USE YOUR AI. FOR ANYTHING.
Every bit of data is encrypted at the hardware level,
so no third party, not even us, can ever see it.
You've been holding back.
Proprietary code. Confidential documents. Customer information. Internal knowledge. Sensitive workloads you've had to keep away from AI.
Every major AI provider decrypts and processes your data on infrastructure you don't control. Encryption in transit protects the wire — not the server.
Cevell changes that.
Free BYOC Access.
Run on your cloud platform.
Deploy confidential AI enclaves directly inside your own cloud platform project with prefix-locked IAM security. Cevell BYOC access is 100% Free — you only pay raw compute at cost to your cloud provider. For managed dedicated clusters, contact our enterprise team.
100% Free BYOC Orchestration
Free BYOC access with $0 platform orchestration fees. Launch CVMs directly in your own cloud account and pay raw Spot (~65% savings) or On-Demand GPU rates directly to your cloud provider.
Prefix-Locked IAM Boundaries
Onboard in 5 seconds via cloud web terminal or Windows PowerShell. Permissions are strictly scoped to cevell-* resources. Zero key storage, zero persistence, zero data leaks.
Managed Dedicated Clusters
Need turnkey, fully managed confidential infrastructure without managing cloud accounts? We deploy and operate dedicated Hopper H100 and Intel TDX clusters with enterprise SLAs.
Make trust unnecessary.
Here's how.
Cryptographic protection at every stage of the inference lifecycle.
Encrypt
Your data is encrypted on your device with AES-256-GCM before it touches the network.
Transmit
Encrypted payload moves over TLS 1.3. The transport layer never sees plaintext.
Attest
Your client verifies the remote server is running inside a genuine hardware-encrypted enclave before sending any data.
Execute
The model runs inside hardware-isolated memory. The host OS, hypervisor, and cloud provider cannot read it.
Wipe
Response is encrypted back to your client key. All session memory is purged. Nothing is stored.
Drop-in API. Same code.
Private inference.
Point your existing OpenAI SDK at Cevell. Same endpoints, same response format. One line change.
# pip install cevell-tunnel openai
from openai import OpenAI
from cevell_tunnel import ConfidentialTransport
# 1. Initialize confidential transport pointing to your CVM endpoint
# Automatically audits hardware silicon attestation & encrypts requests via RFC 9180 HPKE
transport = ConfidentialTransport(
ip="<cvm_public_ip>",
auth_key="~/.cevell/tenant.pem",
verify_attestation=True,
)
# 2. Use standard OpenAI SDK - zero prompt exposure in transit or memory
client = OpenAI(
base_url=transport.base_url,
api_key="EMPTY",
http_client=transport,
)
stream = client.chat.completions.create(
model="Qwen/Qwen2.5-7B-Instruct",
messages=[
{"role": "system", "content": "You are a private financial analyst."},
{"role": "user", "content": "Analyze confidential portfolio risk exposure..."}
],
stream=True
)
for chunk in stream:
print(chunk.choices[0].delta.content or "", end="", flush=True)OpenAI SDK Compatible
Change one line — the base URL. Your existing codebase works as-is. No refactoring.
Hardware Attestation Built In
The SDK verifies the enclave's hardware attestation signature before sending any data. Automatic.
Encrypted Streaming
Real-time token streaming over TLS 1.3. Each chunk is decrypted on your client.
What "can't access your data"
means, technically.
Structural, hardware-enforced privacy guarantees backed by verifiable cryptography.
Hardware Memory Encryption
Every VM runs with hardware memory encryption enforced at the silicon level by the processor's security engine. The hypervisor and host OS are excluded from the trust boundary.
Immutable Operating System
The root filesystem is locked with dm-verity — a Merkle hash tree that verifies every disk block at boot. No runtime modification is possible.
Cryptographic Request Signing
Every API request is signed with Ed25519. Sliding-window nonce validation prevents replay attacks.
Ephemeral Key Exchange
Session keys use X25519 Diffie-Hellman with HKDF-SHA256. Keys are generated per session and never stored.
Open Source Runtime
The enclave runtime, proxy, and initrd are open source. Builds are deterministic via Nix. You can reproduce and verify every binary hash.
Zero Retention
No prompts. No responses. No logs. Session memory is wiped after every request. There is nothing to subpoena.
Private AI starts here.
Deploy verifiable, hardware-enclaved inference for your sensitive workloads.
Frequently asked questions.
Your data is processed inside hardware-encrypted memory that the server operator physically cannot read. This isn't a software policy — it's a constraint enforced by the processor's security engine at the silicon level. Even someone with root access to the host machine cannot inspect what's happening inside the enclave.
No. Your data is encrypted on your device before it's sent. It's only decrypted inside the hardware enclave, which Cevell infrastructure does not have access to. You can verify this yourself through cryptographic attestation — a hardware-signed proof that the enclave is genuine and unmodified.
Cevell runs any model compatible with the vLLM inference engine. That includes Qwen, Llama, DeepSeek, and custom fine-tuned models. You can load models directly from HuggingFace into your sealed enclave.
No. If you use the OpenAI SDK, change one line — the base URL. Cevell is fully compatible with OpenAI's chat completions API, including streaming. Python, TypeScript, and cURL are supported.
It's gone. Session memory is wiped immediately after the response is sent. No prompts, responses, keys, or metadata are retained anywhere. There are no logs to export, review, or subpoena.
The Cevell SDK automatically requests a hardware attestation report from the processor's security engine before sending data. This is a cryptographic proof — signed by the processor's hardware key — that the server is running genuine, untampered enclave code. You can also verify manually from the CLI.