Private routing

Prompts we can prove
we never read.

A key with private routing sends its calls through a broker running inside a hardware-attested enclave. Prompts and completions pass through encrypted memory that the platform cannot inspect — and the attestation is yours to check, not ours to assert.

Open key settingsHow to verify it
Live attestationenclave

$ curl https://broker.agentplatform.store/.well-known/attestation

  • Quote signature chains to the hardware vendor root
  • Measurement matches the broker build we publish
  • TLS fingerprint is bound into the quote itself

Re-attested continuously

The two routes

Pick the one the workload deserves

Both routes carry the same request shape and bill at the same rate. The difference is who could read the payload if they tried.

Standard routing

Every key, by default
Your appGatewayModel provider
  • Calls reach the upstream provider through our gateway.
  • Encrypted in transit; the prompt sits in memory only long enough to route and meter it — never stored, never used for training.
  • Lowest latency and the widest model coverage.

Private routing

Opt in per key
Your appAttested brokerModel provider
  • The broker runs inside a hardware-attested enclave.
  • Prompts and completions move through encrypted memory the platform itself cannot read.
  • You can verify the claim yourself before you trust it.

What the guarantee is not

Honest limits, stated up front

The provider still sees the call

The enclave hides the payload from us. The model vendor on the far end still receives it, under whatever terms you signed with them.

Metering still happens

Token counts and routing decisions are computed inside the enclave and emitted as numbers, so billing works without the text leaving it.

Coverage is narrower

Not every route has a broker in front of it yet. Keys with private routing fail closed instead of silently falling back.