.
Quote Intel TDX (DCAP QVL)
TCB Level status=UpToDate, advisories=[]
Report Data b1ca8eb37f9f78eb89e8c7b60ccd1eac1e02931800000000000000000000000050f0eaf9b109aa810a692148f9a4dc00b32bfb49363ccc1888f66a90a926eacb
Signature ECDSA-P384 ✓
Compose Hash Verified ✓
TCB Consistent sha256 match ✓
Confidential Channel E2EE to attested enclave key ✓
Signer Bound Yes ✓
Nonce Bound Yes ✓
Gateway TLS ffe9580f917878c208fd0f404c2bf1f683acd351ee8ecf6604f642dbe5cd4bf6 (external termination)
Images 6 containers
dstacktee/dstack-ingress:2.2python:3.10-slimdstacktee/vllm-proxy:v0.2.20zozyo/phala-vllm-customs:pvc-v0.5.13lmsysorg/sglang:v0.5.13.post1haproxy:2.9-alpine
RTMR0 90550e56509b94f99f4670a563e0dd0a2fa79b6d7b97fd52d051069d1b33d270b1858120034a43dac4f8daf509f2aeda
OS Image 0e09f2bcb510c682b461d16b97192c710886db582852991e05146291063f890b
Security Model Attested E2EE
What This Means Payloads are encrypted to an attested enclave key; gateway TLS termination is expected
Infrastructure unknown-dstack
E2EE Protocol ecdsa
Signing Key f1ab4e111aa1fb5338f6738ef0cdb0c81104d1b3148b5ff46431fcc6738de9dc13c553a265d925747b8708eb4f4d708205372495e53ce34bdd9fa664ed3cead3
◐ Phala/minimax M2.5 (TEE) Intel TDX Attested E2EE Details
Image not pinned Hardware/channel passed; the container image is not pinned to a verified digest.
Quote Intel TDX (DCAP QVL)
TCB Level status=UpToDate, advisories=[]
Report Data d774daabd777d31bf13030b211667ebeec6ebc84bb6863390532d5478110c9bff65ca24c15e79b7a74eeaa8e75da0ee23dc51987b190ced7bfeb2489dbb06e36
Signature ECDSA-P384 ✓
Confidential Channel E2EE to attested enclave key ✓
Signer Bound Yes ✓
Nonce Bound Yes ✓
Security Model Attested E2EE
What This Means Payloads are encrypted to an attested enclave key; gateway TLS termination is expected
Infrastructure unknown-dstack
E2EE Protocol ML-KEM-768 E2E
Signing Key ml-kem-768:6260aeef-b5ec-42af-aa72-b03e65ec5e11
✗ Phala/qwen2.5 Vl 72b Instruct (TEE) Intel TDX Details
Measurement mismatch The measured deployment could not be tied to the expected workload configuration.
Quote Intel TDX (DCAP QVL)
TCB Level status=UpToDate, advisories=[]
Report Data 15c6552c60ebfcbb6ca7fa9acc54355ac379d87f25d7051ad3d26d9cae1a21337120bc5b3c14e6e7fda9b9b0645d880538571fb258b04afa8505f6f06373a80b
Signature ECDSA-P384 ✓
Compose Hash Mismatch ✗
Nonce Bound No ✗
Enclave TLS Pin ffe9580f917878c208fd0f404c2bf1f683acd351ee8ecf6604f642dbe5cd4bf6 ✗
Security Model No Verified Channel
What This Means No hardware attestation verified
◐ Phala/qwen3.5 27b (TEE) Intel TDX Attested E2EE Details
Image not pinned Hardware/channel passed; the container image is not pinned to a verified digest.
Quote Intel TDX (DCAP QVL)
TCB Level status=UpToDate, advisories=[]
Report Data 3d63de5d9ba772183e6adcdcefb60b24c79fa681000000000000000000000000f8ec1b1c3f51eb6c9a1268c4a00ac02300050ff746e057d9fb1b856531cebb79
Signature ECDSA-P384 ✓
Compose Hash Verified ✓
TCB Consistent sha256 match ✓
Confidential Channel E2EE to attested enclave key ✓
Signer Bound Yes ✓
Nonce Bound Yes ✓
Gateway TLS ffe9580f917878c208fd0f404c2bf1f683acd351ee8ecf6604f642dbe5cd4bf6 (external termination)
Images 11 containers
dstacktee/dstack-ingress:2.2dstacktee/dstack-ingress:2.2python:3.10-slimpython:3.10-slimvllm/vllm-openai:v0.10.2dstacktee/vllm-proxy:v0.2.20zozyo/phala-vllm-customs:pvc-v0.6.3vllm/vllm-openai:latestdstacktee/vllm-proxy:v0.2.20zozyo/phala-vllm-customs:pvc-v0.6.3haproxy:2.9-alpine
RTMR0 6ffe4a2c12f07eccb857f70f370a5af848a7062905cd95adc43abb1f62c39e330aa3c8aeb8f162656c025f3f527600f1
OS Image 806a352e16175d90568de97dff563f31f680239e6b90e9b5b2e9141d0955b0d9
Security Model Attested E2EE
What This Means Payloads are encrypted to an attested enclave key; gateway TLS termination is expected
Infrastructure unknown-dstack
E2EE Protocol ecdsa
Signing Key a4cb54efb43157271493fb99a6cfb8603a9f9af03aba2c2d03c2e905c86ec63fc214a39e36fe950d63e9da91af7cbeae915ffafb957dc0c81ec5ffa03b4dd266
◐ Phala/qwen3.6 27b (TEE) Intel TDX Attested E2EE Details
Image not pinned Hardware/channel passed; the container image is not pinned to a verified digest.
Quote Intel TDX (DCAP QVL)
TCB Level status=UpToDate, advisories=[]
Report Data dfda13e7133e8e2de240f96655c98fc313be5d14d47919088e0ef339d602902810c7cd4c9c04fe7e7338ac3dedebbfd29cb4308a2b1a50326f317e62ecff83df
Signature ECDSA-P384 ✓
Confidential Channel E2EE to attested enclave key ✓
Signer Bound Yes ✓
Nonce Bound Yes ✓
Security Model Attested E2EE
What This Means Payloads are encrypted to an attested enclave key; gateway TLS termination is expected
Infrastructure unknown-dstack
E2EE Protocol ML-KEM-768 E2E
Signing Key ml-kem-768:a6dd2b44-febe-407a-b687-75a0d872c708
✓ Phala/qwen3.6 35b A3b (TEE) Intel TDX Attested E2EE Details
Verified All required verifier gates passed for this check.
Quote Intel TDX (DCAP QVL)
TCB Level status=UpToDate, advisories=[]
Report Data e5d0fec43b001f181a3410b96715ec54171f36da00000000000000000000000078b316b1661d74c34d5bf7382d9b726c972eedadfbe4436c60f2c9c94bc1529f
Signature ECDSA-P384 ✓
Compose Hash Mismatch ✗
TCB Consistent sha256 match ✓
Images Registry verified ✓
Confidential Channel E2EE to attested enclave key ✓
Signer Bound Yes ✓
Nonce Bound Yes ✓
Gateway TLS ffe9580f917878c208fd0f404c2bf1f683acd351ee8ecf6604f642dbe5cd4bf6 (external termination)
App dstack-nvidia-0.5.5
Images 5 containers
datadog/agent@sha256:5556fb80b952832719a76b016f905616c76ee0989a239c4680c6220148e865d6certbot/dns-cloudflare@sha256:742dbd2e61c8709b930712c38958386c3cb3928e09eeb1f1e490600c127e2edbcertbot/dns-cloudflare@sha256:742dbd2e61c8709b930712c38958386c3cb3928e09eeb1f1e490600c127e2edbnearaidev/compose-manager@sha256:5165400d9eb43ab5da36986a85de0ba55f3fb4d05211c4397ecc4bde3ef0113bnearaidev/compose-manager-launcher@sha256:d652f92b64f57ef8aa086bd77a4cf932c1976965b3cea2814a7ee82fe73aa993
RTMR0 bc122d143ab768565ba5c3774ff5f03a63c89a4df7c1f5ea38d3bd173409d14f8cbdcc36d40e703cccb996a9d9687590
OS Image 9b69bb1698bacbb6985409a2c272bcb892e09cdcea63d5399c6768b67d3ff677
Security Model Attested E2EE
What This Means Payloads are encrypted to an attested enclave key; gateway TLS termination is expected
Infrastructure Phala/dstack
E2EE Protocol ecdsa
Signing Key 89f03d8ed945eff27ad1053f87ece198409aff78c5c2aea3e438c460482f67ff5b900054dc129f6ce57e40e8875ceac0ddf30aeb885c28fd2c3e05bf3fbaa4d9
✗ Phala/qwen3.6 35b A3b Uncensored (TEE) Intel TDX Details
Measurement mismatch The measured deployment could not be tied to the expected workload configuration.
Quote Intel TDX (DCAP QVL)
TCB Level status=UpToDate, advisories=[]
Report Data 79a5061efe5a46b0d1f33b11cf1c5adbedae6b79000000000000000000000000a2af60b3c748239208ddf71d106a3ade1b5d5e2dd94a44f9f6344166f3840053
Signature ECDSA-P384 ✓
Compose Hash Mismatch ✗
Signer Bound Yes ✓
Nonce Bound Yes ✓
Enclave TLS Pin c2ebede7c2c632381123e3193b01f5f3fa45cc6c6327b2d0536749348ceeb408 ✗
Security Model No Verified Channel
What This Means No hardware attestation verified
E2EE Protocol ecdsa
Signing Key 04943cea0b4babf60f6e2031e9a00866a37c4ae696fb45895b3a9b38ab8cbb898f42c85b704aceaa0a396cf26f7fdf79d83205be7e11d3a5d70419a68277158c3d
⚠ Phala/uncensored 24b (TEE) Details
Endpoint unavailable Fresh evidence could not be fetched in this run.
Check No public attestation endpoint
✗ Qwen 2.5 7B (TEE) Intel TDX Details
Measurement mismatch The measured deployment could not be tied to the expected workload configuration.
Quote Intel TDX (DCAP QVL)
TCB Level status=UpToDate, advisories=[]
Report Data 79a5061efe5a46b0d1f33b11cf1c5adbedae6b79000000000000000000000000950b2cc411b1e2f12bf3380aa0e4614736acd5e963490bf248788c2fd4af2c69
Signature ECDSA-P384 ✓
Compose Hash Mismatch ✗
Signer Bound Yes ✓
Nonce Bound Yes ✓
Enclave TLS Pin c2ebede7c2c632381123e3193b01f5f3fa45cc6c6327b2d0536749348ceeb408 ✗
Security Model No Verified Channel
What This Means No hardware attestation verified
E2EE Protocol ecdsa
Signing Key 04943cea0b4babf60f6e2031e9a00866a37c4ae696fb45895b3a9b38ab8cbb898f42c85b704aceaa0a396cf26f7fdf79d83205be7e11d3a5d70419a68277158c3d
✗ Qwen3 30B (TEE) Intel TDX Details
Measurement mismatch The measured deployment could not be tied to the expected workload configuration.
Quote Intel TDX (DCAP QVL)
TCB Level status=UpToDate, advisories=[]
Report Data 79a5061efe5a46b0d1f33b11cf1c5adbedae6b79000000000000000000000000da15fd5b52a4b1b0ff712bb438cb0cc11bd23b307e21fd7ae86ccf6239d2e8c8
Signature ECDSA-P384 ✓
Compose Hash Mismatch ✗
Signer Bound Yes ✓
Nonce Bound Yes ✓
Enclave TLS Pin c2ebede7c2c632381123e3193b01f5f3fa45cc6c6327b2d0536749348ceeb408 ✗
Security Model No Verified Channel
What This Means No hardware attestation verified
E2EE Protocol ecdsa
Signing Key 04943cea0b4babf60f6e2031e9a00866a37c4ae696fb45895b3a9b38ab8cbb898f42c85b704aceaa0a396cf26f7fdf79d83205be7e11d3a5d70419a68277158c3d
✗ Qwen3-VL 30B (TEE) Intel TDX Details
Measurement mismatch The measured deployment could not be tied to the expected workload configuration.
Quote Intel TDX (DCAP QVL)
TCB Level status=UpToDate, advisories=[]
Report Data 79a5061efe5a46b0d1f33b11cf1c5adbedae6b79000000000000000000000000995da1afd352dd79dadbe003743bc878103738e15d003927bc4acba0f8a0331f
Signature ECDSA-P384 ✓
Compose Hash Mismatch ✗
Signer Bound Yes ✓
Nonce Bound Yes ✓
Enclave TLS Pin c2ebede7c2c632381123e3193b01f5f3fa45cc6c6327b2d0536749348ceeb408 ✗
Security Model No Verified Channel
What This Means No hardware attestation verified
E2EE Protocol ecdsa
Signing Key 04943cea0b4babf60f6e2031e9a00866a37c4ae696fb45895b3a9b38ab8cbb898f42c85b704aceaa0a396cf26f7fdf79d83205be7e11d3a5d70419a68277158c3d
✗ Qwen3.5 397B (TEE) Intel TDX Details
Measurement mismatch The measured deployment could not be tied to the expected workload configuration.
Quote Intel TDX (DCAP QVL)
TCB Level status=UpToDate, advisories=[]
Report Data 79a5061efe5a46b0d1f33b11cf1c5adbedae6b7900000000000000000000000066134969c6640e2cda437bc77ce16610fbc482c512c5016750824b5ff2d3f3cc
Signature ECDSA-P384 ✓
Compose Hash Mismatch ✗
Signer Bound Yes ✓
Nonce Bound Yes ✓
Enclave TLS Pin c2ebede7c2c632381123e3193b01f5f3fa45cc6c6327b2d0536749348ceeb408 ✗
Security Model No Verified Channel
What This Means No hardware attestation verified
E2EE Protocol ecdsa
Signing Key 04943cea0b4babf60f6e2031e9a00866a37c4ae696fb45895b3a9b38ab8cbb898f42c85b704aceaa0a396cf26f7fdf79d83205be7e11d3a5d70419a68277158c3d

Tinfoil

7/9 Alerts RSS
Availability issue The verifier could not fetch fresh evidence for every check in this run.
7 verified 0 partial 0 failed 2 unavailable
TDX + SNP TEE-Terminated TLS TEE-only Gateway
Hardware 7/9 good Freshness Not shown Key binding 6/9 good Workload Not shown Provenance 7/9 good Availability 2 warning
Endpoint unavailable 2
✓ DeepSeek V4 Pro Intel TDX TEE-Terminated TLS Details
Verified All required verifier gates passed for this check.
Quote Intel TDX (DCAP QVL)
TCB Level status=UpToDate, advisories=[]
Report Data 1ec62d8eaa2bfb4b942df6f69ce30efe8fe3a400c8da813e831415fca5f5b17c23dc187af23ba8bd2a998aec4ef28e18692a179c8cec7f255c8f9fd0d459356a
Signature ECDSA-P384 ✓
Images Registry verified ✓
Sigstore Bundle Crypto Verified ✓
Measurements Match ✓
Release v0.0.7
Sigstore Repo tinfoilsh/confidential-deepseek-v4-pro
Enclave TLS Pin 1ec62d8eaa2bfb4b942df6f69ce30efe8fe3a400c8da813e831415fca5f5b17c ✓
vllm/vllm-openai:v0.22.0@sha256:0fec7ec5f3e6bc168e54899935fb0557da908a4832a1dbc88e2debcf2f889416
Security Model TEE-Terminated TLS
What This Means TLS terminates inside the attested TEE; certificate key is bound to report_data
✓ Gemma 4 31B Intel TDX TEE-Terminated TLS Details
Verified All required verifier gates passed for this check.
Quote Intel TDX (DCAP QVL)
TCB Level status=UpToDate, advisories=[]
Report Data dd34cd14f50bc0e410886c75bb387a6a4afa3704a03ad22386ec8fb8fe5cef9a0394825e3555b92558d6130d1193bf3049e06a67633ed2a735bb3203cdf6ff1f
Signature ECDSA-P384 ✓
Images Registry verified ✓
Sigstore Bundle Crypto Verified ✓
Measurements Match ✓
Release v0.0.18
Sigstore Repo tinfoilsh/confidential-gemma4-31b
Enclave TLS Pin dd34cd14f50bc0e410886c75bb387a6a4afa3704a03ad22386ec8fb8fe5cef9a ✓
ghcr.io/tinfoilsh/confidential-gemma4-31b@sha256:73cec121874dd0a40192d1e5074f9a674f74fe0749d58eb0aee76d5cc351257b
Security Model TEE-Terminated TLS
What This Means TLS terminates inside the attested TEE; certificate key is bound to report_data
✓ GLM 5.1 Intel TDX TEE-Terminated TLS Details
Verified All required verifier gates passed for this check.
Quote Intel TDX (DCAP QVL)
TCB Level status=UpToDate, advisories=[]
Report Data f38f31e20560c8e85ac287f8b38fcadb956b9d9583f3e5b1381c4b9ade8a27bec324ff4f230952be79746aa8da9a85591faf9b507375b9264f48c2493256025e
Signature ECDSA-P384 ✓
Images Registry verified ✓
Sigstore Bundle Crypto Verified ✓
Measurements Match ✓
Release v0.0.9
Sigstore Repo tinfoilsh/confidential-glm5-1
Enclave TLS Pin f38f31e20560c8e85ac287f8b38fcadb956b9d9583f3e5b1381c4b9ade8a27be ✓
vllm/vllm-openai:v0.22.0@sha256:0fec7ec5f3e6bc168e54899935fb0557da908a4832a1dbc88e2debcf2f889416
Security Model TEE-Terminated TLS
What This Means TLS terminates inside the attested TEE; certificate key is bound to report_data
✓ GPT-OSS 120B Intel TDX TEE-Terminated TLS Details
Verified All required verifier gates passed for this check.
Quote Intel TDX (DCAP QVL)
TCB Level status=UpToDate, advisories=[]
Report Data 8d76f170e82d1fee347996dd1dfccbadca299e48bd80a8ff2456224052a2b41482eaf549b1464fed82c64bf625a923f9a85aaf8ade0d16bceb5fb6a125f26b5b
Signature ECDSA-P384 ✓
Images Registry verified ✓
Sigstore Bundle Crypto Verified ✓
Measurements Match ✓
Release v0.0.26
Sigstore Repo tinfoilsh/confidential-gpt-oss-120b
Enclave TLS Pin 8d76f170e82d1fee347996dd1dfccbadca299e48bd80a8ff2456224052a2b414 ✓
vllm/vllm-openai:v0.22.0@sha256:0fec7ec5f3e6bc168e54899935fb0557da908a4832a1dbc88e2debcf2f889416
Security Model TEE-Terminated TLS
What This Means TLS terminates inside the attested TEE; certificate key is bound to report_data
✓ GPT-OSS Safeguard 120B AMD SEV-SNP TEE-Terminated TLS Details
Verified All required verifier gates passed for this check.
Quote AMD SEV-SNP (VCEK)
Policy 0x30000
Report Data 8dff9ead5e54f3905e0325f557ea51f2a7daf89f989e424b73919669373d4a1e6668665ddbf0541157ffb70e94f438ba3d34a6551112ee09e42393b9450cb031
Signature ECDSA-P384 ✓
Images Registry verified ✓
Sigstore Bundle Crypto Verified ✓
Measurements Match ✓
Release v0.0.8
Sigstore Repo tinfoilsh/confidential-gpt-oss-safeguard-120b
Enclave TLS Pin 8dff9ead5e54f3905e0325f557ea51f2a7daf89f989e424b73919669373d4a1e ✓
vllm/vllm-openai:v0.22.0@sha256:0fec7ec5f3e6bc168e54899935fb0557da908a4832a1dbc88e2debcf2f889416
Security Model TEE-Terminated TLS
What This Means TLS terminates inside the attested TEE; certificate key is bound to report_data
⚠ Kimi K2.6 Details
Endpoint unavailable Fresh evidence could not be fetched in this run.
Check No public attestation endpoint
✓ Llama 3.3 70B AMD SEV-SNP TEE-Terminated TLS Details
Verified All required verifier gates passed for this check.
Quote AMD SEV-SNP (VCEK)
Policy 0x30000
Report Data 281ad7bea31b1c428d5100ee142478e76ab48f091b84e4f9505df75b1cde68840e1d011d09c176637d27a2c2b62406d2d0795f88c0c452b4a9d561d3bbaaea3d
Signature ECDSA-P384 ✓
Images Registry verified ✓
Sigstore Bundle Crypto Verified ✓
Measurements Match ✓
Release v0.0.25
Sigstore Repo tinfoilsh/confidential-llama3-3-70b
Enclave TLS Pin 281ad7bea31b1c428d5100ee142478e76ab48f091b84e4f9505df75b1cde6884 ✓
vllm/vllm-openai:v0.22.0@sha256:0fec7ec5f3e6bc168e54899935fb0557da908a4832a1dbc88e2debcf2f889416
Security Model TEE-Terminated TLS
What This Means TLS terminates inside the attested TEE; certificate key is bound to report_data
⚠ Qwen3-VL 30B Details
Endpoint unavailable Fresh evidence could not be fetched in this run.
Check No public attestation endpoint
✓ Router AMD SEV-SNP TEE-only Gateway Details
Verified All required verifier gates passed for this check.
Quote AMD SEV-SNP (VCEK)
Policy 0x30000
Report Data 1bcb53d34e1856d0c22eb0c55d4ae24d0607b9d45e677ef55003b975128ea8ae40802eee8b552ff2fc06ea29206cb6efc64bcc63f61063aca105f651ee871b75
Signature ECDSA-P384 ✓
Images Registry verified ✓
Sigstore Bundle Crypto Verified ✓
Measurements Match ✓
Release v0.0.118
Sigstore Repo tinfoilsh/confidential-model-router
Enclave TLS Pin 3d47e93ba9cfa10f1eed509ae3717dbf965bb21645dd77ca4d57a51dccd22129 ✗
Version v0.0.118
ghcr.io/tinfoilsh/confidential-model-router@sha256:33fa7f02784751a6ea19a3ae1b32cb22ff34ac354ecab697ed475234215f3372
Security Model TEE-only Gateway
What This Means Model runs in TEE but gateway sees plaintext prompts

Venice.ai

5+1/17 Alerts RSS
Critical trust failures At least one check failed a quote, freshness, key-binding, measurement, or policy gate.
5 verified 1 partial 11 failed 0 unavailable
Intel TDX Attested E2EE Phala/dstack
Hardware 11 bad Freshness 11 bad Key binding 6/17 good Workload 5 bad Provenance 1 warning Availability 17/17 good
Nonce not bound 11 Image not pinned 1
✓ E2ee Deepseek V4 Flash (TEE) Intel TDX Attested E2EE Details
Verified All required verifier gates passed for this check.
Quote Intel TDX (DCAP QVL)
TCB Level status=UpToDate, advisories=[]
Report Data c5f6bf2f1bc666569157ec1bb4066cdaf48d026c0000000000000000000000003a7c7de81521ee5ce23f8de919756544b262bcd7882e3c7b76213308e89bbc65
Signature ECDSA-P384 ✓
Compose Hash Mismatch ✗
TCB Consistent sha256 match ✓
Images Registry verified ✓
Confidential Channel E2EE to attested enclave key ✓
Signer Bound Yes ✓
Nonce Bound Yes ✓
Last Deploy v0.0.309
Gateway TLS 08b9c0d165fbf3433870dc1c22a118da08eed65ae58aa4950fdf8dd21e98e70b (external termination)
App dstack-nvidia-0.5.5
Images 6 containers
datadog/agent@sha256:5556fb80b952832719a76b016f905616c76ee0989a239c4680c6220148e865d6otel/opentelemetry-collector-contrib@sha256:85ac41c2db88d0df9bd6145e608a3cb023f5d8443868adbfbbf66efb51087917certbot/dns-cloudflare@sha256:742dbd2e61c8709b930712c38958386c3cb3928e09eeb1f1e490600c127e2edbcertbot/dns-cloudflare@sha256:742dbd2e61c8709b930712c38958386c3cb3928e09eeb1f1e490600c127e2edbnearaidev/compose-manager@sha256:b487f39160e9a53c3d98943a9c709d28e12babef75e0bb5a6cd5692abc8b2db6nearaidev/compose-manager-launcher@sha256:78afb82330137c2fd90a9c8c6e452f8f178c15d863f87c079a11c13e92216e00
RTMR0 bc122d143ab768565ba5c3774ff5f03a63c89a4df7c1f5ea38d3bd173409d14f8cbdcc36d40e703cccb996a9d9687590
OS Image 9b69bb1698bacbb6985409a2c272bcb892e09cdcea63d5399c6768b67d3ff677
Security Model Attested E2EE
What This Means Payloads are encrypted to an attested enclave key; gateway TLS termination is expected
Infrastructure Phala/dstack
E2EE Protocol ecdsa
Signing Key 0434ba223c3175c4debee8cd12d72f55869b6cf1ccc5ff578e940a23c7bf9dcf3abd6530ce8d8624ffd150900fd31bae802eb75367a154a75e39cc87f748b63b84
✗ E2ee Gemma 4 26b A4b Uncensored P (TEE) Details
Nonce not bound The report did not prove freshness with a verifier-generated nonce.
Check No public attestation endpoint
◐ E2ee Glm 4 7 Flash P (TEE) Intel TDX Attested E2EE Details
Image not pinned Hardware/channel passed; the container image is not pinned to a verified digest.
Quote Intel TDX (DCAP QVL)
TCB Level status=UpToDate, advisories=[]
Report Data 20ee170ea6c4349032168d168b07b51cb7d5e1b000000000000000000000000066a3f7a327c3f6d9e63136c3caddfb72edb49b2090d4914bbe9611c0ec9b5fd3
Signature ECDSA-P384 ✓
Compose Hash Verified ✓
TCB Consistent sha256 match ✓
Confidential Channel E2EE to attested enclave key ✓
Signer Bound Yes ✓
Nonce Bound Yes ✓
Gateway TLS 08b9c0d165fbf3433870dc1c22a118da08eed65ae58aa4950fdf8dd21e98e70b (external termination)
Images 5 containers
dstacktee/dstack-ingress:2.2python:3.10-slimdstacktee/vllm-proxy:v0.2.20lmsysorg/sglang:v0.5.10haproxy:2.9-alpine
RTMR0 6ffe4a2c12f07eccb857f70f370a5af848a7062905cd95adc43abb1f62c39e330aa3c8aeb8f162656c025f3f527600f1
OS Image 806a352e16175d90568de97dff563f31f680239e6b90e9b5b2e9141d0955b0d9
Security Model Attested E2EE
What This Means Payloads are encrypted to an attested enclave key; gateway TLS termination is expected
Infrastructure unknown-dstack
E2EE Protocol ecdsa
Signing Key 0444df4c49593ef66aa76622f79ccc5895f8560fff6c77b60e1eb812f5fa4ff98204c67432b12d11349cea1baa35d1cb1afd214cd3b8ed12cf19e370fdc62c1194
✗ E2ee Glm 5 2 P (TEE) Details
Nonce not bound The report did not prove freshness with a verifier-generated nonce.
Check No public attestation endpoint
✓ E2ee Qwen3 6 27b (TEE) Intel TDX Attested E2EE Details
Verified All required verifier gates passed for this check.
Quote Intel TDX (DCAP QVL)
TCB Level status=UpToDate, advisories=[]
Report Data 6eb6ce4fa9f7f704769afff165955105c1ae7b1d00000000000000000000000094361e4a4ea9328a22908197f0dc3575d2cfedc0ef2fc55c4ca55ac1a2cc3728
Signature ECDSA-P384 ✓
Compose Hash Mismatch ✗
TCB Consistent sha256 match ✓
Images Registry verified ✓
Confidential Channel E2EE to attested enclave key ✓
Signer Bound Yes ✓
Nonce Bound Yes ✓
Last Deploy v0.0.309
Gateway TLS 08b9c0d165fbf3433870dc1c22a118da08eed65ae58aa4950fdf8dd21e98e70b (external termination)
App dstack-nvidia-0.5.5
Images 6 containers
datadog/agent@sha256:5556fb80b952832719a76b016f905616c76ee0989a239c4680c6220148e865d6otel/opentelemetry-collector-contrib@sha256:85ac41c2db88d0df9bd6145e608a3cb023f5d8443868adbfbbf66efb51087917certbot/dns-cloudflare@sha256:742dbd2e61c8709b930712c38958386c3cb3928e09eeb1f1e490600c127e2edbcertbot/dns-cloudflare@sha256:742dbd2e61c8709b930712c38958386c3cb3928e09eeb1f1e490600c127e2edbnearaidev/compose-manager@sha256:b487f39160e9a53c3d98943a9c709d28e12babef75e0bb5a6cd5692abc8b2db6nearaidev/compose-manager-launcher@sha256:78afb82330137c2fd90a9c8c6e452f8f178c15d863f87c079a11c13e92216e00
RTMR0 bc122d143ab768565ba5c3774ff5f03a63c89a4df7c1f5ea38d3bd173409d14f8cbdcc36d40e703cccb996a9d9687590
OS Image 9b69bb1698bacbb6985409a2c272bcb892e09cdcea63d5399c6768b67d3ff677
Security Model Attested E2EE
What This Means Payloads are encrypted to an attested enclave key; gateway TLS termination is expected
Infrastructure Phala/dstack
E2EE Protocol ecdsa
Signing Key 04cf942c4bcb0f89ffd33e837d850ab3eb4ff66cee6b285db3bbdff6e815f81e7df9a4bfaf863207b5d4ccc99ea4c3eca3172a82b2a7717635522bd22fc0cf6219
✗ E2ee Qwen3 6 35b A3b Uncensored P (TEE) Details
Nonce not bound The report did not prove freshness with a verifier-generated nonce.
Check No public attestation endpoint
✗ E2ee Venice Uncensored 24b P (TEE) Details
Nonce not bound The report did not prove freshness with a verifier-generated nonce.
Check No public attestation endpoint
✗ Gemma 3 27B (TEE) Details
Nonce not bound The report did not prove freshness with a verifier-generated nonce.
Check No public attestation endpoint
✓ Gemma 4 31B (TEE) Intel TDX Attested E2EE Details
Verified All required verifier gates passed for this check.
Quote Intel TDX (DCAP QVL)
TCB Level status=UpToDate, advisories=[]
Report Data 9765596f43dd91d1467f9a370682173741786d8c0000000000000000000000000f8d665b8296eb6fee0527cd0970585405c272e24ec51b232960b7f2dce74e1f
Signature ECDSA-P384 ✓
Compose Hash Mismatch ✗
TCB Consistent sha256 match ✓
Images Registry verified ✓
Confidential Channel E2EE to attested enclave key ✓
Signer Bound Yes ✓
Nonce Bound Yes ✓
Last Deploy v0.0.309
Gateway TLS 08b9c0d165fbf3433870dc1c22a118da08eed65ae58aa4950fdf8dd21e98e70b (external termination)
App dstack-nvidia-0.5.5
Images 6 containers
datadog/agent@sha256:5556fb80b952832719a76b016f905616c76ee0989a239c4680c6220148e865d6otel/opentelemetry-collector-contrib@sha256:85ac41c2db88d0df9bd6145e608a3cb023f5d8443868adbfbbf66efb51087917certbot/dns-cloudflare@sha256:742dbd2e61c8709b930712c38958386c3cb3928e09eeb1f1e490600c127e2edbcertbot/dns-cloudflare@sha256:742dbd2e61c8709b930712c38958386c3cb3928e09eeb1f1e490600c127e2edbnearaidev/compose-manager@sha256:b487f39160e9a53c3d98943a9c709d28e12babef75e0bb5a6cd5692abc8b2db6nearaidev/compose-manager-launcher@sha256:78afb82330137c2fd90a9c8c6e452f8f178c15d863f87c079a11c13e92216e00
RTMR0 bc122d143ab768565ba5c3774ff5f03a63c89a4df7c1f5ea38d3bd173409d14f8cbdcc36d40e703cccb996a9d9687590
OS Image 9b69bb1698bacbb6985409a2c272bcb892e09cdcea63d5399c6768b67d3ff677
Security Model Attested E2EE
What This Means Payloads are encrypted to an attested enclave key; gateway TLS termination is expected
Infrastructure Phala/dstack
E2EE Protocol ecdsa
Signing Key 04323149efe98c490b9b44b517b3bd599defd1ad5a61f580ca27bfd3daedd3333eddd6e40663c9a79556897ddf9ecf9dfb937ebd3cfbac512d2a7620b3c2df09d2
✗ GLM 4.7 (TEE) Details
Nonce not bound The report did not prove freshness with a verifier-generated nonce.
Check No public attestation endpoint
✓ GLM 5.1 (TEE) Intel TDX Attested E2EE Details
Verified All required verifier gates passed for this check.
Quote Intel TDX (DCAP QVL)
TCB Level status=UpToDate, advisories=[]
Report Data bb4d2e7ffe98eefcd9690e2139be41e92b95e33300000000000000000000000091f458c62f3c273b7b4183b389168e4de4adde37cd5d84fc2a2e8b1f2dbc48cf
Signature ECDSA-P384 ✓
Compose Hash Mismatch ✗
TCB Consistent sha256 match ✓
Images Registry verified ✓
Confidential Channel E2EE to attested enclave key ✓
Signer Bound Yes ✓
Nonce Bound Yes ✓
Gateway TLS 08b9c0d165fbf3433870dc1c22a118da08eed65ae58aa4950fdf8dd21e98e70b (external termination)
App dstack-nvidia-0.5.5
Images 6 containers
datadog/agent@sha256:5556fb80b952832719a76b016f905616c76ee0989a239c4680c6220148e865d6otel/opentelemetry-collector-contrib@sha256:85ac41c2db88d0df9bd6145e608a3cb023f5d8443868adbfbbf66efb51087917certbot/dns-cloudflare@sha256:742dbd2e61c8709b930712c38958386c3cb3928e09eeb1f1e490600c127e2edbcertbot/dns-cloudflare@sha256:742dbd2e61c8709b930712c38958386c3cb3928e09eeb1f1e490600c127e2edbnearaidev/compose-manager@sha256:b487f39160e9a53c3d98943a9c709d28e12babef75e0bb5a6cd5692abc8b2db6nearaidev/compose-manager-launcher@sha256:78afb82330137c2fd90a9c8c6e452f8f178c15d863f87c079a11c13e92216e00
RTMR0 bc122d143ab768565ba5c3774ff5f03a63c89a4df7c1f5ea38d3bd173409d14f8cbdcc36d40e703cccb996a9d9687590
OS Image 9b69bb1698bacbb6985409a2c272bcb892e09cdcea63d5399c6768b67d3ff677
Security Model Attested E2EE
What This Means Payloads are encrypted to an attested enclave key; gateway TLS termination is expected
Infrastructure Phala/dstack
E2EE Protocol ecdsa
Signing Key 042a1c47aad08a4f47dcb67134d77b83d8a1d5c895e37e959189249e819c3939289d8c59acb07d262db3ca946d52c51ae079fde6708cb0af7e25a57d35c8e0ac30
✗ GPT-OSS 120B (TEE) Details
Nonce not bound The report did not prove freshness with a verifier-generated nonce.
Check No public attestation endpoint
✗ GPT-OSS 20B (TEE) Details
Nonce not bound The report did not prove freshness with a verifier-generated nonce.
Check No public attestation endpoint
✗ Qwen 2.5 7B (TEE) Details
Nonce not bound The report did not prove freshness with a verifier-generated nonce.
Check No public attestation endpoint
✗ Qwen3 30B (TEE) Details
Nonce not bound The report did not prove freshness with a verifier-generated nonce.
Check No public attestation endpoint
✓ Qwen3 35B (TEE) Intel TDX Attested E2EE Details
Verified All required verifier gates passed for this check.
Quote Intel TDX (DCAP QVL)
TCB Level status=UpToDate, advisories=[]
Report Data e5d0fec43b001f181a3410b96715ec54171f36da000000000000000000000000ab466445090d56529f470b61467367e79aa3d43c3f1abe7e2b7a022d8229a052
Signature ECDSA-P384 ✓
Compose Hash Mismatch ✗
TCB Consistent sha256 match ✓
Images Registry verified ✓
Confidential Channel E2EE to attested enclave key ✓
Signer Bound Yes ✓
Nonce Bound Yes ✓
Gateway TLS 08b9c0d165fbf3433870dc1c22a118da08eed65ae58aa4950fdf8dd21e98e70b (external termination)
App dstack-nvidia-0.5.5
Images 6 containers
datadog/agent@sha256:5556fb80b952832719a76b016f905616c76ee0989a239c4680c6220148e865d6otel/opentelemetry-collector-contrib@sha256:85ac41c2db88d0df9bd6145e608a3cb023f5d8443868adbfbbf66efb51087917certbot/dns-cloudflare@sha256:742dbd2e61c8709b930712c38958386c3cb3928e09eeb1f1e490600c127e2edbcertbot/dns-cloudflare@sha256:742dbd2e61c8709b930712c38958386c3cb3928e09eeb1f1e490600c127e2edbnearaidev/compose-manager@sha256:5165400d9eb43ab5da36986a85de0ba55f3fb4d05211c4397ecc4bde3ef0113bnearaidev/compose-manager-launcher@sha256:d652f92b64f57ef8aa086bd77a4cf932c1976965b3cea2814a7ee82fe73aa993
RTMR0 bc122d143ab768565ba5c3774ff5f03a63c89a4df7c1f5ea38d3bd173409d14f8cbdcc36d40e703cccb996a9d9687590
OS Image 9b69bb1698bacbb6985409a2c272bcb892e09cdcea63d5399c6768b67d3ff677
Security Model Attested E2EE
What This Means Payloads are encrypted to an attested enclave key; gateway TLS termination is expected
Infrastructure Phala/dstack
E2EE Protocol ecdsa
Signing Key 0489f03d8ed945eff27ad1053f87ece198409aff78c5c2aea3e438c460482f67ff5b900054dc129f6ce57e40e8875ceac0ddf30aeb885c28fd2c3e05bf3fbaa4d9
✗ Qwen3-VL 30B (TEE) Details
Nonce not bound The report did not prove freshness with a verifier-generated nonce.
Check No public attestation endpoint

Shared Infrastructure

These providers share the same physical TEE infrastructure:

unknown-dstack NanoGPT · Redpill
Phala/dstack NEAR AI · Redpill · Venice.ai

Verification Methodology

Tinfoil Enclaves

Fetches .well-known/tinfoil-attestation from each enclave. The response contains a gzipped, base64-encoded hardware quote. For TDX enclaves, the quote is verified through Intel DCAP Quote Verification Library (dcap-qvl) using Intel PCS collateral (override via PCCS_URL if needed). For SNP enclaves, the report is verified against AMD KDS VCEK certificates with builtin ARK/ASK roots. TLS certificate SPKI fingerprints are compared to the attested report_data.

Venice.ai / Redpill / NEAR AI (dstack)

All three providers use the same dstack attestation format. Venice returns a direct attestation; Redpill and NEAR AI return a two-layer format (gateway + model attestations). In all cases, the raw intel_quote hex is parsed as a TDX quote and verified via dcap-qvl using Intel PCS collateral (or PCCS_URL override). The quote-bound tcb_info.app_compose hash is recomputed and compared to tcb_info.compose_hash; when compose-manager actions_hash evidence is present, that is recomputed too. Provider server_verification and verified fields are completely ignored.

NVIDIA GPU Attestation

GPU evidence payloads are submitted to NVIDIA's NRAS (NVRemote Attestation Service) which returns a signed JWT. The JWT signature is verified against NRAS's JWKS, the issuer is pinned to nras.attestation.nvidia.com, and the eat_nonce is checked against the request nonce. NRAS currently rejects dstack/Phala GPU evidence (unsupported architecture), so GPU verification is reported separately from TDX.

Chutes / Maple / Privatemode / Other Providers

Chutes is checked by fetching a live TEE chute's evidence endpoint, verifying the Intel TDX quote with dcap-qvl, checking that report_data binds the verifier nonce plus the ML-KEM E2E public key, and verifying NVIDIA GPU evidence when present. Chutes checks stay partial unless the workload image is digest-pinned or equivalent signed provenance is exposed. Maple Nitro checks also stay partial until expected PCR/workload provenance is configured. Privatemode is checked with a pinned Contrast CLI: the Coordinator is remotely attested, the active manifest must match the CDN manifest hash, and digest-pinned images are extracted from the verified initdata before the local proxy model path is accepted. PPQ is not counted as verified from liveness alone.