RedRouterPrivate inference: what ZDR and encryption protect
Private inference has no single universal product definition. First ask who can see plaintext while the model runs, who retains content, and what you can independently verify. RedRouter offers Zero Data Retention: no stored prompts or completions. RedRouter also offers Confidential Inference, which adds hardware-isolated, attested execution and encryption to the verified runtime. This guide explains how these protections fit together.
Choose the boundary you need
| Control or architecture | What it addresses | What it does not establish | Evidence to request |
|---|---|---|---|
| No training | Permitted uses of submitted content | No logging, deletion or operator exclusion | Applicable policy and contract, including upstream scope |
| TLS / HTTPS | Traffic between transport endpoints | Secrecy from a proxy that terminates TLS | Where each connection terminates and who decrypts |
| Encryption at rest | Stored data under a key-access policy | Secrecy from authorized readers or running software | Key custody, access audit and recovery policy |
| Attested confidential runtime | Execution isolated under a defined hardware/software threat model | Bug-free guest code, safe model output or every side channel | Measured release, fresh attestation, bound endpoint key and verifier |
| FHE / MPC | Computation using ciphertext or distributed secret shares | Universal model support, affordable performance or automatic malicious-party security | Protocol, adversary assumptions and workload-specific evaluation |
| Local / self-hosted | Control over where software and data run | Secure endpoint devices, disabled telemetry or safe administration | Network, storage, dependency and operator review |
Follow the plaintext through every boundary
The arrows describe a conceptual standard request path, not a physical network map. The upstream host administers the environment in which the runtime executes; storage can occur at multiple stages. A response crosses these boundaries in reverse. Ask the same questions about completions, tool arguments and attachments as about prompts.
For RedRouter standard inference, Cloudflare terminates ordinary transport and processes plaintext traffic, RedRouter handles request content, and an upstream host runs the model. With ZDR enabled, RedRouter stores no prompts or completions. RedRouter Confidential Inference keeps content encrypted to a verified, hardware-isolated runtime for protected execution. Your client can retain another copy before the request even leaves your machine.
No training is not no retention
A promise not to train on your data constrains a use of that data. It does not answer whether a provider keeps a debugging log, a security record or a saved conversation. Zero Data Retention means no prompts or completions are stored.
Ask whose policy applies: the gateway, model host, external search tool and your application can have different controls. RedRouter's retention guide distinguishes per-key storage from account ZDR and explains how to enable ZDR before sending requests.
TLS, encryption at rest and encryption to an enclave
TLS protects a connection until its termination point. Database encryption protects stored bytes subject to who can obtain keys and run decryption. Neither alone prevents the inference service from inspecting a prompt in memory.
An encrypted-to-enclave channel instead aims to keep content encrypted until it reaches an approved confidential runtime. The runtime normally decrypts and computes on plaintext inside its protected boundary; this is different from computing directly on ciphertext. An ordinary upstream behind an encrypted enclave proxy is still an ordinary plaintext upstream.
A TEE, or trusted execution environment, isolates execution within a specific threat model. NVIDIA's Trust and Threat Model distinguishes hostile host administration from trusted guest software. Guest code and guest administrators remain security responsibilities. CPU/GPU firmware, drivers, attestation policy and supported interconnect modes matter; a confidential VM alone does not exclude the service operator who controls the software inside it. Check the exact platform rather than inferring support from a GPU brand.
Attestation must bind the key, code and model
Remote attestation supplies evidence about an execution environment. A client must validate that evidence against an approved release policy before sending sensitive content. It also needs to establish that the encryption key belongs to that environment. Otherwise, an unrelated endpoint could present genuine evidence while receiving the plaintext itself.
RedRouter Confidential Inference uses remote attestation and encryption to the verified runtime to establish the protected execution boundary. Verification follows the path that can decrypt content, keeping ordinary edge and control-plane processing outside that boundary.
For any such design, ask which weights, tokenizer, adapters and runtime configuration the approved measurement commits to, and whether alternate loading paths are blocked. A recognizable model name is not a weight commitment. Signed code is not necessarily reviewed code; a valid signature does not make an old vulnerable release acceptable. Evidence needs freshness, revocation and rollback rules. Attestation does not prove a model's answers are correct or harmless.
FHE and MPC: a different computation model
Fully homomorphic encryption (FHE) permits selected computations on encrypted values. Secure multiparty computation (MPC) distributes computation under a protocol and assumptions about participating parties. Hybrid systems can combine them, with costs and security properties determined by the actual workload and adversary model.
The EncFormer research paper studies a two-party Transformer inference framework combining FHE and MPC, including conversion and communication costs. Its evaluation on particular GPT- and BERT-style workloads is not proof that every full-size model can be served economically this way. A buyer still needs the protocol's collusion and malicious-party assumptions, supported operations, accuracy effects and deployment evidence. RedRouter Confidential Inference uses hardware-isolated execution. FHE and MPC are different approaches to computation.
Local, on-premises, VPC and residency answer different questions
Local or on-device inference can keep processing on your own device if the software does not send content elsewhere. Self-hosted and on-premises systems give you operational responsibility, including logs, updates, access control and backups. BYOC, or bring your own cloud, moves some ownership into your account but may still allow a vendor administrator access.
A VPC or private endpoint constrains networking. Dedicated hosting constrains resource sharing. Neither automatically prevents the host or guest administrator from reading memory. EU hosting and data residency constrain geography only to the extent documented for processing, storage, backups and support access. Sovereign infrastructure claims additionally need an explanation of legal jurisdiction and operational control. None of these labels is a substitute for a threat model.
Your client and tools are part of the boundary
A protected server cannot prevent a compromised client, browser extension or local transcript from copying input. A browser also runs code delivered by the service: ask how the verifier and encryption client are distributed and independently checked. A green server banner is not client verification.
Retrieval, web search, embeddings, file preprocessing and tool execution need their own data-flow review. A model's protected response may contain a tool call whose arguments your application then sends to an ordinary third party. Streaming also needs authenticated ordering and termination; ask what happens on retry, cancellation or verification failure. No protected route should silently fall back to an unverified endpoint.
Can provider staff read this?
Use this decision list for each component that handles content:
- Does it receive plaintext? If a gateway terminates ordinary TLS without additional content encryption, its running software can read the request. A policy may restrict staff access, but that is not cryptographic exclusion.
- Who controls the decryption key and guest software? If an administrator can replace accepted code, attach a debugger or obtain keys outside the protected boundary, hardware isolation alone is insufficient.
- Does your client verify the approved workload and its key before sending? If not, do not infer operator exclusion from an enclave badge or SDK compatibility.
- Can plaintext leave through another path? Review logs, tools, model routing, dumps, storage and support workflows. One unprotected hop can defeat the intended boundary.
- What remains trusted or excluded? Hardware flaws, residual side channels, client compromise, traffic metadata and denial of service require explicit limits. A successful verification is evidence within those limits, not a universal guarantee.
Buyer evidence checklist
Copy this text into an evaluation record and fill it for the actual service and release. An unanswered item is an unresolved requirement, not a pass.
Workload and data classes:
Parties forbidden from seeing plaintext:
Client / edge / gateway / host / runtime / storage boundaries:
Permitted metadata and retention periods:
Log, backup, saved-history and deletion rules:
Exact CPU/GPU platform and protected interconnects:
Approved code/configuration/model commitments:
Attestation freshness, revocation and rollback policy:
Endpoint key binding and verification before transmission:
Client/verifier source, distribution and reproducibility evidence:
Tool, retrieval, file and streaming exclusions:
Failure behavior: reject or silently downgrade?
Independent review scope, release and unresolved findings:
Contract, residency and incident-response requirements:
Decision owner and evidence review date:
Request a runnable verifier and failure examples for stale evidence, an unapproved release, the wrong key and unavailable protected capacity. A vendor document explains intent; a current result for your exact client and platform provides different evidence. Neither should be presented as an independent audit unless one actually exists.
RedRouter: retention controls and Confidential Inference
Current standard inference has per-key content storage off for new keys, without a surcharge. Older keys retain their prior on setting. Account ZDR is separate, off by default, prospective across keys and Chat, disables Save chat, and is included during paid monthly plan periods or adds 20% to PAYG token rates. With ZDR enabled, RedRouter stores no prompts or completions. Earlier content is not retroactively erased, and saved chats have a separate lifecycle. See data handling.
RedRouter Confidential Inference is available. It protects content during execution through hardware isolation, remote attestation and encryption to the verified runtime. Contact support@redrouter.org for supported models, integration and pricing.
Choose the standard inference API when its processing boundary and retention controls meet your requirements. Choose Confidential Inference when your workload also needs a verified execution boundary. Review your client, tools and authorization in either case.
Explore Confidential Inference or enable Zero Data Retention.