# Tinfoil - Verifiably Private AI

> Trust the hardware, not the promises.

## Overview

Tinfoil is a secure AI platform where no one sees your data. We run AI workloads inside secure hardware enclaves, protecting your data from everyone, including Tinfoil. Our software stack is open-source and fully verifiable.

Tinfoil provides on-prem privacy with cloud scalability using NVIDIA confidential computing GPUs.

**SOC 2 Compliant** - See our security documentation at https://trust.tinfoil.sh

## Products

### Private Chat
Access the latest AI models without exposing your data.

- **URL**: https://chat.tinfoil.sh
- **Pricing**: $20/month
- **Features**:
  - All conversations are processed in secure enclaves
  - Verify privacy directly in the browser
  - Provable zero data access and zero data retention
  - Generous rate limits
  - Access to projects
  - Ability to search the web
  - Chat across web and iOS
  - Sync across devices

### Private Inference API
Build with powerful AI models while keeping all data private. OpenAI-compatible API with automatic privacy verification.

- **URL**: https://tinfoil.sh/inference
- **Pricing**: Usage-based pricing (per-model pricing for input and output tokens)
- **Features**:
  - Drop-in OpenAI replacement
  - Automatic privacy verification
  - Access to all models
  - Python, JS, Go, Swift SDKs
  - Dashboard and usage metrics
  - Team organization
  - Email and Slack support
  - Tool calling support
  - Document processing
  - Image processing
  - Structured outputs

### Tinfoil Containers
Deploy any container in a secure enclave with verifiable privacy guarantees.

- **URL**: https://tinfoil.sh/containers
- **Pricing**: Usage-based pricing
- **Documentation**: https://docs.tinfoil.sh/containers/overview
- **Features**:
  - Deploy any Docker container
  - Multi-GPU confidential computing
  - Client-side attestation verification
  - Attestation and transparency infrastructure
  - Zero-downtime updates and relaunches
  - Health checks and monitoring
  - Debug mode environment
  - Private registries
  - Custom domains
  - Secure encrypted memory (up to 128 GB)
  - CPU and GPU TEE support
  - Email and Slack support

### Business & Enterprise
Customized solutions and support for organizations.

- **Contact**: contact@tinfoil.sh or https://calendly.com/tanya-52pb/tinfoil-demo
- **Pricing**: Custom
- **Features**:
  - Dedicated endpoints
  - Custom models and prompts
  - Model training
  - Guaranteed SLA
  - SSO and Access Controls
  - Audit logs and compliance
  - On-prem integrations
  - White-glove support

## Available Models

Tinfoil runs state-of-the-art open-source AI models in secure hardware enclaves with verifiable privacy guarantees.

**Language Models**:
- **GPT-OSS 120B** - Open-source GPT reasoning model
- **Kimi K2.5** - Multimodal reasoning model from Moonshot AI
- **DeepSeek R1** - State-of-the-art reasoning model
- **Voxtral** - Audio and multimodal model from Mistral
- **Qwen3-VL 30B** - Vision-language model from Alibaba
- **Llama 3.3 70B** - Open-source model from Meta

All models run in dedicated confidential computing GPUs with hardware-level isolation.

**Note**: Tinfoil only supports open-source models or custom models. Closed-source models like GPT-5 and Claude are not supported.

Full model catalog: https://docs.tinfoil.sh/models/catalog

## Confidential Computing Technology

### How It Works

1. **End-to-End Privacy**: Your data is encrypted directly to the GPU running the AI model
2. **Secure Enclaves**: Models run inside trusted execution environments (TEEs) with hardware-level isolation
3. **Zero Access**: Your data cannot be accessed or shared with third parties, even by Tinfoil
4. **Cryptographic Verification**: Security guarantees are cryptographically verifiable

### Hardware Partners

Powered by confidential computing primitives from:
- **NVIDIA** - GPU confidential computing on Hopper and Blackwell architectures
- **AMD** - SEV for secure encrypted virtualization of CPU workloads
- **Intel** - TDX for hardware-isolated trust domains

### Technology Stack

- AMD SEV with NVIDIA confidential computing GPUs
- Hardware-backed cryptographic guarantees
- Sigstore transparency log for public verifiability
- Stateless enclaves between requests
- Open-source and auditable

Architecture details: https://docs.tinfoil.sh/verification/attestation-architecture

### Performance

- **NVIDIA Hopper**: Small performance overhead with strong security
- **NVIDIA Blackwell**: Near-zero performance difference vs non-secure workloads
- Multi-GPU confidential computing support
- Cloud scalability without compromising privacy

Learn more: https://developer.nvidia.com/blog/confidential-computing-on-h100-gpus-for-secure-and-trustworthy-ai/

## Comparison with Alternatives

| Feature | OpenAI | On-Premise | Tinfoil |
|---------|---------------|------------|---------|
| **Data Privacy** |
| Provable Zero Data Retention | No | Yes | Yes |
| **Features** |
| Cloud Convenience | Yes | No | Yes |
| Setup Costs | Low | High | Low |
| Complexity | Low | High | Low |
| Scalability | Good | Poor | Good |
| Zero Trust | No | No | Yes |
| Private Observability | No | No | Yes |

### Traditional AI vs Tinfoil

**Traditional AI Providers**:
- Data only encrypted in transit, not in use
- Providers decrypt data before processing
- Providers can access, analyze, and train on your data
- Protection relies on legal agreements (DPAs)

**Tinfoil**:
- Data encrypted directly to the GPU running the AI model
- Models run inside trusted execution environments (TEEs)
- Each model runs in a dedicated confidential computing GPU
- Data cannot be accessed or shared with third parties
- Security guarantees are cryptographically verifiable

## Solutions by Industry

### Personal Use
Interact freely with AI, knowing that no one except you can see your conversations.

**Use Cases**:
- **Private Chat**: Discuss mental health, personal finance, and sensitive topics
- **Private Data Analysis**: Analyze personal or business data securely
- **Private Journaling**: AI-assisted reflection and personal growth

### Startups
Give customers confidence to embrace your AI products by guaranteeing their sensitive information is never revealed.

**Use Cases**:
- **AI Agents for Private Data**: Remove trust barriers for sensitive AI tools
- **Private Content Moderation**: AI moderation that users can trust and verify
- **Enterprise-Ready Security**: Zero-trust approach for enterprise customers

### Enterprise
Enforce security, data sovereignty, and compliance at scale with a zero-trust approach.

**Use Cases**:
- **AI Agents for Proprietary Code**: Empower developers without exposing IP
- **Private RAG and Applications**: Build RAG systems with sensitive data sources
- **Private Training and Fine-tuning**: Train models on proprietary datasets securely
- **Model Weight Protection**: Protect proprietary model weights from unauthorized access

## Key Benefits

### Private Cloud Infrastructure
- Run AI workloads in secure enclaves
- Data never leaves secure environment
- Cloud-native tools for deployment and scaling
- No on-prem management overhead

### Elevated Data Security
- Safeguard against data leaks
- Proprietary information stays encrypted in transit and in use
- Defense against hackers and malicious actors
- Protection for intellectual property

### Compliance Ready
- Meet stringent data privacy regulations
- Hardware-enforced security guarantees
- SOC 2 Compliant
- Suitable for healthcare, finance, and government

### Developer Experience
- OpenAI-compatible API
- SDKs for Python, JavaScript, Swift, and Go
- Integrate in minutes
- Automatic privacy verification

## Integration

### API Compatibility
- OpenAI Chat Completions API compatible
- Drop-in replacement for most existing deployments
- SDKs available at GitHub @tinfoilsh

### Observability
- Prometheus-compatible metrics
- Privacy-preserving analytics
- Secure aggregation for observability

### Supported Workloads
- Chat applications
- Inference APIs
- RAG (Retrieval-Augmented Generation)
- Fine-tuning and training
- Custom model deployment
- Custom containerized workloads

## Frequently Asked Questions

### How does Tinfoil protect my data?
Tinfoil uses secure enclaves with hardware-backed cryptographic guarantees, combining AMD SEV with NVIDIA confidential computing GPUs. Sigstore provides transparency logs for public verification.

### What does end-to-end privacy mean?
Your data is encrypted directly to the enclave. No one can access it except you and the model inside the enclave. Even Tinfoil cannot see your conversations.

### How is Tinfoil different from typical AI security?
Most AI security relies on access controls where you trust the provider. Tinfoil uses secure enclaves and hardware-level isolation to provide verifiable hardware protections, similar to Apple's Private Cloud Compute but available across platforms.

### What's the performance impact?
- NVIDIA Hopper: Small overhead (see NVIDIA benchmarks)
- NVIDIA Blackwell: Near-zero performance difference

### Is Tinfoil compatible with closed-source models like GPT-5 and Claude?
No. Tinfoil only supports open-source models like DeepSeek, Kimi, Llama, and Qwen, or custom models provided by customers.

### What analytics and observability does Tinfoil offer?
Tinfoil provides Prometheus-compatible metrics with privacy-preserving analytics, allowing you to monitor and debug applications while maintaining privacy through secure aggregation.

### Can I deploy my own AI models?
Yes! Tinfoil supports deployment of custom and proprietary models. Contact us for details.

### Can I integrate Tinfoil with my existing application?
Yes! Tinfoil supports the OpenAI Chat Completions API standard, making it easy to integrate with existing applications.

### Can I keep server-side data and state?
Enclaves are stateless between requests and do not have access to external storage. However, we offer privacy-preserving analytics and observability. Contact us with your specific use case.

### Will Tinfoil use fully homomorphic encryption (FHE)?
FHE is not scalable for AI applications in the near future. Even with hardware-accelerated FHE, it cannot support large-scale AI workloads in real-time. Some companies use FHE for limited use cases (blockchains, static database queries), but for AI workloads, FHE quickly hits a performance wall.

## Company

### Mission
We founded Tinfoil because we wanted a private garden for thought. We believe AI needs infrastructure where privacy is enforced by design, not through policies and legal frameworks.

**Founding Principles**:
1. Our users don't have to trust us; they can verify
2. We believe in a good future with AI
3. Privacy elevates the user experience
4. Commitment to transparency

Full mission statement: https://tinfoil.sh/mission

### Founding Team

**Jules Drean** - Co-founder
Jules holds a PhD from MIT in secure hardware and systems. Jules has industry experience working at Microsoft Research and NVIDIA.
- LinkedIn: https://www.linkedin.com/in/jdrean

**Tanya Verma** - Co-founder
Tanya is an ex-Cloudflare engineer and researcher. Tanya designed and deployed privacy and security protocols used by billions of users, and contributed to Cloudflare's Workers AI platform.
- LinkedIn: https://linkedin.com/in/tanya-verma-130a23124
- Twitter/X: @t0nyav

**Sacha Servan-Schreiber** - Co-founder
Sacha holds a PhD from MIT in cryptography and privacy-preserving systems. Sacha has industry experience working at Microsoft Research and MongoDB.
- LinkedIn: https://www.linkedin.com/in/sacha-servan-schreiber-308341305/
- Twitter/X: @sachaservan

### Team

**Miles Dai** - Founding Engineer
Miles is a software engineer focused on building robust systems for secure hardware. He holds a masters degree from MIT in computer architecture, and has worked at Google and zeroRISC.
- LinkedIn: https://www.linkedin.com/in/milesdai/

### Featured Angel Investors

**Nick Sullivan** - Investor
Industry leader in security/networking/cryptography research and development.
- LinkedIn: https://www.linkedin.com/in/ntsullivan/
- Twitter/X: @grittygrease

**Alana Renda** - Investor
Former founder & CEO of Readyset. PhD candidate at MIT's Language and Intelligence group.
- LinkedIn: https://www.linkedin.com/in/alanamarzoev/
- Twitter/X: @alanamarzoev

**Michael Grinich** - Investor
Founder & CEO of WorkOS. Previously, founder and CEO of Nylas.
- LinkedIn: https://www.linkedin.com/in/grinich/
- Twitter/X: @grinich

**Paul Graham** - Investor
Co-founder of Y Combinator.
- Twitter/X: @paulg

### Case Studies and Collaborations

**Meta Llama Case Study**
Featured in a Llama case study as the only multi-GPU infrastructure offering production-ready, verifiably private AI.
- URL: https://www.llama.com/resources/case-studies/tinfoil/

**Red Hat Collaboration**
Collaborating with Red Hat on open source confidential AI infrastructure for private inference.
- URL: https://next.redhat.com/2025/10/23/enhancing-ai-inference-security-with-confidential-computing-a-path-to-private-data-inference-with-proprietary-llms/

**Trail of Bits Security Audit**
Security audit and webinar collaboration on TEE vulnerabilities and confidential computing best practices.
- URL: https://watch.getcontrast.io/register/trail-of-bits-top-tee-bugs-you-should-fix-before-your-audit

**Canonical Success Story**
Our story on building audit-ready, verifiably private AI with Ubuntu as the foundation for multi-platform confidential computing.
- URL: https://ubuntu.com/engage/tinfoil-confidential-computing-guide

### Industry Partner Programs

- NVIDIA Inception Program
- MIT Industrial Liaison Program
- Intel Liftoff Program
- Cloudflare Workers Launchpad
- Meta Llama Partner
- Confidential Computing Consortium Member

### Investors

- Y Combinator (Portfolio Company)
- Felicis

## Resources

### Documentation
- [API Reference](https://docs.tinfoil.sh)
- [Verification and Attestation](https://docs.tinfoil.sh/verification/attestation-architecture)
- [Model Catalog](https://docs.tinfoil.sh/models/catalog)
- [Tool Calling Guide](https://docs.tinfoil.sh/guides/tool-calling)
- [Document Processing](https://docs.tinfoil.sh/guides/document-processing)
- [Image Processing](https://docs.tinfoil.sh/guides/image-processing)
- [Structured Outputs](https://docs.tinfoil.sh/guides/structured-outputs)
- [Containers Overview](https://docs.tinfoil.sh/containers/overview)
- [Containers Quickstart](https://docs.tinfoil.sh/containers/quickstart)
- [Containers Configuration](https://docs.tinfoil.sh/containers/configuration)
- [Containers Secrets & Env Vars](https://docs.tinfoil.sh/containers/secrets-and-env-vars)
- [Containers Custom Domains](https://docs.tinfoil.sh/containers/custom-domains)

### Code and Libraries
- [GitHub](https://github.com/tinfoilsh): @tinfoilsh
- [Python SDK](https://github.com/tinfoilsh/tinfoil-python)
- [JavaScript SDK](https://github.com/tinfoilsh/tinfoil-js)
- [Swift SDK](https://github.com/tinfoilsh/tinfoil-swift)
- [Go SDK](https://github.com/tinfoilsh/tinfoil-go)
- [Rust SDK](https://github.com/tinfoilsh/tinfoil-rs)

### Blog
- [All posts](https://tinfoil.sh/blog)
- [Introduction to Tinfoil](https://tinfoil.sh/blog/2025-01-06-introduction)
- [Tinfoil Enclaves: An Overview](https://tinfoil.sh/blog/2025-01-10-tinfoil-enclaves-overview)
- [Publish, Audit, Attest: How Tinfoil Builds Trust](https://tinfoil.sh/blog/2025-01-13-how-tinfoil-builds-trust)
- [How Does Tinfoil Compare to Apple Private Cloud Compute?](https://tinfoil.sh/blog/2025-01-30-how-do-we-compare)
- [Running Private DeepSeek R1 with Verifiable Security](https://tinfoil.sh/blog/2025-02-03-running-private-deepseek)
- [Shrinking the Complexity Risks in AI Cloud Deployments](https://tinfoil.sh/blog/2025-02-27-shrinking-complexity)
- [Oblivious Is Not Always Private](https://tinfoil.sh/blog/2025-05-10-ohttp)
- [Got Privacy?](https://tinfoil.sh/blog/2025-05-15-privacy)
- [What About Side-Channels?](https://tinfoil.sh/blog/2025-05-15-side-channels)
- [Launching gpt-oss-120b on Tinfoil](https://tinfoil.sh/blog/2025-08-05-gpt-oss-120b-privacy)
- [Encrypted ChatGPT?](https://tinfoil.sh/blog/2025-08-22-openai-encrypted-chatgpt)
- [Launching qwen3-coder-480B](https://tinfoil.sh/blog/2025-09-02-qwen3-coder-private)
- [Private Chat Backups with Local-First Principles](https://tinfoil.sh/blog/2025-09-24-private-chat-backups-local-first)
- [Building a Browser-Native Verification Stack for Tinfoil](https://tinfoil.sh/blog/2025-12-18-browser-native-verification)
- [How We Implemented Private AI Web Search](https://tinfoil.sh/blog/2026-01-22-private-ai-web-search)
- [Sharing Conversations Without Sharing With Tinfoil](https://tinfoil.sh/blog/2026-01-26-private-url-sharing)
- [How Tinfoil Proves Exactly What Model Is Running](https://tinfoil.sh/blog/2026-02-03-proving-model-identity)

### Contact
- General inquiries: contact@tinfoil.sh
- Security: security@tinfoil.sh
- Legal: legal@tinfoil.sh
- Demo: https://calendly.com/tanya-52pb/tinfoil-demo
- Twitter/X: @TinfoilAI
- LinkedIn: Tinfoil Inc.
- Security Trust Center: https://trust.tinfoil.sh
- Status Page: https://status.tinfoil.sh
- Dashboard: https://dash.tinfoil.sh

### Brand Assets
- [Brand assets and usage guidelines](https://tinfoil.sh/brand)

## Location

Tinfoil Inc.
San Francisco, CA
© 2026

## Optional

### Keywords

verifiable privacy, private AI, confidential computing, secure enclaves, GPU confidential computing, NVIDIA confidential computing, hardware-backed security, zero trust AI, private AI inference, private LLM, encrypted AI, SOC 2 compliant AI, enterprise AI security, private ChatGPT alternative, on-premise AI alternative, cloud AI security, cryptographically verifiable AI, AMD SEV, Intel TDX, private RAG, AI code copilot, private fine-tuning, model weight protection, healthcare AI compliance, finance AI security, open-source AI models, DeepSeek private, Llama private deployment, private AI chat, zero data retention, tinfoil containers, secure containers, confidential containers, TEE containers