Zero-Trust Attestation
TEE
Verification
A valid hardware quote proves the TEE exists. End-to-end verification additionally proves freshness, the confidential channel, the measured workload, source provenance, and the request route where applicable.
71/89 Hardware + TCB verified
3/89 End-to-end verified
54 Evidence incomplete
19 Explicit failures
13 Unavailable
Observed channel modes 2 TEE-Terminated TLS 27 Attested E2EE 28 TEE-only Gateway
What do these channel modes mean? How to read this run
Hardware verification is the first gate, not the final verdict.
71 checks validated their hardware quote and TCB policy. Only 3 also proved every applicable layer through workload identity, source provenance, and request routing. All 54 incomplete checks passed hardware and TCB verification in this run.
- 71/89 Hardware + TCB Vendor-rooted quote and configured hardware policy both passed.
- 57/88 Freshness Current evidence is bound to a verifier-owned challenge.
- 43/59 Confidential channel A TLS or application encryption key is bound to the attested environment.
- 24/89 Workload identity The measured runtime matches the expected workload configuration.
- 4/89 Source provenance The measured runtime is linked to signed source or release evidence.
- 2/88 Request route The request is cryptographically bound to the selected backend.
Each denominator includes only checks where that layer applies to the provider's claimed confidentiality model.
✓
End-to-end verifiedEvery applicable evidence gate passed.
◐
Evidence incompleteHardware passed, but a later gate is not proven. This is not an explicit attestation failure.
✗
Explicit failureA mismatch or policy rejection was observed. The hardware quote may still be valid.
!
UnavailableFresh evidence could not be fetched; this does not prove the provider is outside a TEE.
Incomplete evidence Hardware and TCB passed, but one or more later evidence gates are not proven.
Hardware 1 warning TCB policy 1 warning Freshness 1 warning Channel binding 1 warning Workload identity 13 warning Source provenance 13 warning Request route 13 warning Availability 1 warning
Workload identity not proven 12 Source provenance not proven 12 Request route not proven 12 Endpoint unavailable 1
Deepseek Ai/DeepSeek V3.2 TEE (TEE) Intel TDX Attested E2EE Details
Workload identity not proven No expected workload measurement was verified.
Quote Intel TDX (DCAP QVL)
TCB Level status=UpToDate, advisories=[]
Report Data a5dfa827290b77e4d431f47df02a54ada1af022f1b3c85847ab2f1818886d537a2f7287384894c01ac2796f42aeb1a9dccae61c2d203227e99f34e24c8eb8093
Signature ECDSA-P384 ✓
Confidential Channel E2EE to attested enclave key ✓
Signer Bound Yes ✓
Nonce Bound Yes ✓
registry.chutes.ai/chutes/sglang:nightly-2026031300-7f2b15c9e6e9
Security Model Attested E2EE
What This Means Payloads are encrypted to an attested enclave key; gateway TLS termination is expected
Sold by Chutes
Workload operator Chutes (corroborated)
TEE platform Chutes (corroborated)
Route binding No request-bound receipt
E2EE Protocol ML-KEM-768 E2E
Signing Key ml-kem-768:42392f46-da99-4408-8898-a762cc2e2abf
chute:deepseek-ai/DeepSeek-V3.2-TEEinstance:42392f46-da99-4408-8898-a762cc2e2abfcertificate-present:truegpu-evidence-count:8revision:a7e62ac04ecb2c0a54d736dc46601c5606cf10a6lock-modules:trueexternal-egress:falsechutes-version:0.6.6image-id:d63d064c-4add-5213-b278-d3125c8078fdimage-status:built and pushedimage-chutes-version:0.6.6
Google/gemma 4 31B Turbo TEE (TEE) Intel TDX Attested E2EE Details
Workload identity not proven No expected workload measurement was verified.
Quote Intel TDX (DCAP QVL)
TCB Level status=UpToDate, advisories=[]
Report Data 91d6a46f83e46a3204d4f649aa51e29b71568738d4fece50ef32cac35d20f14d042ca2465cfd1b3eb11eee1f0d9777c3e8c589097ab0d7e2ba6d3687b601064c
Signature ECDSA-P384 ✓
Confidential Channel E2EE to attested enclave key ✓
Signer Bound Yes ✓
Nonce Bound Yes ✓
registry.chutes.ai/chutes/sglang:0.5.13-post1c
Security Model Attested E2EE
What This Means Payloads are encrypted to an attested enclave key; gateway TLS termination is expected
Sold by Chutes
Workload operator Chutes (corroborated)
TEE platform Chutes (corroborated)
Route binding No request-bound receipt
E2EE Protocol ML-KEM-768 E2E
Signing Key ml-kem-768:66a58ade-79c3-440b-acbe-044cd3ee0a24
chute:google/gemma-4-31B-turbo-TEEinstance:66a58ade-79c3-440b-acbe-044cd3ee0a24certificate-present:truegpu-evidence-count:1revision:e5ef03afa233c35cb000323ff098d4291e1dd07clock-modules:trueexternal-egress:falsechutes-version:0.6.11.rc2image-id:a3028618-6f8f-5afc-9a51-8eff25f2e5c8image-status:built and pushedimage-chutes-version:0.6.11.rc2
MiniMaxAI/MiniMax M2.5 TEE (TEE) Intel TDX Attested E2EE Details
Workload identity not proven No expected workload measurement was verified.
Quote Intel TDX (DCAP QVL)
TCB Level status=UpToDate, advisories=[]
Report Data 6cee4ec8c9634a46ffdb7117a0e9ddd3becdb70dfe22fee8da73ae4d76e4f56a547717537a4216cf6a61a37a128ffee2b435b6205c7de68bf996a06e8c4caeb1
Signature ECDSA-P384 ✓
Confidential Channel E2EE to attested enclave key ✓
Signer Bound Yes ✓
Nonce Bound Yes ✓
registry.chutes.ai/chutes/sglang:nightly-2026043000
Security Model Attested E2EE
What This Means Payloads are encrypted to an attested enclave key; gateway TLS termination is expected
Sold by Chutes
Workload operator Chutes (corroborated)
TEE platform Chutes (corroborated)
Route binding No request-bound receipt
E2EE Protocol ML-KEM-768 E2E
Signing Key ml-kem-768:e47fe8ed-99e2-4131-a778-d58b965303eb
chute:MiniMaxAI/MiniMax-M2.5-TEEinstance:e47fe8ed-99e2-4131-a778-d58b965303ebcertificate-present:truegpu-evidence-count:8revision:37649bdaab7de76902236a546b2df436a93a33balock-modules:trueexternal-egress:falsechutes-version:0.6.5image-id:fef3b089-b516-5c04-bf72-ae56ad48492aimage-status:built and pushedimage-chutes-version:0.6.5
Moonshotai/Kimi K2.5 TEE (TEE) Intel TDX Attested E2EE Details
Workload identity not proven No expected workload measurement was verified.
Quote Intel TDX (DCAP QVL)
TCB Level status=UpToDate, advisories=[]
Report Data d27dae8142aa728eddaaef7b010f092e8949f6991639c6369638f0e44b1eb0391b7d5773f1d9c8e8e91f552ddc82d0907d1e1a421a3a2366c29826eaf5957a6d
Signature ECDSA-P384 ✓
Confidential Channel E2EE to attested enclave key ✓
Signer Bound Yes ✓
Nonce Bound Yes ✓
registry.chutes.ai/chutes/sglang:0.5.13-post1b
Security Model Attested E2EE
What This Means Payloads are encrypted to an attested enclave key; gateway TLS termination is expected
Sold by Chutes
Workload operator Chutes (corroborated)
TEE platform Chutes (corroborated)
Route binding No request-bound receipt
E2EE Protocol ML-KEM-768 E2E
Signing Key ml-kem-768:20f449a0-f64c-4e24-aaa0-4c0603df0bd5
chute:moonshotai/Kimi-K2.5-TEEinstance:20f449a0-f64c-4e24-aaa0-4c0603df0bd5certificate-present:truegpu-evidence-count:8revision:3367c8d1c68584429fab7faf845a32d5195b6ac1lock-modules:trueexternal-egress:falsechutes-version:0.6.11.rc2image-id:cc46d5fd-9059-59f4-b208-83ff6ff11c31image-status:built and pushedimage-chutes-version:0.6.11.rc2
Moonshotai/Kimi K2.6 TEE (TEE) Intel TDX Attested E2EE Details
Workload identity not proven No expected workload measurement was verified.
Quote Intel TDX (DCAP QVL)
TCB Level status=UpToDate, advisories=[]
Report Data d0d43b3bb1dcac95edad70c1e8546fed0eab90ca61b9544829d0fa80463b049a95ff53a42698c4e87a2aa127c68a3996087634eb65ab37f94ee0551c4f0c3fb8
Signature ECDSA-P384 ✓
Confidential Channel E2EE to attested enclave key ✓
Signer Bound Yes ✓
Nonce Bound Yes ✓
registry.chutes.ai/chutes/vllm:nightly-2026031400-03df6abfe49f
Security Model Attested E2EE
What This Means Payloads are encrypted to an attested enclave key; gateway TLS termination is expected
Sold by Chutes
Workload operator Chutes (corroborated)
TEE platform Chutes (corroborated)
Route binding No request-bound receipt
E2EE Protocol ML-KEM-768 E2E
Signing Key ml-kem-768:f31be22a-574c-4296-9b4b-da3b0b61e10c
chute:moonshotai/Kimi-K2.6-TEEinstance:f31be22a-574c-4296-9b4b-da3b0b61e10ccertificate-present:truegpu-evidence-count:8revision:d9cb81bc88b9bd2dc89877599f23c614ded72b9clock-modules:trueexternal-egress:falsechutes-version:0.6.6image-id:5bbb13bc-c050-518d-bb55-79994b540ec2image-status:built and pushedimage-chutes-version:0.6.6
Qwen/Qwen3 235B A22B Thinking 2507 TEE (TEE) Details
Endpoint unavailable Fresh evidence could not be fetched in this run.
Check No public attestation endpoint
Qwen/Qwen3 32B TEE (TEE) Intel TDX Attested E2EE Details
Workload identity not proven No expected workload measurement was verified.
Quote Intel TDX (DCAP QVL)
TCB Level status=UpToDate, advisories=[]
Report Data a9c5ba02f1fe76adb1e072190867f72b8f0c87b91fa334e1b07c2c301c32ad8902d0026dd3f1e51515ca5bf85cfa2eac17f4bd2f3d0288d73a93a634aee8867a
Signature ECDSA-P384 ✓
Confidential Channel E2EE to attested enclave key ✓
Signer Bound Yes ✓
Nonce Bound Yes ✓
registry.chutes.ai/chutes/sglang:0.5.13-post1c
Security Model Attested E2EE
What This Means Payloads are encrypted to an attested enclave key; gateway TLS termination is expected
Sold by Chutes
Workload operator Chutes (corroborated)
TEE platform Chutes (corroborated)
Route binding No request-bound receipt
E2EE Protocol ML-KEM-768 E2E
Signing Key ml-kem-768:1d5fdd83-ab04-454e-a153-ed297a6acb16
chute:Qwen/Qwen3-32B-TEEinstance:1d5fdd83-ab04-454e-a153-ed297a6acb16certificate-present:truegpu-evidence-count:8revision:aa55da1ecc13d006e8b8e4f54579b1ea8c3db2dflock-modules:trueexternal-egress:falsechutes-version:0.6.11.rc2image-id:a3028618-6f8f-5afc-9a51-8eff25f2e5c8image-status:built and pushedimage-chutes-version:0.6.11.rc2
Qwen/Qwen3.5 397B A17B TEE (TEE) Intel TDX Attested E2EE Details
Workload identity not proven No expected workload measurement was verified.
Quote Intel TDX (DCAP QVL)
TCB Level status=UpToDate, advisories=[]
Report Data 8c6f7f2c593fa81d0398fcd5cb85179809b88a53d95abe70a5b5c7fed2dfb80f0c7428cec02f3359bae81630ea9ded77072976469ac93288a45deeda8f48366b
Signature ECDSA-P384 ✓
Confidential Channel E2EE to attested enclave key ✓
Signer Bound Yes ✓
Nonce Bound Yes ✓
registry.chutes.ai/chutes/sglang:0.5.13-post1b
Security Model Attested E2EE
What This Means Payloads are encrypted to an attested enclave key; gateway TLS termination is expected
Sold by Chutes
Workload operator Chutes (corroborated)
TEE platform Chutes (corroborated)
Route binding No request-bound receipt
E2EE Protocol ML-KEM-768 E2E
Signing Key ml-kem-768:d52b1448-74c8-46d0-84d6-35b1b6ed1313
chute:Qwen/Qwen3.5-397B-A17B-TEEinstance:d52b1448-74c8-46d0-84d6-35b1b6ed1313certificate-present:truegpu-evidence-count:8revision:9f1f3de9a3a48cfd340fd73ca98c02625b7afb3block-modules:trueexternal-egress:falsechutes-version:0.6.11.rc2image-id:cc46d5fd-9059-59f4-b208-83ff6ff11c31image-status:built and pushedimage-chutes-version:0.6.11.rc2
Qwen/Qwen3.6 27B TEE (TEE) Intel TDX Attested E2EE Details
Workload identity not proven No expected workload measurement was verified.
Quote Intel TDX (DCAP QVL)
TCB Level status=UpToDate, advisories=[]
Report Data c15eb6dadce29ba2c964887e714fb9c38263a1e3507a0a496c3a6e014812be193d52db5071df543ae1e178de6866ca978a2da4867299aa3417ccd3f66d12f1ae
Signature ECDSA-P384 ✓
Confidential Channel E2EE to attested enclave key ✓
Signer Bound Yes ✓
Nonce Bound Yes ✓
registry.chutes.ai/chutes/sglang:0.5.13-post1c
Security Model Attested E2EE
What This Means Payloads are encrypted to an attested enclave key; gateway TLS termination is expected
Sold by Chutes
Workload operator Chutes (corroborated)
TEE platform Chutes (corroborated)
Route binding No request-bound receipt
E2EE Protocol ML-KEM-768 E2E
Signing Key ml-kem-768:3b2a1555-6a60-4337-a4d7-3a7182e7cd2b
chute:Qwen/Qwen3.6-27B-TEEinstance:3b2a1555-6a60-4337-a4d7-3a7182e7cd2bcertificate-present:truegpu-evidence-count:1revision:e89b16ebf1988b3d6befa7de50abc2d76f26eb09lock-modules:trueexternal-egress:falsechutes-version:0.6.11.rc2image-id:a3028618-6f8f-5afc-9a51-8eff25f2e5c8image-status:built and pushedimage-chutes-version:0.6.11.rc2
Unsloth/Mistral Nemo Instruct 2407 TEE (TEE) Intel TDX Attested E2EE Details
Workload identity not proven No expected workload measurement was verified.
Quote Intel TDX (DCAP QVL)
TCB Level status=UpToDate, advisories=[]
Report Data 988d0aeb103bf76a838638435e1b89483453854e27214ba60b0bd1fc3163136f197c73ef93c2c44ae3adea2ba2828d1ef2adff541142d738fcf5800dc6f3f767
Signature ECDSA-P384 ✓
Confidential Channel E2EE to attested enclave key ✓
Signer Bound Yes ✓
Nonce Bound Yes ✓
registry.chutes.ai/chutes/sglang:nightly-2026050600-9bf2c6dee5f7
Security Model Attested E2EE
What This Means Payloads are encrypted to an attested enclave key; gateway TLS termination is expected
Sold by Chutes
Workload operator Chutes (corroborated)
TEE platform Chutes (corroborated)
Route binding No request-bound receipt
E2EE Protocol ML-KEM-768 E2E
Signing Key ml-kem-768:bac9b81f-c421-4aa4-8579-9d5659d3b418
chute:unsloth/Mistral-Nemo-Instruct-2407-TEEinstance:bac9b81f-c421-4aa4-8579-9d5659d3b418certificate-present:truegpu-evidence-count:1revision:e9976040f42d8a5590ed58cefe973061b3f973b5lock-modules:trueexternal-egress:falsechutes-version:0.6.8image-id:e8a097de-bebd-5dfe-b69f-532a6c06a57eimage-status:built and pushedimage-chutes-version:0.6.8
Zai Org/GLM 5 TEE (TEE) Intel TDX Attested E2EE Details
Workload identity not proven No expected workload measurement was verified.
Quote Intel TDX (DCAP QVL)
TCB Level status=UpToDate, advisories=[]
Report Data 75813af424e74bc1583433a755ff20337bbb2825acadc979d347d89937411cd7e947b8ef8407b8183bbfb8166ff7860d667d6af9e02b82344b9b2f233d5c0e8c
Signature ECDSA-P384 ✓
Confidential Channel E2EE to attested enclave key ✓
Signer Bound Yes ✓
Nonce Bound Yes ✓
registry.chutes.ai/chutes/sglang:nightly-2026050600-9bf2c6dee5f7
Security Model Attested E2EE
What This Means Payloads are encrypted to an attested enclave key; gateway TLS termination is expected
Sold by Chutes
Workload operator Chutes (corroborated)
TEE platform Chutes (corroborated)
Route binding No request-bound receipt
E2EE Protocol ML-KEM-768 E2E
Signing Key ml-kem-768:72219539-35f1-4b86-922e-4e41d21fa920
chute:zai-org/GLM-5-TEEinstance:72219539-35f1-4b86-922e-4e41d21fa920certificate-present:truegpu-evidence-count:8revision:949e09d70b611943740a3d79a0f46a63947498a6lock-modules:trueexternal-egress:falsechutes-version:0.6.8image-id:e8a097de-bebd-5dfe-b69f-532a6c06a57eimage-status:built and pushedimage-chutes-version:0.6.8
Zai Org/GLM 5.1 TEE (TEE) Intel TDX Attested E2EE Details
Workload identity not proven No expected workload measurement was verified.
Quote Intel TDX (DCAP QVL)
TCB Level status=UpToDate, advisories=[]
Report Data 453517bf06602e00df68e5a33c6fb9f236b438c3cd43f2f216f6c778879315d2d263d93702842d18255c044dd6ff078c6a5b93c75abf4d57bd1cec2eb12e1c15
Signature ECDSA-P384 ✓
Confidential Channel E2EE to attested enclave key ✓
Signer Bound Yes ✓
Nonce Bound Yes ✓
registry.chutes.ai/chutes/sglang:nightly-2026032100-6483b7da6ccd
Security Model Attested E2EE
What This Means Payloads are encrypted to an attested enclave key; gateway TLS termination is expected
Sold by Chutes
Workload operator Chutes (corroborated)
TEE platform Chutes (corroborated)
Route binding No request-bound receipt
E2EE Protocol ML-KEM-768 E2E
Signing Key ml-kem-768:e6e74419-622e-4f64-b7ab-1eb90756279a
chute:zai-org/GLM-5.1-TEEinstance:e6e74419-622e-4f64-b7ab-1eb90756279acertificate-present:truegpu-evidence-count:8revision:f396cf805182f4ca10fa675e1a99815b3ca384dblock-modules:trueexternal-egress:falsechutes-version:0.6.6image-id:ae476f71-ed8f-562e-b1af-49d49c948d6fimage-status:built and pushedimage-chutes-version:0.6.6
Zai Org/GLM 5.2 TEE (TEE) Intel TDX Attested E2EE Details
Workload identity not proven No expected workload measurement was verified.
Quote Intel TDX (DCAP QVL)
TCB Level status=UpToDate, advisories=[]
Report Data e89cb9d40db3b69eb92719f66045e1e5a537ac3d9633b10031a87217e9ca3757722be30e147f151cb2d5d406081b8b5cba67b176c241bb87f26a62bc79793114
Signature ECDSA-P384 ✓
Confidential Channel E2EE to attested enclave key ✓
Signer Bound Yes ✓
Nonce Bound Yes ✓
registry.chutes.ai/chutes/sglang:0.5.15-post1a
Security Model Attested E2EE
What This Means Payloads are encrypted to an attested enclave key; gateway TLS termination is expected
Sold by Chutes
Workload operator Chutes (corroborated)
TEE platform Chutes (corroborated)
Route binding No request-bound receipt
E2EE Protocol ML-KEM-768 E2E
Signing Key ml-kem-768:138e2dea-ebeb-4433-b1f8-d8bb2e6cec79
chute:zai-org/GLM-5.2-TEEinstance:138e2dea-ebeb-4433-b1f8-d8bb2e6cec79certificate-present:truegpu-evidence-count:8revision:aec724e8c7b8ee9db3b48c01c320f63f9cdaf8aalock-modules:trueexternal-egress:falsechutes-version:0.6.11.rc2image-id:e5589f58-64d3-51f6-8a3d-146b1cd77940image-status:built and pushedimage-chutes-version:0.6.11.rc2
Incomplete evidence Hardware and TCB passed, but one or more later evidence gates are not proven.
Hardware 1/1 good TCB policy 1/1 good Freshness 1/1 good Channel binding 1/1 good Workload identity 1 warning Source provenance 1 warning Request route 1 warning Availability 1/1 good
Workload identity not proven 1 Source provenance not proven 1 Request route not proven 1
Explicit trust failures At least one check has an explicit mismatch or policy rejection; other evidence layers may still have passed.
Hardware 5 bad TCB policy 5 bad Freshness 13 warning Channel binding Not shown Workload identity 29 warning Source provenance 29 warning Request route 29 warning Availability 5 warning
Hardware evidence failed 5 TCB policy failed 5 Workload identity not proven 24 Source provenance not proven 24
DeepSeek V3.2 (TEE) Intel TDX TEE-only Gateway Details
Workload identity not proven No expected workload measurement was verified.
Quote Intel TDX (DCAP QVL)
TCB Level status=UpToDate, advisories=[]
Report Data 79a5061efe5a46b0d1f33b11cf1c5adbedae6b79000000000000000000000000aa74e5e0050ac6368119d84a38aac7eb8b2b4badd531fd1e4552547bc8e9d2bf
Signature ECDSA-P384 ✓
Signer Bound Yes ✓
Nonce Bound Yes ✓
Enclave TLS Pin 993daa286650eedd76f6c7d11d6ddd9bb0bf4e160fd4ba2f146eba0f9ff06aa7 ✗
Security Model TEE-only Gateway
What This Means Model runs in TEE but gateway sees plaintext prompts
Sold by NanoGPT
Routed through Redpill (corroborated)
Route binding No request-bound receipt
Gemma 4 31B (TEE) Intel TDX TEE-only Gateway Details
Freshness not proven No verifier-owned challenge binding was exposed.
Quote Intel TDX (DCAP QVL)
TCB Level status=UpToDate, advisories=[]
Report Data 74088291c6a837ae70be1c0ea6b66de2a4038c79a936573d9de686f665c4218034dc63a6987d45129b17fc7a3e25d5c6d3bc71c9e7b0f12baf50cda7b06fed7a
Signature ECDSA-P384 ✓
Enclave TLS Pin 993daa286650eedd76f6c7d11d6ddd9bb0bf4e160fd4ba2f146eba0f9ff06aa7 ✗
Security Model TEE-only Gateway
What This Means Model runs in TEE but gateway sees plaintext prompts
Sold by NanoGPT
Workload operator Tinfoil (inferred)
TEE platform Tinfoil (inferred)
Route binding No request-bound receipt
GLM 5.1 (TEE) Intel TDX TEE-only Gateway Details
Workload identity not proven No expected workload measurement was verified.
Quote Intel TDX (DCAP QVL)
TCB Level status=UpToDate, advisories=[]
Report Data 79a5061efe5a46b0d1f33b11cf1c5adbedae6b7900000000000000000000000026ab976093d49be2daa1a05bf2c90ea9069ecd62245da6cfd4d366d05d2a689a
Signature ECDSA-P384 ✓
Signer Bound Yes ✓
Nonce Bound Yes ✓
Enclave TLS Pin 993daa286650eedd76f6c7d11d6ddd9bb0bf4e160fd4ba2f146eba0f9ff06aa7 ✗
Security Model TEE-only Gateway
What This Means Model runs in TEE but gateway sees plaintext prompts
Sold by NanoGPT
Routed through Redpill (corroborated)
Route binding No request-bound receipt
GPT-OSS 120B (TEE) Intel TDX TEE-only Gateway Details
Workload identity not proven No expected workload measurement was verified.
Quote Intel TDX (DCAP QVL)
TCB Level status=UpToDate, advisories=[]
Report Data 79a5061efe5a46b0d1f33b11cf1c5adbedae6b790000000000000000000000009bfc817661429c09fd49b0408361ebc7fc79771e3d66e56437cb571855d9b34e
Signature ECDSA-P384 ✓
Signer Bound Yes ✓
Nonce Bound Yes ✓
Enclave TLS Pin 993daa286650eedd76f6c7d11d6ddd9bb0bf4e160fd4ba2f146eba0f9ff06aa7 ✗
Security Model TEE-only Gateway
What This Means Model runs in TEE but gateway sees plaintext prompts
Sold by NanoGPT
Routed through Redpill (corroborated)
Route binding No request-bound receipt
Kimi K2.6 (TEE) Intel TDX TEE-only Gateway Details
Workload identity not proven No expected workload measurement was verified.
Quote Intel TDX (DCAP QVL)
TCB Level status=UpToDate, advisories=[]
Report Data 79a5061efe5a46b0d1f33b11cf1c5adbedae6b79000000000000000000000000c39c754672b5b88fc862b91700963f04bcb93f0b4c300c7bf11ad29d1cb64d51
Signature ECDSA-P384 ✓
Signer Bound Yes ✓
Nonce Bound Yes ✓
Enclave TLS Pin 993daa286650eedd76f6c7d11d6ddd9bb0bf4e160fd4ba2f146eba0f9ff06aa7 ✗
Security Model TEE-only Gateway
What This Means Model runs in TEE but gateway sees plaintext prompts
Sold by NanoGPT
Routed through Redpill (corroborated)
Route binding No request-bound receipt
Llama 3.3 70B (TEE) AMD SEV-SNP TEE-only Gateway Details
Freshness not proven No verifier-owned challenge binding was exposed.
Quote AMD SEV-SNP (VCEK)
Policy 0x30000
Report Data 281ad7bea31b1c428d5100ee142478e76ab48f091b84e4f9505df75b1cde68840e1d011d09c176637d27a2c2b62406d2d0795f88c0c452b4a9d561d3bbaaea3d
Signature ECDSA-P384 ✓
Enclave TLS Pin 993daa286650eedd76f6c7d11d6ddd9bb0bf4e160fd4ba2f146eba0f9ff06aa7 ✗
Security Model TEE-only Gateway
What This Means Model runs in TEE but gateway sees plaintext prompts
Sold by NanoGPT
Workload operator Tinfoil (inferred)
TEE platform Tinfoil (inferred)
Route binding No request-bound receipt
Qwen3.5 397B (TEE) Details
Hardware evidence failed Required hardware evidence was not verified.
Check No public attestation endpoint
TEE/deepseek V3.1 (TEE) Intel TDX TEE-only Gateway Details
Workload identity not proven No expected workload measurement was verified.
Quote Intel TDX (DCAP QVL)
TCB Level status=UpToDate, advisories=[]
Report Data 79a5061efe5a46b0d1f33b11cf1c5adbedae6b790000000000000000000000004dd1b4295d65463b1939593b10c2d781844e51edf39cc15783cf196f50c987cf
Signature ECDSA-P384 ✓
Signer Bound Yes ✓
Nonce Bound Yes ✓
Enclave TLS Pin 993daa286650eedd76f6c7d11d6ddd9bb0bf4e160fd4ba2f146eba0f9ff06aa7 ✗
Security Model TEE-only Gateway
What This Means Model runs in TEE but gateway sees plaintext prompts
Sold by NanoGPT
Routed through Redpill (corroborated)
Route binding No request-bound receipt
TEE/deepseek V4 Flash (TEE) Intel TDX TEE-only Gateway Details
Workload identity not proven No expected workload measurement was verified.
Quote Intel TDX (DCAP QVL)
TCB Level status=UpToDate, advisories=[]
Report Data 79a5061efe5a46b0d1f33b11cf1c5adbedae6b79000000000000000000000000eaabd7b7b8a379bfe6198c88ec6696972b38a66d3c9ff3aeedc9809b669c30af
Signature ECDSA-P384 ✓
Signer Bound Yes ✓
Nonce Bound Yes ✓
Enclave TLS Pin 993daa286650eedd76f6c7d11d6ddd9bb0bf4e160fd4ba2f146eba0f9ff06aa7 ✗
Security Model TEE-only Gateway
What This Means Model runs in TEE but gateway sees plaintext prompts
Sold by NanoGPT
Routed through Redpill (corroborated)
Route binding No request-bound receipt
TEE/gemma 3 27b It (TEE) Intel TDX TEE-only Gateway Details
Workload identity not proven No expected workload measurement was verified.
Quote Intel TDX (DCAP QVL)
TCB Level status=UpToDate, advisories=[]
Report Data 79a5061efe5a46b0d1f33b11cf1c5adbedae6b79000000000000000000000000584946d074f50558663e443c5d22e1fb3c716a8e664adbbb3e6b71fb2492849b
Signature ECDSA-P384 ✓
Signer Bound Yes ✓
Nonce Bound Yes ✓
Enclave TLS Pin 993daa286650eedd76f6c7d11d6ddd9bb0bf4e160fd4ba2f146eba0f9ff06aa7 ✗
Security Model TEE-only Gateway
What This Means Model runs in TEE but gateway sees plaintext prompts
Sold by NanoGPT
Routed through Redpill (corroborated)
Route binding No request-bound receipt
TEE/gemma 4 26b A4b Uncensored (TEE) Intel TDX TEE-only Gateway Details
Workload identity not proven No expected workload measurement was verified.
Quote Intel TDX (DCAP QVL)
TCB Level status=UpToDate, advisories=[]
Report Data 79a5061efe5a46b0d1f33b11cf1c5adbedae6b79000000000000000000000000c8baaf51ca67c30e7cbd93f4b17ecb4a1f93e2505374d3c863af4ce3f8f486af
Signature ECDSA-P384 ✓
Signer Bound Yes ✓
Nonce Bound Yes ✓
Enclave TLS Pin 993daa286650eedd76f6c7d11d6ddd9bb0bf4e160fd4ba2f146eba0f9ff06aa7 ✗
Security Model TEE-only Gateway
What This Means Model runs in TEE but gateway sees plaintext prompts
Sold by NanoGPT
Routed through Redpill (corroborated)
Route binding No request-bound receipt
TEE/gemma 4 31b It (TEE) Intel TDX TEE-only Gateway Details
Workload identity not proven No expected workload measurement was verified.
Quote Intel TDX (DCAP QVL)
TCB Level status=UpToDate, advisories=[]
Report Data 79a5061efe5a46b0d1f33b11cf1c5adbedae6b790000000000000000000000006d4cc2a60fb7e21fc5ab514ae0b02cf2480aa6c806f8f20169e23e27fea899f9
Signature ECDSA-P384 ✓
Signer Bound Yes ✓
Nonce Bound Yes ✓
Enclave TLS Pin 993daa286650eedd76f6c7d11d6ddd9bb0bf4e160fd4ba2f146eba0f9ff06aa7 ✗
Security Model TEE-only Gateway
What This Means Model runs in TEE but gateway sees plaintext prompts
Sold by NanoGPT
Routed through Redpill (corroborated)
Route binding No request-bound receipt
TEE/gemma4 31b:thinking (TEE) Intel TDX TEE-only Gateway Details
Freshness not proven No verifier-owned challenge binding was exposed.
Quote Intel TDX (DCAP QVL)
TCB Level status=UpToDate, advisories=[]
Report Data 74088291c6a837ae70be1c0ea6b66de2a4038c79a936573d9de686f665c4218034dc63a6987d45129b17fc7a3e25d5c6d3bc71c9e7b0f12baf50cda7b06fed7a
Signature ECDSA-P384 ✓
Enclave TLS Pin 993daa286650eedd76f6c7d11d6ddd9bb0bf4e160fd4ba2f146eba0f9ff06aa7 ✗
Security Model TEE-only Gateway
What This Means Model runs in TEE but gateway sees plaintext prompts
Sold by NanoGPT
Workload operator Tinfoil (inferred)
TEE platform Tinfoil (inferred)
Route binding No request-bound receipt
TEE/glm 4.7 (TEE) Intel TDX TEE-only Gateway Details
Workload identity not proven No expected workload measurement was verified.
Quote Intel TDX (DCAP QVL)
TCB Level status=UpToDate, advisories=[]
Report Data 79a5061efe5a46b0d1f33b11cf1c5adbedae6b79000000000000000000000000eecd47fe5e7498be413f395fd810b92af3675dfa0a330f00cc6e00dc0ac6fad0
Signature ECDSA-P384 ✓
Signer Bound Yes ✓
Nonce Bound Yes ✓
Enclave TLS Pin 993daa286650eedd76f6c7d11d6ddd9bb0bf4e160fd4ba2f146eba0f9ff06aa7 ✗
Security Model TEE-only Gateway
What This Means Model runs in TEE but gateway sees plaintext prompts
Sold by NanoGPT
Routed through Redpill (corroborated)
Route binding No request-bound receipt
TEE/glm 5 (TEE) Details
Hardware evidence failed Required hardware evidence was not verified.
Check No public attestation endpoint
TEE/glm 5.1 Thinking (TEE) Intel TDX TEE-only Gateway Details
Workload identity not proven No expected workload measurement was verified.
Quote Intel TDX (DCAP QVL)
TCB Level status=UpToDate, advisories=[]
Report Data 79a5061efe5a46b0d1f33b11cf1c5adbedae6b79000000000000000000000000909d8922a3e12257d0fc76ad71dfe68485b8b85e16bfe37cd3ed3ad0e45bae31
Signature ECDSA-P384 ✓
Signer Bound Yes ✓
Nonce Bound Yes ✓
Enclave TLS Pin 993daa286650eedd76f6c7d11d6ddd9bb0bf4e160fd4ba2f146eba0f9ff06aa7 ✗
Security Model TEE-only Gateway
What This Means Model runs in TEE but gateway sees plaintext prompts
Sold by NanoGPT
Routed through Redpill (corroborated)
Route binding No request-bound receipt
TEE/glm 5.2 (TEE) Intel TDX TEE-only Gateway Details
Workload identity not proven No expected workload measurement was verified.
Quote Intel TDX (DCAP QVL)
TCB Level status=UpToDate, advisories=[]
Report Data 79a5061efe5a46b0d1f33b11cf1c5adbedae6b790000000000000000000000007465a7e0136a88c37856c24c9eb4b4264bd45620303f3687b04bd0445138d5c7
Signature ECDSA-P384 ✓
Signer Bound Yes ✓
Nonce Bound Yes ✓
Enclave TLS Pin 993daa286650eedd76f6c7d11d6ddd9bb0bf4e160fd4ba2f146eba0f9ff06aa7 ✗
Security Model TEE-only Gateway
What This Means Model runs in TEE but gateway sees plaintext prompts
Sold by NanoGPT
Routed through Redpill (corroborated)
Route binding No request-bound receipt
TEE/glm 5.2:thinking (TEE) Intel TDX TEE-only Gateway Details
Workload identity not proven No expected workload measurement was verified.
Quote Intel TDX (DCAP QVL)
TCB Level status=UpToDate, advisories=[]
Report Data 79a5061efe5a46b0d1f33b11cf1c5adbedae6b79000000000000000000000000bf239f48c6e7cbc6e675bfb2ad27c86b07a72e3977d85ae3073c7529a470c62f
Signature ECDSA-P384 ✓
Signer Bound Yes ✓
Nonce Bound Yes ✓
Enclave TLS Pin 993daa286650eedd76f6c7d11d6ddd9bb0bf4e160fd4ba2f146eba0f9ff06aa7 ✗
Security Model TEE-only Gateway
What This Means Model runs in TEE but gateway sees plaintext prompts
Sold by NanoGPT
Routed through Redpill (corroborated)
Route binding No request-bound receipt
TEE/gpt Oss 20b (TEE) Intel TDX TEE-only Gateway Details
Workload identity not proven No expected workload measurement was verified.
Quote Intel TDX (DCAP QVL)
TCB Level status=UpToDate, advisories=[]
Report Data 79a5061efe5a46b0d1f33b11cf1c5adbedae6b790000000000000000000000004a93085a1ec4a9d0f9a9622d2b4691af3147229f8c06c9121aec76ced1495cf4
Signature ECDSA-P384 ✓
Signer Bound Yes ✓
Nonce Bound Yes ✓
Enclave TLS Pin 993daa286650eedd76f6c7d11d6ddd9bb0bf4e160fd4ba2f146eba0f9ff06aa7 ✗
Security Model TEE-only Gateway
What This Means Model runs in TEE but gateway sees plaintext prompts
Sold by NanoGPT
Routed through Redpill (corroborated)
Route binding No request-bound receipt
TEE/kimi K2.5 (TEE) Details
Hardware evidence failed Required hardware evidence was not verified.
Check No public attestation endpoint
TEE/kimi K2.5 Thinking (TEE) Details
Hardware evidence failed Required hardware evidence was not verified.
Check No public attestation endpoint
TEE/minimax M2.5 (TEE) Details
Hardware evidence failed Required hardware evidence was not verified.
Check No public attestation endpoint
TEE/qwen2.5 Vl 72b Instruct (TEE) Intel TDX TEE-only Gateway Details
Workload identity not proven No expected workload measurement was verified.
Quote Intel TDX (DCAP QVL)
TCB Level status=UpToDate, advisories=[]
Report Data 79a5061efe5a46b0d1f33b11cf1c5adbedae6b790000000000000000000000007a70648d5a765bf730d4bf41c1abec6667a4dd5a0d6e5b1130a3f8f74d6d17d4
Signature ECDSA-P384 ✓
Signer Bound Yes ✓
Nonce Bound Yes ✓
Enclave TLS Pin 993daa286650eedd76f6c7d11d6ddd9bb0bf4e160fd4ba2f146eba0f9ff06aa7 ✗
Security Model TEE-only Gateway
What This Means Model runs in TEE but gateway sees plaintext prompts
Sold by NanoGPT
Routed through Redpill (corroborated)
Route binding No request-bound receipt
TEE/qwen3 30b A3b Instruct 2507 (TEE) Intel TDX TEE-only Gateway Details
Workload identity not proven No expected workload measurement was verified.
Quote Intel TDX (DCAP QVL)
TCB Level status=UpToDate, advisories=[]
Report Data 79a5061efe5a46b0d1f33b11cf1c5adbedae6b79000000000000000000000000dc1e9d7d70041019dc0eceabc935351d9510cbbee9a7f599cb8b5c05ef81d745
Signature ECDSA-P384 ✓
Signer Bound Yes ✓
Nonce Bound Yes ✓
Enclave TLS Pin 993daa286650eedd76f6c7d11d6ddd9bb0bf4e160fd4ba2f146eba0f9ff06aa7 ✗
Security Model TEE-only Gateway
What This Means Model runs in TEE but gateway sees plaintext prompts
Sold by NanoGPT
Routed through Redpill (corroborated)
Route binding No request-bound receipt
TEE/qwen3.5 122b A10b (TEE) Details
Endpoint unavailable Fresh evidence could not be fetched in this run.
Check No public attestation endpoint
TEE/qwen3.5 27b (TEE) Details
Endpoint unavailable Fresh evidence could not be fetched in this run.
Check No public attestation endpoint
TEE/qwen3.6 27b (TEE) Details
Endpoint unavailable Fresh evidence could not be fetched in this run.
Check No public attestation endpoint
TEE/qwen3.6 35b A3b (TEE) Details
Endpoint unavailable Fresh evidence could not be fetched in this run.
Check No public attestation endpoint
TEE/qwen3.6 35b A3b Uncensored (TEE) Details
Endpoint unavailable Fresh evidence could not be fetched in this run.
Check No public attestation endpoint
Incomplete evidence Hardware and TCB passed, but one or more later evidence gates are not proven.
Hardware 7/7 good TCB policy 7/7 good Freshness 7/7 good Channel binding 7/7 good Workload identity 7/7 good Source provenance 7 warning Request route 7 warning Availability 7/7 good
Source provenance not proven 7 Request route not proven 7
Gemma 4 31B (TEE) Intel TDX Attested E2EE Details
Source provenance not proven Registry existence alone is not source provenance.
Quote Intel TDX (DCAP QVL)
TCB Level status=UpToDate, advisories=[]
Report Data 2ad96997ac5762e37f81b72c404c21f0d6baa53a9c6b8872113fb42716710b9b5ae8b328f27304ef9592cf69acb941f7a2624cdbe704d19f3dc5d5269e85cad1
Signature ECDSA-P384 ✓
Compose Hash Mismatch ✗
TCB Consistent sha256 match ✓
Registry digest Digest exists in registry ✓
Confidential Channel E2EE to attested enclave key ✓
Signer Bound Yes ✓
Nonce Bound Yes ✓
Last Deploy v0.0.322
Gateway TLS 0355dbe22c22a762cb063cfc3d7ebe775fe6ce0fa88aa583c2f3ed2b93a79de5 (external termination)
App dstack-nvidia-0.5.5
Images 6 containers
datadog/agent@sha256:5556fb80b952832719a76b016f905616c76ee0989a239c4680c6220148e865d6otel/opentelemetry-collector-contrib@sha256:85ac41c2db88d0df9bd6145e608a3cb023f5d8443868adbfbbf66efb51087917certbot/dns-cloudflare@sha256:742dbd2e61c8709b930712c38958386c3cb3928e09eeb1f1e490600c127e2edbcertbot/dns-cloudflare@sha256:742dbd2e61c8709b930712c38958386c3cb3928e09eeb1f1e490600c127e2edbnearaidev/compose-manager@sha256:b487f39160e9a53c3d98943a9c709d28e12babef75e0bb5a6cd5692abc8b2db6nearaidev/compose-manager-launcher@sha256:78afb82330137c2fd90a9c8c6e452f8f178c15d863f87c079a11c13e92216e00
RTMR0 bc122d143ab768565ba5c3774ff5f03a63c89a4df7c1f5ea38d3bd173409d14f8cbdcc36d40e703cccb996a9d9687590
OS Image 9b69bb1698bacbb6985409a2c272bcb892e09cdcea63d5399c6768b67d3ff677
Security Model Attested E2EE
What This Means Payloads are encrypted to an attested enclave key; gateway TLS termination is expected
Sold by NEAR AI
TEE platform Phala/dstack (corroborated)
Route binding No request-bound receipt
E2EE Protocol ed25519
Signing Key 2ad96997ac5762e37f81b72c404c21f0d6baa53a9c6b8872113fb42716710b9b
GLM 5.1 (TEE) Intel TDX Attested E2EE Details
Source provenance not proven Registry existence alone is not source provenance.
Quote Intel TDX (DCAP QVL)
TCB Level status=UpToDate, advisories=[]
Report Data 40ef1aadbb12f26cf4c2d499b9e7a7b043da4388200715abed573fa135a561bb383fad85658673cf6ed7086db99f808b9f0e1384b147d89c5b16a3da3b846096
Signature ECDSA-P384 ✓
Compose Hash Mismatch ✗
TCB Consistent sha256 match ✓
Registry digest Digest exists in registry ✓
Confidential Channel E2EE to attested enclave key ✓
Signer Bound Yes ✓
Nonce Bound Yes ✓
Gateway TLS 0355dbe22c22a762cb063cfc3d7ebe775fe6ce0fa88aa583c2f3ed2b93a79de5 (external termination)
App dstack-nvidia-0.5.5
Images 6 containers
datadog/agent@sha256:5556fb80b952832719a76b016f905616c76ee0989a239c4680c6220148e865d6otel/opentelemetry-collector-contrib@sha256:85ac41c2db88d0df9bd6145e608a3cb023f5d8443868adbfbbf66efb51087917certbot/dns-cloudflare@sha256:742dbd2e61c8709b930712c38958386c3cb3928e09eeb1f1e490600c127e2edbcertbot/dns-cloudflare@sha256:742dbd2e61c8709b930712c38958386c3cb3928e09eeb1f1e490600c127e2edbnearaidev/compose-manager@sha256:b487f39160e9a53c3d98943a9c709d28e12babef75e0bb5a6cd5692abc8b2db6nearaidev/compose-manager-launcher@sha256:78afb82330137c2fd90a9c8c6e452f8f178c15d863f87c079a11c13e92216e00
RTMR0 bc122d143ab768565ba5c3774ff5f03a63c89a4df7c1f5ea38d3bd173409d14f8cbdcc36d40e703cccb996a9d9687590
OS Image 9b69bb1698bacbb6985409a2c272bcb892e09cdcea63d5399c6768b67d3ff677
Security Model Attested E2EE
What This Means Payloads are encrypted to an attested enclave key; gateway TLS termination is expected
Sold by NEAR AI
TEE platform Phala/dstack (corroborated)
Route binding No request-bound receipt
E2EE Protocol ed25519
Signing Key 40ef1aadbb12f26cf4c2d499b9e7a7b043da4388200715abed573fa135a561bb
GPT-OSS 120B (TEE) Intel TDX Attested E2EE Details
Source provenance not proven Registry existence alone is not source provenance.
Quote Intel TDX (DCAP QVL)
TCB Level status=UpToDate, advisories=[]
Report Data 21189bb96e2e0ff7598bd618bed473045cd6da886ddc844dc23f30bd2bfdb62d4e8c6a0d25e36b7782d3160b94354909cb5c899fd408018f47beff6b557af991
Signature ECDSA-P384 ✓
Compose Hash Mismatch ✗
TCB Consistent sha256 match ✓
Registry digest Digest exists in registry ✓
Confidential Channel E2EE to attested enclave key ✓
Signer Bound Yes ✓
Nonce Bound Yes ✓
Last Deploy v0.0.295
Gateway TLS 0355dbe22c22a762cb063cfc3d7ebe775fe6ce0fa88aa583c2f3ed2b93a79de5 (external termination)
App dstack-nvidia-0.5.5
Images 6 containers
datadog/agent@sha256:5556fb80b952832719a76b016f905616c76ee0989a239c4680c6220148e865d6otel/opentelemetry-collector-contrib@sha256:85ac41c2db88d0df9bd6145e608a3cb023f5d8443868adbfbbf66efb51087917certbot/dns-cloudflare@sha256:742dbd2e61c8709b930712c38958386c3cb3928e09eeb1f1e490600c127e2edbcertbot/dns-cloudflare@sha256:742dbd2e61c8709b930712c38958386c3cb3928e09eeb1f1e490600c127e2edbnearaidev/compose-manager@sha256:5165400d9eb43ab5da36986a85de0ba55f3fb4d05211c4397ecc4bde3ef0113bnearaidev/compose-manager-launcher@sha256:d652f92b64f57ef8aa086bd77a4cf932c1976965b3cea2814a7ee82fe73aa993
RTMR0 bc122d143ab768565ba5c3774ff5f03a63c89a4df7c1f5ea38d3bd173409d14f8cbdcc36d40e703cccb996a9d9687590
OS Image 9b69bb1698bacbb6985409a2c272bcb892e09cdcea63d5399c6768b67d3ff677
Security Model Attested E2EE
What This Means Payloads are encrypted to an attested enclave key; gateway TLS termination is expected
Sold by NEAR AI
TEE platform Phala/dstack (corroborated)
Route binding No request-bound receipt
E2EE Protocol ed25519
Signing Key 21189bb96e2e0ff7598bd618bed473045cd6da886ddc844dc23f30bd2bfdb62d
Qwen 3.5 122B (TEE) Intel TDX Attested E2EE Details
Source provenance not proven Registry existence alone is not source provenance.
Quote Intel TDX (DCAP QVL)
TCB Level status=UpToDate, advisories=[]
Report Data d0aa20bcf567cc0c7c914608967dbd4c7a17e10b600802d45923434ce323f82353e315f088a8f0a962bd0a04db4ce78450a939de7274f899940e9c3817c4a60b
Signature ECDSA-P384 ✓
Compose Hash Mismatch ✗
TCB Consistent sha256 match ✓
Registry digest Digest exists in registry ✓
Confidential Channel E2EE to attested enclave key ✓
Signer Bound Yes ✓
Nonce Bound Yes ✓
Last Deploy v0.0.322
Gateway TLS 0355dbe22c22a762cb063cfc3d7ebe775fe6ce0fa88aa583c2f3ed2b93a79de5 (external termination)
App dstack-nvidia-0.5.5
Images 6 containers
datadog/agent@sha256:5556fb80b952832719a76b016f905616c76ee0989a239c4680c6220148e865d6otel/opentelemetry-collector-contrib@sha256:85ac41c2db88d0df9bd6145e608a3cb023f5d8443868adbfbbf66efb51087917certbot/dns-cloudflare@sha256:742dbd2e61c8709b930712c38958386c3cb3928e09eeb1f1e490600c127e2edbcertbot/dns-cloudflare@sha256:742dbd2e61c8709b930712c38958386c3cb3928e09eeb1f1e490600c127e2edbnearaidev/compose-manager@sha256:b487f39160e9a53c3d98943a9c709d28e12babef75e0bb5a6cd5692abc8b2db6nearaidev/compose-manager-launcher@sha256:78afb82330137c2fd90a9c8c6e452f8f178c15d863f87c079a11c13e92216e00
RTMR0 bc122d143ab768565ba5c3774ff5f03a63c89a4df7c1f5ea38d3bd173409d14f8cbdcc36d40e703cccb996a9d9687590
OS Image 9b69bb1698bacbb6985409a2c272bcb892e09cdcea63d5399c6768b67d3ff677
Security Model Attested E2EE
What This Means Payloads are encrypted to an attested enclave key; gateway TLS termination is expected
Sold by NEAR AI
TEE platform Phala/dstack (corroborated)
Route binding No request-bound receipt
E2EE Protocol ed25519
Signing Key d0aa20bcf567cc0c7c914608967dbd4c7a17e10b600802d45923434ce323f823
Qwen/Qwen3.6 27B FP8 (TEE) Intel TDX Attested E2EE Details
Source provenance not proven Registry existence alone is not source provenance.
Quote Intel TDX (DCAP QVL)
TCB Level status=UpToDate, advisories=[]
Report Data 052233b7fb537337f2f4f9c8a239297f8a5d8876b2ccce49dfa684bb53361c245de3b0f99b4e26127c3d6243e8558aa6b407ef1b3005b67b6962f52a5012f43a
Signature ECDSA-P384 ✓
Compose Hash Mismatch ✗
TCB Consistent sha256 match ✓
Registry digest Digest exists in registry ✓
Confidential Channel E2EE to attested enclave key ✓
Signer Bound Yes ✓
Nonce Bound Yes ✓
Last Deploy v0.0.322
Gateway TLS 0355dbe22c22a762cb063cfc3d7ebe775fe6ce0fa88aa583c2f3ed2b93a79de5 (external termination)
App dstack-nvidia-0.5.5
Images 6 containers
datadog/agent@sha256:5556fb80b952832719a76b016f905616c76ee0989a239c4680c6220148e865d6otel/opentelemetry-collector-contrib@sha256:85ac41c2db88d0df9bd6145e608a3cb023f5d8443868adbfbbf66efb51087917certbot/dns-cloudflare@sha256:742dbd2e61c8709b930712c38958386c3cb3928e09eeb1f1e490600c127e2edbcertbot/dns-cloudflare@sha256:742dbd2e61c8709b930712c38958386c3cb3928e09eeb1f1e490600c127e2edbnearaidev/compose-manager@sha256:b487f39160e9a53c3d98943a9c709d28e12babef75e0bb5a6cd5692abc8b2db6nearaidev/compose-manager-launcher@sha256:78afb82330137c2fd90a9c8c6e452f8f178c15d863f87c079a11c13e92216e00
RTMR0 bc122d143ab768565ba5c3774ff5f03a63c89a4df7c1f5ea38d3bd173409d14f8cbdcc36d40e703cccb996a9d9687590
OS Image 9b69bb1698bacbb6985409a2c272bcb892e09cdcea63d5399c6768b67d3ff677
Security Model Attested E2EE
What This Means Payloads are encrypted to an attested enclave key; gateway TLS termination is expected
Sold by NEAR AI
TEE platform Phala/dstack (corroborated)
Route binding No request-bound receipt
E2EE Protocol ed25519
Signing Key 052233b7fb537337f2f4f9c8a239297f8a5d8876b2ccce49dfa684bb53361c24
Qwen3-VL 30B (TEE) Intel TDX Attested E2EE Details
Source provenance not proven Registry existence alone is not source provenance.
Quote Intel TDX (DCAP QVL)
TCB Level status=UpToDate, advisories=[]
Report Data 31ddf80d420921b91ff4a41d933a15b46a3840e80031804c1c5ba4f25c4e88cc45eaf1ecae6272915a0bf2cd0253d799c55ecf7d41a1aff3c8c9a3652fd2ed42
Signature ECDSA-P384 ✓
Compose Hash Mismatch ✗
TCB Consistent sha256 match ✓
Registry digest Digest exists in registry ✓
Confidential Channel E2EE to attested enclave key ✓
Signer Bound Yes ✓
Nonce Bound Yes ✓
Last Deploy v0.0.295
Gateway TLS 0355dbe22c22a762cb063cfc3d7ebe775fe6ce0fa88aa583c2f3ed2b93a79de5 (external termination)
App dstack-nvidia-0.5.5
Images 6 containers
datadog/agent@sha256:5556fb80b952832719a76b016f905616c76ee0989a239c4680c6220148e865d6otel/opentelemetry-collector-contrib@sha256:85ac41c2db88d0df9bd6145e608a3cb023f5d8443868adbfbbf66efb51087917certbot/dns-cloudflare@sha256:742dbd2e61c8709b930712c38958386c3cb3928e09eeb1f1e490600c127e2edbcertbot/dns-cloudflare@sha256:742dbd2e61c8709b930712c38958386c3cb3928e09eeb1f1e490600c127e2edbnearaidev/compose-manager@sha256:5165400d9eb43ab5da36986a85de0ba55f3fb4d05211c4397ecc4bde3ef0113bnearaidev/compose-manager-launcher@sha256:d652f92b64f57ef8aa086bd77a4cf932c1976965b3cea2814a7ee82fe73aa993
RTMR0 bc122d143ab768565ba5c3774ff5f03a63c89a4df7c1f5ea38d3bd173409d14f8cbdcc36d40e703cccb996a9d9687590
OS Image 9b69bb1698bacbb6985409a2c272bcb892e09cdcea63d5399c6768b67d3ff677
Security Model Attested E2EE
What This Means Payloads are encrypted to an attested enclave key; gateway TLS termination is expected
Sold by NEAR AI
TEE platform Phala/dstack (corroborated)
Route binding No request-bound receipt
E2EE Protocol ed25519
Signing Key 31ddf80d420921b91ff4a41d933a15b46a3840e80031804c1c5ba4f25c4e88cc
Qwen3.6 35B (TEE) Intel TDX Attested E2EE Details
Source provenance not proven Registry existence alone is not source provenance.
Quote Intel TDX (DCAP QVL)
TCB Level status=UpToDate, advisories=[]
Report Data aba45f0b8f90869baab26db02e8b01354bb8f8730769c60650cb7a635da602d4363daa1d52c5612798d35b25c05a1ad041af5b593b85bf6ec93f8f9edd7b1fa5
Signature ECDSA-P384 ✓
Compose Hash Mismatch ✗
TCB Consistent sha256 match ✓
Registry digest Digest exists in registry ✓
Confidential Channel E2EE to attested enclave key ✓
Signer Bound Yes ✓
Nonce Bound Yes ✓
Last Deploy v0.0.295
Gateway TLS 0355dbe22c22a762cb063cfc3d7ebe775fe6ce0fa88aa583c2f3ed2b93a79de5 (external termination)
App dstack-nvidia-0.5.5
Images 6 containers
datadog/agent@sha256:5556fb80b952832719a76b016f905616c76ee0989a239c4680c6220148e865d6otel/opentelemetry-collector-contrib@sha256:85ac41c2db88d0df9bd6145e608a3cb023f5d8443868adbfbbf66efb51087917certbot/dns-cloudflare@sha256:742dbd2e61c8709b930712c38958386c3cb3928e09eeb1f1e490600c127e2edbcertbot/dns-cloudflare@sha256:742dbd2e61c8709b930712c38958386c3cb3928e09eeb1f1e490600c127e2edbnearaidev/compose-manager@sha256:5165400d9eb43ab5da36986a85de0ba55f3fb4d05211c4397ecc4bde3ef0113bnearaidev/compose-manager-launcher@sha256:d652f92b64f57ef8aa086bd77a4cf932c1976965b3cea2814a7ee82fe73aa993
RTMR0 bc122d143ab768565ba5c3774ff5f03a63c89a4df7c1f5ea38d3bd173409d14f8cbdcc36d40e703cccb996a9d9687590
OS Image 9b69bb1698bacbb6985409a2c272bcb892e09cdcea63d5399c6768b67d3ff677
Security Model Attested E2EE
What This Means Payloads are encrypted to an attested enclave key; gateway TLS termination is expected
Sold by NEAR AI
TEE platform Phala/dstack (corroborated)
Route binding No request-bound receipt
E2EE Protocol ed25519
Signing Key aba45f0b8f90869baab26db02e8b01354bb8f8730769c60650cb7a635da602d4
Incomplete evidence Hardware and TCB passed, but one or more later evidence gates are not proven.
Hardware 4 warning TCB policy 4 warning Freshness 6 warning Channel binding 4 warning Workload identity 5 warning Source provenance 5 warning Request route 6 warning Availability 4 warning
Endpoint unavailable 4 Freshness not proven 2 Request route not proven 2 Workload identity not proven 1
Gemma 4 31B (TEE) Details
Endpoint unavailable Fresh evidence could not be fetched in this run.
Check No public attestation endpoint
GLM 5.2 (TEE) AMD SEV-SNP Attested E2EE Details
Freshness not proven No verifier-owned challenge binding was exposed.
Quote AMD SEV-SNP (VCEK)
Policy 0x30000
Report Data d38fa693cea0ffde1161a1535b8a26c721d784cdf18be9bdde34af949065fbefaab09e9e9721a30afcaac40cbd76ee049f4ded4042db1eb0b33c66bdefeb1803
Signature ECDSA-P384 ✓
Registry digest Digest exists in registry ✓
Sigstore Bundle Crypto Verified ✓
Measurements Match ✓
Release v0.0.127
Sigstore Repo tinfoilsh/confidential-model-router
Confidential Channel E2EE to attested enclave key ✓
Signer Bound Yes ✓
ghcr.io/tinfoilsh/confidential-model-router@sha256:21b8f197b499b67664e6b764df5e14f87b0ac94156f587f40ce0707853c61fec
Security Model Attested E2EE
What This Means Payloads are encrypted to an attested enclave key; gateway TLS termination is expected
Sold by PPQ.AI
Routed through Tinfoil (corroborated)
Workload operator Tinfoil (declared)
Route binding No request-bound receipt
E2EE Protocol hpke
Signing Key aab09e9e9721a30afcaac40cbd76ee049f4ded4042db1eb0b33c66bdefeb1803
GPT-OSS 120B (TEE) Details
Endpoint unavailable Fresh evidence could not be fetched in this run.
Check No public attestation endpoint
Kimi K2.6 (TEE) Details
Endpoint unavailable Fresh evidence could not be fetched in this run.
Check No public attestation endpoint
Llama 3.3 70B (TEE) AMD SEV-SNP Attested E2EE Details
Freshness not proven No verifier-owned challenge binding was exposed.
Quote AMD SEV-SNP (VCEK)
Policy 0x30000
Report Data d38fa693cea0ffde1161a1535b8a26c721d784cdf18be9bdde34af949065fbefaab09e9e9721a30afcaac40cbd76ee049f4ded4042db1eb0b33c66bdefeb1803
Signature ECDSA-P384 ✓
Registry digest Digest exists in registry ✓
Sigstore Bundle Crypto Verified ✓
Measurements Match ✓
Release v0.0.127
Sigstore Repo tinfoilsh/confidential-model-router
Confidential Channel E2EE to attested enclave key ✓
Signer Bound Yes ✓
ghcr.io/tinfoilsh/confidential-model-router@sha256:21b8f197b499b67664e6b764df5e14f87b0ac94156f587f40ce0707853c61fecvllm/vllm-openai:v0.22.0@sha256:0fec7ec5f3e6bc168e54899935fb0557da908a4832a1dbc88e2debcf2f889416
Security Model Attested E2EE
What This Means Payloads are encrypted to an attested enclave key; gateway TLS termination is expected
Sold by PPQ.AI
Routed through Tinfoil (corroborated)
Workload operator Tinfoil (corroborated)
Route binding No request-bound receipt
E2EE Protocol hpke
Signing Key aab09e9e9721a30afcaac40cbd76ee049f4ded4042db1eb0b33c66bdefeb1803
Qwen3-VL 30B (TEE) Details
Endpoint unavailable Fresh evidence could not be fetched in this run.
Check No public attestation endpoint
Incomplete evidence Hardware and TCB passed, but one or more later evidence gates are not proven.
Hardware 8/8 good TCB policy 8/8 good Freshness 8 warning Channel binding 8 warning Workload identity 8/8 good Source provenance 8 warning Request route 8 warning Availability 8/8 good
Freshness not proven 8 Channel binding not proven 8 Source provenance not proven 8 Request route not proven 8
Gemma 4 31b TEE-only Gateway Details
Freshness not proven No verifier-owned challenge binding was exposed.
Check No public attestation endpoint
Gemma Latest TEE-only Gateway Details
Freshness not proven No verifier-owned challenge binding was exposed.
Check No public attestation endpoint
Gpt Oss 120b TEE-only Gateway Details
Freshness not proven No verifier-owned challenge binding was exposed.
Check No public attestation endpoint
Gpt Oss Latest TEE-only Gateway Details
Freshness not proven No verifier-owned challenge binding was exposed.
Check No public attestation endpoint
Kimi K2.6 TEE-only Gateway Details
Freshness not proven No verifier-owned challenge binding was exposed.
Check No public attestation endpoint
Qwen3 Embedding 4b TEE-only Gateway Details
Freshness not proven No verifier-owned challenge binding was exposed.
Check No public attestation endpoint
Voxtral Mini 3b TEE-only Gateway Details
Freshness not proven No verifier-owned challenge binding was exposed.
Check No public attestation endpoint
Whisper Large V3 TEE-only Gateway Details
Freshness not proven No verifier-owned challenge binding was exposed.
Check No public attestation endpoint
Explicit trust failures At least one check has an explicit mismatch or policy rejection; other evidence layers may still have passed.
Hardware 3/3 good TCB policy 3/3 good Freshness 3/3 good Channel binding 3/3 good Workload identity 3 bad Source provenance 3 warning Request route 3 warning Availability 3/3 good
Workload identity failed 3 Source provenance not proven 3 Request route not proven 3
Phala/gemma 4 26b A4b Uncensored (TEE) Intel TDX Details
Workload identity failed Measured workload evidence did not match the expectation.
Quote Intel TDX (DCAP QVL)
TCB Level status=UpToDate, advisories=[]
Report Data 79a5061efe5a46b0d1f33b11cf1c5adbedae6b790000000000000000000000009e49cd08024ec94c912fc337827952fb2e6253e79bae00280e18341b2c251a83
Signature ECDSA-P384 ✓
Compose Hash Mismatch ✗
Signer Bound Yes ✓
Nonce Bound Yes ✓
Enclave TLS Pin c2ebede7c2c632381123e3193b01f5f3fa45cc6c6327b2d0536749348ceeb408 ✗
Security Model No Verified Channel
What This Means No hardware attestation verified
Sold by Redpill
Route binding No request-bound receipt
E2EE Protocol ecdsa
Signing Key 04943cea0b4babf60f6e2031e9a00866a37c4ae696fb45895b3a9b38ab8cbb898f42c85b704aceaa0a396cf26f7fdf79d83205be7e11d3a5d70419a68277158c3d
Phala/qwen3.6 35b A3b Uncensored (TEE) Intel TDX Details
Workload identity failed Measured workload evidence did not match the expectation.
Quote Intel TDX (DCAP QVL)
TCB Level status=UpToDate, advisories=[]
Report Data 79a5061efe5a46b0d1f33b11cf1c5adbedae6b7900000000000000000000000017ca579b08095ae7266fae167fb2c8adf22632543959d9b7d092705d52b62a7b
Signature ECDSA-P384 ✓
Compose Hash Mismatch ✗
Signer Bound Yes ✓
Nonce Bound Yes ✓
Enclave TLS Pin c2ebede7c2c632381123e3193b01f5f3fa45cc6c6327b2d0536749348ceeb408 ✗
Security Model No Verified Channel
What This Means No hardware attestation verified
Sold by Redpill
Route binding No request-bound receipt
E2EE Protocol ecdsa
Signing Key 04943cea0b4babf60f6e2031e9a00866a37c4ae696fb45895b3a9b38ab8cbb898f42c85b704aceaa0a396cf26f7fdf79d83205be7e11d3a5d70419a68277158c3d
Phala/uncensored 24b (TEE) Intel TDX Details
Workload identity failed Measured workload evidence did not match the expectation.
Quote Intel TDX (DCAP QVL)
TCB Level status=UpToDate, advisories=[]
Report Data 79a5061efe5a46b0d1f33b11cf1c5adbedae6b7900000000000000000000000057a56d8535b2960a1d6a22d6311363e883b6560a43beda575b72cf7957b0c059
Signature ECDSA-P384 ✓
Compose Hash Mismatch ✗
Signer Bound Yes ✓
Nonce Bound Yes ✓
Enclave TLS Pin c2ebede7c2c632381123e3193b01f5f3fa45cc6c6327b2d0536749348ceeb408 ✗
Security Model No Verified Channel
What This Means No hardware attestation verified
Sold by Redpill
Route binding No request-bound receipt
E2EE Protocol ecdsa
Signing Key 04943cea0b4babf60f6e2031e9a00866a37c4ae696fb45895b3a9b38ab8cbb898f42c85b704aceaa0a396cf26f7fdf79d83205be7e11d3a5d70419a68277158c3d
Availability issue The verifier could not fetch fresh evidence for every check in this run.
Hardware 3 warning TCB policy 3 warning Freshness 3 warning Channel binding 3 warning Workload identity 3 warning Source provenance 3 warning Request route 3 warning Availability 3 warning
Endpoint unavailable 3
Gemma 4 31B Details
Endpoint unavailable Fresh evidence could not be fetched in this run.
Check No public attestation endpoint
GPT-OSS 120B Details
Endpoint unavailable Fresh evidence could not be fetched in this run.
Check No public attestation endpoint
GPT-OSS Safeguard 120B AMD SEV-SNP TEE-Terminated TLS Details
Verified All required verifier gates passed for this check.
Quote AMD SEV-SNP (VCEK)
Policy 0x30000
Report Data 8dff9ead5e54f3905e0325f557ea51f2a7daf89f989e424b73919669373d4a1e6668665ddbf0541157ffb70e94f438ba3d34a6551112ee09e42393b9450cb031
Signature ECDSA-P384 ✓
Registry digest Digest exists in registry ✓
Sigstore Bundle Crypto Verified ✓
Measurements Match ✓
Release v0.0.8
Sigstore Repo tinfoilsh/confidential-gpt-oss-safeguard-120b
Enclave TLS Pin 8dff9ead5e54f3905e0325f557ea51f2a7daf89f989e424b73919669373d4a1e ✓
vllm/vllm-openai:v0.22.0@sha256:0fec7ec5f3e6bc168e54899935fb0557da908a4832a1dbc88e2debcf2f889416
Security Model TEE-Terminated TLS
What This Means TLS terminates inside the attested TEE; certificate key is bound to report_data
Sold by Tinfoil
Routed through Tinfoil (verified)
Workload operator Tinfoil (verified)
TEE platform Tinfoil (verified)
Route binding Request-bound receipt verified
Kimi K2.6 Details
Endpoint unavailable Fresh evidence could not be fetched in this run.
Check No public attestation endpoint
Llama 3.3 70B AMD SEV-SNP TEE-Terminated TLS Details
Verified All required verifier gates passed for this check.
Quote AMD SEV-SNP (VCEK)
Policy 0x30000
Report Data 281ad7bea31b1c428d5100ee142478e76ab48f091b84e4f9505df75b1cde68840e1d011d09c176637d27a2c2b62406d2d0795f88c0c452b4a9d561d3bbaaea3d
Signature ECDSA-P384 ✓
Registry digest Digest exists in registry ✓
Sigstore Bundle Crypto Verified ✓
Measurements Match ✓
Release v0.0.25
Sigstore Repo tinfoilsh/confidential-llama3-3-70b
Enclave TLS Pin 281ad7bea31b1c428d5100ee142478e76ab48f091b84e4f9505df75b1cde6884 ✓
vllm/vllm-openai:v0.22.0@sha256:0fec7ec5f3e6bc168e54899935fb0557da908a4832a1dbc88e2debcf2f889416
Security Model TEE-Terminated TLS
What This Means TLS terminates inside the attested TEE; certificate key is bound to report_data
Sold by Tinfoil
Routed through Tinfoil (verified)
Workload operator Tinfoil (verified)
TEE platform Tinfoil (verified)
Route binding Request-bound receipt verified
Router AMD SEV-SNP TEE-only Gateway Details
Verified All required verifier gates passed for this check.
Quote AMD SEV-SNP (VCEK)
Policy 0x30000
Report Data d38fa693cea0ffde1161a1535b8a26c721d784cdf18be9bdde34af949065fbefaab09e9e9721a30afcaac40cbd76ee049f4ded4042db1eb0b33c66bdefeb1803
Signature ECDSA-P384 ✓
Registry digest Digest exists in registry ✓
Sigstore Bundle Crypto Verified ✓
Measurements Match ✓
Release v0.0.127
Sigstore Repo tinfoilsh/confidential-model-router
Enclave TLS Pin 1c53d211618948cbdde5cf3d8e3c3fa70f78624e57f90190abe4ef804270ebcb ✗
Version v0.0.127
ghcr.io/tinfoilsh/confidential-model-router@sha256:21b8f197b499b67664e6b764df5e14f87b0ac94156f587f40ce0707853c61fec
Security Model TEE-only Gateway
What This Means Model runs in TEE but gateway sees plaintext prompts
Sold by Tinfoil
Routed through Tinfoil (verified)
Workload operator Tinfoil (verified)
TEE platform Tinfoil (verified)
Route binding No request-bound receipt
Explicit trust failures At least one check has an explicit mismatch or policy rejection; other evidence layers may still have passed.
Hardware 16/16 good TCB policy 16/16 good Freshness 16/16 good Channel binding 16/16 good Workload identity 11 bad Source provenance 16 warning Request route 16 warning Availability 16/16 good
Workload identity failed 11 Source provenance not proven 16 Request route not proven 16
E2ee Deepseek V4 Flash (TEE) Intel TDX Attested E2EE Details
Source provenance not proven Registry existence alone is not source provenance.
Quote Intel TDX (DCAP QVL)
TCB Level status=UpToDate, advisories=[]
Report Data c5f6bf2f1bc666569157ec1bb4066cdaf48d026c000000000000000000000000dec4b06f6137c53348843ca3f22e3def105d6887161131e3b7887310e1906dd4
Signature ECDSA-P384 ✓
Compose Hash Mismatch ✗
TCB Consistent sha256 match ✓
Registry digest Digest exists in registry ✓
Confidential Channel E2EE to attested enclave key ✓
Signer Bound Yes ✓
Nonce Bound Yes ✓
Last Deploy v0.0.322
Gateway TLS 08b9c0d165fbf3433870dc1c22a118da08eed65ae58aa4950fdf8dd21e98e70b (external termination)
App dstack-nvidia-0.5.5
Images 6 containers
datadog/agent@sha256:5556fb80b952832719a76b016f905616c76ee0989a239c4680c6220148e865d6otel/opentelemetry-collector-contrib@sha256:85ac41c2db88d0df9bd6145e608a3cb023f5d8443868adbfbbf66efb51087917certbot/dns-cloudflare@sha256:742dbd2e61c8709b930712c38958386c3cb3928e09eeb1f1e490600c127e2edbcertbot/dns-cloudflare@sha256:742dbd2e61c8709b930712c38958386c3cb3928e09eeb1f1e490600c127e2edbnearaidev/compose-manager@sha256:b487f39160e9a53c3d98943a9c709d28e12babef75e0bb5a6cd5692abc8b2db6nearaidev/compose-manager-launcher@sha256:78afb82330137c2fd90a9c8c6e452f8f178c15d863f87c079a11c13e92216e00
RTMR0 bc122d143ab768565ba5c3774ff5f03a63c89a4df7c1f5ea38d3bd173409d14f8cbdcc36d40e703cccb996a9d9687590
OS Image 9b69bb1698bacbb6985409a2c272bcb892e09cdcea63d5399c6768b67d3ff677
Security Model Attested E2EE
What This Means Payloads are encrypted to an attested enclave key; gateway TLS termination is expected
Sold by Venice.ai
TEE platform Phala/dstack (corroborated)
Route binding No request-bound receipt
E2EE Protocol ecdsa
Signing Key 0434ba223c3175c4debee8cd12d72f55869b6cf1ccc5ff578e940a23c7bf9dcf3abd6530ce8d8624ffd150900fd31bae802eb75367a154a75e39cc87f748b63b84
E2ee Gemma 4 26b A4b Uncensored P (TEE) Intel TDX Details
Workload identity failed Measured workload evidence did not match the expectation.
Quote Intel TDX (DCAP QVL)
TCB Level status=UpToDate, advisories=[]
Report Data 79a5061efe5a46b0d1f33b11cf1c5adbedae6b79000000000000000000000000dff0fd10592a646f823a3662f2b16ca3b365acc0d22271290a7adf6467d06429
Signature ECDSA-P384 ✓
Compose Hash Mismatch ✗
Signer Bound Yes ✓
Nonce Bound Yes ✓
Enclave TLS Pin 08b9c0d165fbf3433870dc1c22a118da08eed65ae58aa4950fdf8dd21e98e70b ✗
Security Model No Verified Channel
What This Means No hardware attestation verified
Sold by Venice.ai
TEE platform phala (inferred)
Route binding No request-bound receipt
E2EE Protocol ecdsa
Signing Key 04943cea0b4babf60f6e2031e9a00866a37c4ae696fb45895b3a9b38ab8cbb898f42c85b704aceaa0a396cf26f7fdf79d83205be7e11d3a5d70419a68277158c3d
E2ee Glm 5 2 P (TEE) Intel TDX Details
Workload identity failed Measured workload evidence did not match the expectation.
Quote Intel TDX (DCAP QVL)
TCB Level status=UpToDate, advisories=[]
Report Data 79a5061efe5a46b0d1f33b11cf1c5adbedae6b790000000000000000000000004fdcd89a4f908f14378003945ae08502d234c7439cbe4787450e6b507526e264
Signature ECDSA-P384 ✓
Compose Hash Mismatch ✗
Signer Bound Yes ✓
Nonce Bound Yes ✓
Enclave TLS Pin 08b9c0d165fbf3433870dc1c22a118da08eed65ae58aa4950fdf8dd21e98e70b ✗
Security Model No Verified Channel
What This Means No hardware attestation verified
Sold by Venice.ai
TEE platform phala (inferred)
Route binding No request-bound receipt
E2EE Protocol ecdsa
Signing Key 04943cea0b4babf60f6e2031e9a00866a37c4ae696fb45895b3a9b38ab8cbb898f42c85b704aceaa0a396cf26f7fdf79d83205be7e11d3a5d70419a68277158c3d
E2ee Qwen3 6 27b (TEE) Intel TDX Attested E2EE Details
Source provenance not proven Registry existence alone is not source provenance.
Quote Intel TDX (DCAP QVL)
TCB Level status=UpToDate, advisories=[]
Report Data 6eb6ce4fa9f7f704769afff165955105c1ae7b1d000000000000000000000000fe7fa0239ae7842d31222af8b2e72fb185a05247b5154e436f741a3bacdefdcf
Signature ECDSA-P384 ✓
Compose Hash Mismatch ✗
TCB Consistent sha256 match ✓
Registry digest Digest exists in registry ✓
Confidential Channel E2EE to attested enclave key ✓
Signer Bound Yes ✓
Nonce Bound Yes ✓
Last Deploy v0.0.322
Gateway TLS 08b9c0d165fbf3433870dc1c22a118da08eed65ae58aa4950fdf8dd21e98e70b (external termination)
App dstack-nvidia-0.5.5
Images 6 containers
datadog/agent@sha256:5556fb80b952832719a76b016f905616c76ee0989a239c4680c6220148e865d6otel/opentelemetry-collector-contrib@sha256:85ac41c2db88d0df9bd6145e608a3cb023f5d8443868adbfbbf66efb51087917certbot/dns-cloudflare@sha256:742dbd2e61c8709b930712c38958386c3cb3928e09eeb1f1e490600c127e2edbcertbot/dns-cloudflare@sha256:742dbd2e61c8709b930712c38958386c3cb3928e09eeb1f1e490600c127e2edbnearaidev/compose-manager@sha256:b487f39160e9a53c3d98943a9c709d28e12babef75e0bb5a6cd5692abc8b2db6nearaidev/compose-manager-launcher@sha256:78afb82330137c2fd90a9c8c6e452f8f178c15d863f87c079a11c13e92216e00
RTMR0 bc122d143ab768565ba5c3774ff5f03a63c89a4df7c1f5ea38d3bd173409d14f8cbdcc36d40e703cccb996a9d9687590
OS Image 9b69bb1698bacbb6985409a2c272bcb892e09cdcea63d5399c6768b67d3ff677
Security Model Attested E2EE
What This Means Payloads are encrypted to an attested enclave key; gateway TLS termination is expected
Sold by Venice.ai
TEE platform Phala/dstack (corroborated)
Route binding No request-bound receipt
E2EE Protocol ecdsa
Signing Key 04cf942c4bcb0f89ffd33e837d850ab3eb4ff66cee6b285db3bbdff6e815f81e7df9a4bfaf863207b5d4ccc99ea4c3eca3172a82b2a7717635522bd22fc0cf6219
E2ee Qwen3 6 35b A3b Uncensored P (TEE) Intel TDX Details
Workload identity failed Measured workload evidence did not match the expectation.
Quote Intel TDX (DCAP QVL)
TCB Level status=UpToDate, advisories=[]
Report Data 79a5061efe5a46b0d1f33b11cf1c5adbedae6b790000000000000000000000005499e994c82c44717278f07e56c503d4a1e4785853319e924a69e74e9b4136d9
Signature ECDSA-P384 ✓
Compose Hash Mismatch ✗
Signer Bound Yes ✓
Nonce Bound Yes ✓
Enclave TLS Pin 08b9c0d165fbf3433870dc1c22a118da08eed65ae58aa4950fdf8dd21e98e70b ✗
Security Model No Verified Channel
What This Means No hardware attestation verified
Sold by Venice.ai
TEE platform phala (inferred)
Route binding No request-bound receipt
E2EE Protocol ecdsa
Signing Key 04943cea0b4babf60f6e2031e9a00866a37c4ae696fb45895b3a9b38ab8cbb898f42c85b704aceaa0a396cf26f7fdf79d83205be7e11d3a5d70419a68277158c3d
E2ee Venice Uncensored 24b P (TEE) Intel TDX Details
Workload identity failed Measured workload evidence did not match the expectation.
Quote Intel TDX (DCAP QVL)
TCB Level status=UpToDate, advisories=[]
Report Data 79a5061efe5a46b0d1f33b11cf1c5adbedae6b790000000000000000000000001affa6096297aa30ce14903b9ae187135674cad0c14282e48c5b30b2edc9df52
Signature ECDSA-P384 ✓
Compose Hash Mismatch ✗
Signer Bound Yes ✓
Nonce Bound Yes ✓
Enclave TLS Pin 08b9c0d165fbf3433870dc1c22a118da08eed65ae58aa4950fdf8dd21e98e70b ✗
Security Model No Verified Channel
What This Means No hardware attestation verified
Sold by Venice.ai
TEE platform phala (inferred)
Route binding No request-bound receipt
E2EE Protocol ecdsa
Signing Key 04943cea0b4babf60f6e2031e9a00866a37c4ae696fb45895b3a9b38ab8cbb898f42c85b704aceaa0a396cf26f7fdf79d83205be7e11d3a5d70419a68277158c3d
Gemma 3 27B (TEE) Intel TDX Details
Workload identity failed Measured workload evidence did not match the expectation.
Quote Intel TDX (DCAP QVL)
TCB Level status=UpToDate, advisories=[]
Report Data 79a5061efe5a46b0d1f33b11cf1c5adbedae6b79000000000000000000000000c42c02ba3dcc425dc251d9539a70a2b4f26880e3c0a9f0624c9bbc5434deaad4
Signature ECDSA-P384 ✓
Compose Hash Mismatch ✗
Signer Bound Yes ✓
Nonce Bound Yes ✓
Enclave TLS Pin 08b9c0d165fbf3433870dc1c22a118da08eed65ae58aa4950fdf8dd21e98e70b ✗
Security Model No Verified Channel
What This Means No hardware attestation verified
Sold by Venice.ai
TEE platform phala (inferred)
Route binding No request-bound receipt
E2EE Protocol ecdsa
Signing Key 04943cea0b4babf60f6e2031e9a00866a37c4ae696fb45895b3a9b38ab8cbb898f42c85b704aceaa0a396cf26f7fdf79d83205be7e11d3a5d70419a68277158c3d
Gemma 4 31B (TEE) Intel TDX Attested E2EE Details
Source provenance not proven Registry existence alone is not source provenance.
Quote Intel TDX (DCAP QVL)
TCB Level status=UpToDate, advisories=[]
Report Data 9765596f43dd91d1467f9a370682173741786d8c00000000000000000000000098624f775506338736d4c3f061e210abad709f5f8fd9a515c0b95d6cee0d624d
Signature ECDSA-P384 ✓
Compose Hash Mismatch ✗
TCB Consistent sha256 match ✓
Registry digest Digest exists in registry ✓
Confidential Channel E2EE to attested enclave key ✓
Signer Bound Yes ✓
Nonce Bound Yes ✓
Last Deploy v0.0.322
Gateway TLS 08b9c0d165fbf3433870dc1c22a118da08eed65ae58aa4950fdf8dd21e98e70b (external termination)
App dstack-nvidia-0.5.5
Images 6 containers
datadog/agent@sha256:5556fb80b952832719a76b016f905616c76ee0989a239c4680c6220148e865d6otel/opentelemetry-collector-contrib@sha256:85ac41c2db88d0df9bd6145e608a3cb023f5d8443868adbfbbf66efb51087917certbot/dns-cloudflare@sha256:742dbd2e61c8709b930712c38958386c3cb3928e09eeb1f1e490600c127e2edbcertbot/dns-cloudflare@sha256:742dbd2e61c8709b930712c38958386c3cb3928e09eeb1f1e490600c127e2edbnearaidev/compose-manager@sha256:b487f39160e9a53c3d98943a9c709d28e12babef75e0bb5a6cd5692abc8b2db6nearaidev/compose-manager-launcher@sha256:78afb82330137c2fd90a9c8c6e452f8f178c15d863f87c079a11c13e92216e00
RTMR0 bc122d143ab768565ba5c3774ff5f03a63c89a4df7c1f5ea38d3bd173409d14f8cbdcc36d40e703cccb996a9d9687590
OS Image 9b69bb1698bacbb6985409a2c272bcb892e09cdcea63d5399c6768b67d3ff677
Security Model Attested E2EE
What This Means Payloads are encrypted to an attested enclave key; gateway TLS termination is expected
Sold by Venice.ai
TEE platform Phala/dstack (corroborated)
Route binding No request-bound receipt
E2EE Protocol ecdsa
Signing Key 04323149efe98c490b9b44b517b3bd599defd1ad5a61f580ca27bfd3daedd3333eddd6e40663c9a79556897ddf9ecf9dfb937ebd3cfbac512d2a7620b3c2df09d2
GLM 4.7 (TEE) Intel TDX Details
Workload identity failed Measured workload evidence did not match the expectation.
Quote Intel TDX (DCAP QVL)
TCB Level status=UpToDate, advisories=[]
Report Data 79a5061efe5a46b0d1f33b11cf1c5adbedae6b790000000000000000000000008dda8b98854133d0be5e443b22c652fa02e4dbb088749bc6513095ab79d3332b
Signature ECDSA-P384 ✓
Compose Hash Mismatch ✗
Signer Bound Yes ✓
Nonce Bound Yes ✓
Enclave TLS Pin 08b9c0d165fbf3433870dc1c22a118da08eed65ae58aa4950fdf8dd21e98e70b ✗
Security Model No Verified Channel
What This Means No hardware attestation verified
Sold by Venice.ai
TEE platform phala (inferred)
Route binding No request-bound receipt
E2EE Protocol ecdsa
Signing Key 04943cea0b4babf60f6e2031e9a00866a37c4ae696fb45895b3a9b38ab8cbb898f42c85b704aceaa0a396cf26f7fdf79d83205be7e11d3a5d70419a68277158c3d
GLM 5.1 (TEE) Intel TDX Attested E2EE Details
Source provenance not proven Registry existence alone is not source provenance.
Quote Intel TDX (DCAP QVL)
TCB Level status=UpToDate, advisories=[]
Report Data bb4d2e7ffe98eefcd9690e2139be41e92b95e3330000000000000000000000001ed38a00c7a203f7b4c9226100a66e0c08127a1c77cda465fd5cb93ade942cbd
Signature ECDSA-P384 ✓
Compose Hash Mismatch ✗
TCB Consistent sha256 match ✓
Registry digest Digest exists in registry ✓
Confidential Channel E2EE to attested enclave key ✓
Signer Bound Yes ✓
Nonce Bound Yes ✓
Gateway TLS 08b9c0d165fbf3433870dc1c22a118da08eed65ae58aa4950fdf8dd21e98e70b (external termination)
App dstack-nvidia-0.5.5
Images 6 containers
datadog/agent@sha256:5556fb80b952832719a76b016f905616c76ee0989a239c4680c6220148e865d6otel/opentelemetry-collector-contrib@sha256:85ac41c2db88d0df9bd6145e608a3cb023f5d8443868adbfbbf66efb51087917certbot/dns-cloudflare@sha256:742dbd2e61c8709b930712c38958386c3cb3928e09eeb1f1e490600c127e2edbcertbot/dns-cloudflare@sha256:742dbd2e61c8709b930712c38958386c3cb3928e09eeb1f1e490600c127e2edbnearaidev/compose-manager@sha256:b487f39160e9a53c3d98943a9c709d28e12babef75e0bb5a6cd5692abc8b2db6nearaidev/compose-manager-launcher@sha256:78afb82330137c2fd90a9c8c6e452f8f178c15d863f87c079a11c13e92216e00
RTMR0 bc122d143ab768565ba5c3774ff5f03a63c89a4df7c1f5ea38d3bd173409d14f8cbdcc36d40e703cccb996a9d9687590
OS Image 9b69bb1698bacbb6985409a2c272bcb892e09cdcea63d5399c6768b67d3ff677
Security Model Attested E2EE
What This Means Payloads are encrypted to an attested enclave key; gateway TLS termination is expected
Sold by Venice.ai
TEE platform Phala/dstack (corroborated)
Route binding No request-bound receipt
E2EE Protocol ecdsa
Signing Key 042a1c47aad08a4f47dcb67134d77b83d8a1d5c895e37e959189249e819c3939289d8c59acb07d262db3ca946d52c51ae079fde6708cb0af7e25a57d35c8e0ac30
GPT-OSS 120B (TEE) Intel TDX Details
Workload identity failed Measured workload evidence did not match the expectation.
Quote Intel TDX (DCAP QVL)
TCB Level status=UpToDate, advisories=[]
Report Data 79a5061efe5a46b0d1f33b11cf1c5adbedae6b790000000000000000000000003f18032e6e292a55f05f1bedfa6ad4efcbada8e96478bd9e969cc264441a3672
Signature ECDSA-P384 ✓
Compose Hash Mismatch ✗
Signer Bound Yes ✓
Nonce Bound Yes ✓
Enclave TLS Pin 08b9c0d165fbf3433870dc1c22a118da08eed65ae58aa4950fdf8dd21e98e70b ✗
Security Model No Verified Channel
What This Means No hardware attestation verified
Sold by Venice.ai
TEE platform phala (inferred)
Route binding No request-bound receipt
E2EE Protocol ecdsa
Signing Key 04943cea0b4babf60f6e2031e9a00866a37c4ae696fb45895b3a9b38ab8cbb898f42c85b704aceaa0a396cf26f7fdf79d83205be7e11d3a5d70419a68277158c3d
GPT-OSS 20B (TEE) Intel TDX Details
Workload identity failed Measured workload evidence did not match the expectation.
Quote Intel TDX (DCAP QVL)
TCB Level status=UpToDate, advisories=[]
Report Data 79a5061efe5a46b0d1f33b11cf1c5adbedae6b79000000000000000000000000f914b8d4497ecd57291b0cd0db24685789932901853fdaf75b9444d2e4c5fe1a
Signature ECDSA-P384 ✓
Compose Hash Mismatch ✗
Signer Bound Yes ✓
Nonce Bound Yes ✓
Enclave TLS Pin 08b9c0d165fbf3433870dc1c22a118da08eed65ae58aa4950fdf8dd21e98e70b ✗
Security Model No Verified Channel
What This Means No hardware attestation verified
Sold by Venice.ai
TEE platform phala (inferred)
Route binding No request-bound receipt
E2EE Protocol ecdsa
Signing Key 04943cea0b4babf60f6e2031e9a00866a37c4ae696fb45895b3a9b38ab8cbb898f42c85b704aceaa0a396cf26f7fdf79d83205be7e11d3a5d70419a68277158c3d
Qwen 2.5 7B (TEE) Intel TDX Details
Workload identity failed Measured workload evidence did not match the expectation.
Quote Intel TDX (DCAP QVL)
TCB Level status=UpToDate, advisories=[]
Report Data 79a5061efe5a46b0d1f33b11cf1c5adbedae6b79000000000000000000000000bba70d83a8c6831238151a9e9a20224c94f4d8469b811ec98049774cfc40c2d5
Signature ECDSA-P384 ✓
Compose Hash Mismatch ✗
Signer Bound Yes ✓
Nonce Bound Yes ✓
Enclave TLS Pin 08b9c0d165fbf3433870dc1c22a118da08eed65ae58aa4950fdf8dd21e98e70b ✗
Security Model No Verified Channel
What This Means No hardware attestation verified
Sold by Venice.ai
TEE platform phala (inferred)
Route binding No request-bound receipt
E2EE Protocol ecdsa
Signing Key 04943cea0b4babf60f6e2031e9a00866a37c4ae696fb45895b3a9b38ab8cbb898f42c85b704aceaa0a396cf26f7fdf79d83205be7e11d3a5d70419a68277158c3d
Qwen3 30B (TEE) Intel TDX Details
Workload identity failed Measured workload evidence did not match the expectation.
Quote Intel TDX (DCAP QVL)
TCB Level status=UpToDate, advisories=[]
Report Data 79a5061efe5a46b0d1f33b11cf1c5adbedae6b790000000000000000000000006bb1ed01eda753ee5ed6b5105ce3a7b7d759f780f94aa70ffb0e9dde2c5d1a66
Signature ECDSA-P384 ✓
Compose Hash Mismatch ✗
Signer Bound Yes ✓
Nonce Bound Yes ✓
Enclave TLS Pin 08b9c0d165fbf3433870dc1c22a118da08eed65ae58aa4950fdf8dd21e98e70b ✗
Security Model No Verified Channel
What This Means No hardware attestation verified
Sold by Venice.ai
TEE platform phala (inferred)
Route binding No request-bound receipt
E2EE Protocol ecdsa
Signing Key 04943cea0b4babf60f6e2031e9a00866a37c4ae696fb45895b3a9b38ab8cbb898f42c85b704aceaa0a396cf26f7fdf79d83205be7e11d3a5d70419a68277158c3d
Qwen3 35B (TEE) Intel TDX Attested E2EE Details
Source provenance not proven Registry existence alone is not source provenance.
Quote Intel TDX (DCAP QVL)
TCB Level status=UpToDate, advisories=[]
Report Data e5d0fec43b001f181a3410b96715ec54171f36da000000000000000000000000fa23d9d8103a4a55140794a9776840e888bcc78343dd016eb62a93db05f02713
Signature ECDSA-P384 ✓
Compose Hash Mismatch ✗
TCB Consistent sha256 match ✓
Registry digest Digest exists in registry ✓
Confidential Channel E2EE to attested enclave key ✓
Signer Bound Yes ✓
Nonce Bound Yes ✓
Last Deploy v0.0.295
Gateway TLS 08b9c0d165fbf3433870dc1c22a118da08eed65ae58aa4950fdf8dd21e98e70b (external termination)
App dstack-nvidia-0.5.5
Images 6 containers
datadog/agent@sha256:5556fb80b952832719a76b016f905616c76ee0989a239c4680c6220148e865d6otel/opentelemetry-collector-contrib@sha256:85ac41c2db88d0df9bd6145e608a3cb023f5d8443868adbfbbf66efb51087917certbot/dns-cloudflare@sha256:742dbd2e61c8709b930712c38958386c3cb3928e09eeb1f1e490600c127e2edbcertbot/dns-cloudflare@sha256:742dbd2e61c8709b930712c38958386c3cb3928e09eeb1f1e490600c127e2edbnearaidev/compose-manager@sha256:5165400d9eb43ab5da36986a85de0ba55f3fb4d05211c4397ecc4bde3ef0113bnearaidev/compose-manager-launcher@sha256:d652f92b64f57ef8aa086bd77a4cf932c1976965b3cea2814a7ee82fe73aa993
RTMR0 bc122d143ab768565ba5c3774ff5f03a63c89a4df7c1f5ea38d3bd173409d14f8cbdcc36d40e703cccb996a9d9687590
OS Image 9b69bb1698bacbb6985409a2c272bcb892e09cdcea63d5399c6768b67d3ff677
Security Model Attested E2EE
What This Means Payloads are encrypted to an attested enclave key; gateway TLS termination is expected
Sold by Venice.ai
TEE platform Phala/dstack (corroborated)
Route binding No request-bound receipt
E2EE Protocol ecdsa
Signing Key 0489f03d8ed945eff27ad1053f87ece198409aff78c5c2aea3e438c460482f67ff5b900054dc129f6ce57e40e8875ceac0ddf30aeb885c28fd2c3e05bf3fbaa4d9
Qwen3-VL 30B (TEE) Intel TDX Details
Workload identity failed Measured workload evidence did not match the expectation.
Quote Intel TDX (DCAP QVL)
TCB Level status=UpToDate, advisories=[]
Report Data 79a5061efe5a46b0d1f33b11cf1c5adbedae6b7900000000000000000000000067b1f0f40c02632e357b718a342764a3bf6f8477296d52b340556c04f94e95bd
Signature ECDSA-P384 ✓
Compose Hash Mismatch ✗
Signer Bound Yes ✓
Nonce Bound Yes ✓
Enclave TLS Pin 08b9c0d165fbf3433870dc1c22a118da08eed65ae58aa4950fdf8dd21e98e70b ✗
Security Model No Verified Channel
What This Means No hardware attestation verified
Sold by Venice.ai
TEE platform phala (inferred)
Route binding No request-bound receipt
E2EE Protocol ecdsa
Signing Key 04943cea0b4babf60f6e2031e9a00866a37c4ae696fb45895b3a9b38ab8cbb898f42c85b704aceaa0a396cf26f7fdf79d83205be7e11d3a5d70419a68277158c3d
Verification Methodology
Tinfoil Enclaves
Fetches .well-known/tinfoil-attestation from each enclave. The response contains a gzipped, base64-encoded hardware quote. For TDX enclaves, the quote is verified through Intel DCAP Quote Verification Library (dcap-qvl) using Intel PCS collateral (override via PCCS_URL if needed). For SNP enclaves, the report is verified against AMD KDS VCEK certificates with builtin ARK/ASK roots. TLS certificate SPKI fingerprints are compared to the attested report_data.
Venice.ai / Redpill / NEAR AI (dstack)
All three providers use the same dstack attestation format. Venice returns a direct attestation; Redpill and NEAR AI return a two-layer format (gateway + model attestations). In all cases, the raw intel_quote hex is parsed as a TDX quote and verified via dcap-qvl using Intel PCS collateral (or PCCS_URL override). The quote-bound tcb_info.app_compose hash is recomputed and compared to tcb_info.compose_hash; when compose-manager actions_hash evidence is present, that is recomputed too. Provider server_verification and verified fields are completely ignored.
NVIDIA GPU Attestation
Non-empty GPU evidence payloads are submitted to NVIDIA's current NRAS endpoint, which returns a signed JWT. The JWT signature is verified against NRAS's JWKS, the issuer is pinned to nras.attestation.nvidia.com, and the eat_nonce is checked against the request nonce. Empty or malformed provider evidence and mismatched provider nonces are rejected locally before any NRAS request.
Chutes / Maple / Privatemode / Other Providers
Chutes is checked by fetching a live TEE chute's evidence endpoint, verifying the Intel TDX quote with dcap-qvl, checking that report_data binds the verifier nonce plus the ML-KEM E2E public key, and verifying NVIDIA GPU evidence when present. Chutes checks stay partial unless the workload image is digest-pinned or equivalent signed provenance is exposed. Maple Nitro checks also stay partial until expected PCR/workload provenance is configured. Privatemode is checked with a pinned Contrast CLI: the Coordinator is remotely attested, the active manifest must match the CDN manifest hash, and digest-pinned images are extracted from the verified initdata before the local proxy model path is accepted. PPQ is not counted as verified from liveness alone.