- ISO 27001 certified
- End-to-end confidentiality
- End-to-end verifiability
- Open source, reproducible builds
- Hosted in the EU
Verifiable, not just promised.
Privatemode keeps your prompts encrypted in memory while they are processed, and your client checks that before it sends your data.
Where your prompt is protected.
Encryption in transit and at rest is standard. The difference is what happens in memory, and whether you can check it.
ProxylessYou call our API directly, with nothing to install.
Such as OpenAI or Anthropic
Certified, assessed, and trusted.
Certified
ISO/IEC 27001:2022
Tempo Audits certifies the information security management system of Edgeless Systems GmbH, for the design, development, operation, and delivery of our software for confidential cloud computing and Confidential AI.
Standard
BSI C5:2026
Privatemode meets the criteria for "very strong attestation" in the BSI's cloud catalogue, its highest attestation level.
Professional secrecy
§ 203 StGB
A review by an external advisory firm recommends Privatemode for professions bound by professional secrecy under § 203 StGB, such as doctors, lawyers, and tax advisors.
Review
Audits and pen tests
External security firms have pen tested Privatemode and reviewed its architecture.
Licensed
We hold the Nvidia Confidential Computing license, for using the confidential computing features of Nvidia GPUs. With it, the GPUs that run the models are part of Privatemode's confidential computing environment.
Data protection
GDPR-compliant, hosted in the EU
Privatemode runs on infrastructure in the EU. We process your data on your behalf, under a data processing agreement according to Art. 28 GDPR.
Customer
Runs a scalable AI chatbot on Privatemode, with sensitive personal data encrypted in memory.
Customer
Its software is used by over 1,400 hospitals. ID has run Privatemode company-wide since July 2026.
Customer
Pilots AI-powered documentation and knowledge queries for the more than 16,000 GP practices it supports.
Customer
Runs AI coding assistants on Privatemode, so clients in regulated industries can use them without exposing their source code.
Built on proven technology.
What Privatemode is built on, and where our technology already runs.
In use
Germany's electronic patient record (ePA)
Edgeless Systems, the company behind Privatemode, protects sensitive ePA applications with confidential computing, for up to 50 million insured people. Privatemode brings the same approach, mechanisms, and expertise to AI.
Platform
ContrastPrivatemode runs on Contrast, our open-source platform for confidential computing.
Open source
GitHubThe code that matters for your security is public, and the builds are reproducible, so anyone can rebuild what runs.
How the protection works.
The three pillars behind the comparison at the top: what keeps your prompt encrypted, how your client software verifies the environment, and how the architecture is designed so that neither we nor others have access.
Pillar 1
End-to-end confidential computing
- Prompts are encrypted client-side with AES-256
- Prompts stay protected during processing
- Prompts are decrypted only inside the isolated environment
Pillar 2
End-to-end attestation and verification
- CPUs and GPUs issue cryptographic certificates
- Certificates cover all relevant software
- Entire Privatemode service can be verified
Pillar 3
Zero-access architecture
- No access for the infrastructure provider, by design
- No access for Edgeless Systems, by design
- No access for the model providers, by design
The architecture in detail
Every component and the full attestation flow are documented. With reproducible builds and public source code, your security team can verify the design.
Technical Details
Frequently asked questions about Privatemode's security and compliance
Your prompt is encrypted on your device and decrypted only inside the shielded environment. The Privatemode proxy or SDK does this, and verifies the environment first. The keys are shared only between your client and the isolated AI worker.