Solution
AI and agents you can verify.
Privasys AI runs open-weight models inside confidential VMs, runs your agents inside an attested harness, and reaches your accounts through connectors that keep no credential at rest. Every leg of the loop, the model, the harness and each tool, proves what it is before it sees your data, and your Privasys Drive is the memory it all works from.
Confidential inference is where it starts.
An agent is a loop: the model proposes, tools act, the results come back. Protect the model alone and you have protected one leg of it, while your context travels to whatever operates the rest. Privasys AI attests all three.
The model
Open-weight models in Intel TDX with the NVIDIA H100 in confidential-compute mode. Every reply carries a hardware-signed receipt of the code, weights and configuration that produced it.
The agent
Privasys Harness runs the agent loop in its own enclave. Every call it makes leaves through a gate that admits only the attested services you approved in your wallet.
Its reach
Your Drive is its memory, and Privasys Connectors reach your mail, calendar, files and meetings. Each is a separately attested enclave, and none keeps your credential at rest.
What every session gives you.
Confidential VM
Inference runs inside an Intel TDX trust domain with the GPU in NVIDIA Confidential Computing mode. CPU memory and GPU VRAM are encrypted and isolated from the cloud operator. Even Privasys cannot see your prompts.
Reproducible inference
Every response carries the model digest, server image hash and seed metadata. Anyone can rebuild the exact runtime from source and replay the same generation. The answer is auditable, not just trusted.
Attested chat
Before the first prompt leaves your browser, the chat client verifies a fresh TDX quote bound to the connection’s TLS key. You see the exact model and code hash you are talking to, signed by the hardware.
Agents you can verify.
Privasys Harness is where the loop runs: an open-source agent harness pinned at an exact commit and composed inside an attested enclave, so what executes is what was measured, and the measurement is what your wallet approves.
Every call leaves through a gate
Model calls and tool calls go through an egress proxy inside the same enclave. It speaks mutual RA-TLS and admits only the services in the app’s declared dependency set, which your wallet shows you at consent. Anything else is refused.
Verification in the product
The harness shows its live hardware quote against a challenge you can regenerate, and every tool call in the trajectory carries its own attestation, checked against the measurement pinned for that tool.
Replay a whole turn
A turn is several model calls and the tool results between them. The harness replays all of it and reports, step by step, whether the prompt, the clock and the reply came back identical to the record.
A folder of its own
Approve the harness on your wallet and it gets a folder in your Drive for its agents, skills and working files, under your quota and your Revoke, rather than a database on our servers.
Your accounts
Privasys Connectors
Every useful agent needs your accounts, and the usual way to give it them is to hand a password or a long-lived token to a service you cannot inspect, on a machine you cannot see, which keeps it for as long as it likes. The model gets all the scrutiny; the connector, which actually holds the keys to your correspondence, gets almost none. Privasys Connectors make that leg as verifiable as the rest.
Your credential is never at rest
What opens your account lives in the memory of the attested connector and on your own phone. It is never written to a disk we operate and never appears in a log. If the connector restarts, it asks your phone again: one tap.
One account, one purpose, one Revoke
The access you approve names one account, one purpose and an expiry, and it is bound to the exact build of the connector that asked. Your wallet lists what holds access, and Revoke takes effect immediately.
Sign in, never hand over a password
You type your address, the connector works out who hosts it, and you sign in at Google or Microsoft in your own browser. A password is asked for only by providers that offer nothing better.
Attested on both ends, and open
The agent verifies the connector’s code and the connector verifies the agent’s before a byte moves. The code is open source, and the measured build is what your wallet approves, so you verify rather than trust.
Four to start with
Mail. Any IMAP mailbox, with a Google or Microsoft sign-in where the provider offers one. Read, search years of correspondence, label, and draft replies in your own voice.
Calendar. Google, Microsoft 365 and any CalDAV calendar. Read what is planned and when you are free, and propose meetings for you to confirm.
Files. Google Drive, OneDrive and the SharePoint libraries you follow. Find a document and read it as text, whatever its format.
Meetings. The transcripts Zoom and Microsoft Teams produce for your meetings, kept in your own Drive rather than left with the recording service.
Sending mail and invitations is on the way. Until then, what an agent leaves behind is a draft or a proposal, for you to send or confirm.
Write your own
A connector is a driver, a schema, a probe and a list of tools. Everything that makes it trustworthy, the capability routes, the sign-in the wallet drives, the change feed an agent waits on, the redaction and the attestation, is a shared shell you copy in, permissively licensed so that anyone can write the next one. Publish it, and it is approved from a wallet like any other application.
Built for the data that matters.
AI that knows you
The best outcomes come from real, private data, not sanitised summaries. Privasys AI can work directly on your transactions, records, or contracts, because the data stays encrypted in hardware throughout.
Private knowledge retrieval
Augment the model with your own documents through Privasys Drive. Ingestion, embedding, and retrieval all happen inside the enclave, so your data is never exposed, even to the model provider.
Where it was impossible before
Finance over transaction data, healthcare over patient records, legal over confidential files, government over classified information. Using AI on this data no longer means surrendering control of it.
How it works.
Hardware-rooted trust chain
The TDX module measures the boot kernel, the verified read-only root filesystem, the inference server image and the model weights into the TDX RTMRs. The H100 attests its CC-mode firmware over SPDM. Both evidence trees are folded into the TLS certificate the chat client sees.
OpenAI-compatible API, attested edges
Each fleet exposes a vLLM-backed OpenAI-compatible endpoint behind a gateway that performs RA-TLS. Existing tooling works unchanged; the only difference is that you can prove who answered.
Distributed attestation verifier
Quote signature verification runs against an independent attestation-server, so the inference VM cannot lie about its own attestation. The verifier’s policy and code hashes are part of the published trust chain.
Per-tenant isolation by design
Dedicated fleets get their own VM, their own model menu and their own private retrieval store. Public fleets share infrastructure but never state. Quota and identity are enforced by Privasys ID, not by the inference node.
How it compares.
vs. closed APIs
OpenAI, Anthropic and the like give you a smart endpoint and a policy promise. There is no cryptographic proof of which model answered, what code ran, or where your data went after it left your browser. Privasys AI gives you all three on every request.
vs. self-hosted vLLM
Self-hosted vLLM gives you control of the box. Privasys AI gives you the same control plus a hardware-attested trust chain, a managed attestation verifier, reproducibility metadata, and a chat front-end your users can verify without reading PEM files.
Honest about the boundaries.
Confidential computing protects against the cloud operator and the host OS, not against bugs in the model itself or in the inference server. Attestation proves what code ran; it does not prove that code is correct. The same holds for agents and connectors: attestation tells you which code holds your credential and which services an agent may call, and an agent acts within the access you granted, so grant what the task needs. We publish the full source, the build recipe and the patch set, and we make it easy to rebuild and diff. The trust chain is only as strong as what you actually verify.