Are conversations encrypted before leaving the server?

Yes. The Privatemode proxy runs on the same host as Open WebUI and encrypts every prompt before it is transmitted. On startup it also performs remote attestation to verify that the Privatemode backend is genuine. Requests are decrypted only inside the confidential computing environment.

Does Privatemode retain conversation data?

No. Privatemode never learns from your data. Requests are processed inside a hardware-isolated environment whose memory stays encrypted. Prompts and responses are not saved once a request completes; only operational metadata such as token usage, timestamps, and request status is kept for billing and monitoring.

Open WebUI shows "No models available". What do I check?

Verify the proxy is running and reachable from the Open WebUI container: `docker exec open-webui curl -s http://privatemode-proxy:8080/v1/models` If you see a connection error, confirm both containers are on the privatemode-net network: `docker network inspect privatemode-net ` Also check the proxy logs for attestation errors: `docker logs privatemode-proxy`

How do I add HTTPS for external access?

Put Open WebUI behind a reverse proxy such as nginx with TLS termination. The nginx location block should proxy_pass to http://localhost:3000 and include proxy_buffering off to support streaming responses. The connection between Open WebUI and the Privatemode proxy runs on the internal Docker network and does not need separate TLS. The proxy already encrypts all traffic to Privatemode. [See details.](https://docs.openwebui.com/reference/https/)

The proxy fails to start with a certificate error. What is wrong?

Your network likely uses TLS inspection. Mount a custom CA bundle into the proxy container using `-v /path/to/ca-bundle.crt:/etc/ssl/certs/custom-ca.crt:ro` and set the environment variable `SSL_CERT_FILE=/etc/ssl/certs/custom-ca.crt` in the docker run command. Also make sure you are running the latest proxy image: `docker pull ghcr.io/edgelesssys/privatemode/privatemode-proxy:latest`.

Integrating Privatemode AI with Open WebUI

Open WebUI gives a whole team a self-hosted chat interface with groups, permissions, and a document library. One Privatemode connection serves all of it, encrypted before it leaves your network and encrypted in memory while it is processed.

Introduction

Self-hosting your chat interface shouldn't stop at the model

Open WebUI chat using the Kimi K2.6 model

The challenge

One connection exposes every conversation

Open WebUI runs on your own server, but the moment it calls a conventional cloud LLM, every prompt and response your team sends is processed in plaintext on that provider's servers. Self-hosting the interface does not change that.

The solution

Encrypted before it leaves your network

The Privatemode proxy runs alongside Open WebUI on your own server, as the one connection every chat goes through. The proxy encrypts every request before it leaves, and confidential computing keeps your team's chats encrypted in memory even during processing, so by design neither the infrastructure provider nor we can read them.

Benefits

Why use Privatemode AI with Open WebUI?

One setup for the whole team

No GPUs needed for confidential AI

End-to-end confidentiality

Learn how

Free tier available

How to get started

How to set up Privatemode in Open WebUI

This tutorial walks you through deploying the Privatemode AI proxy alongside Open WebUI on a server your team can reach over your local network. From the moment a prompt leaves the proxy until the response comes back, traffic is end-to-end encrypted and only decrypted inside the backend's confidential computing environment.

Get your API key

If you don't have a Privatemode API key yet, you can generate one for free here.

Create a Docker network

Both containers communicate over a dedicated bridge network. This keeps the Privatemode proxy off the host network, so it is only reachable by containers you explicitly add to this network.

Start the Privatemode proxy

The proxy performs remote attestation on startup to verify the Privatemode backend, then transparently encrypts all requests before they leave the server.

--sharedPromptCache enables a shared cache across all Open WebUI users, reducing latency on repeated queries.

The -v proxy-logs volume persists the proxy's manifest log, which records the service versions it verified over time. The proxy has no exposed host port: it is reachable only by containers on privatemode-net.

Start Open WebUI

OPENAI_API_BASE_URL points Open WebUI at the proxy using the container name as hostname — no IP address needed. OPENAI_API_KEY can be any non-empty string; the proxy handles authentication to Privatemode using the key from Step 1. The -v open-webui-data volume persists user accounts and chat history across container restarts.

Done!

Open http://your-server:3000 in a browser and create an admin account. Open WebUI auto-discovers available models from the Privatemode proxy. Select a model and start chatting.

Remark: Tool calling via MCP uses the model's native function calling, which is the default since Open WebUI v0.10.0. On older versions, set Function Calling to Native under Settings → Admin → Models → [Model] → Advanced Params.

FAQ

Frequently asked questions about using Privatemode with Open WebUI

Yes. Open WebUI supports multiple user accounts, admin management and separate chat histories. The shared prompt cache also reduces latency for queries that share common prefixes across users, making team-wide usage more efficient.