If your enterprise deal died at "legal won't let us send customer data to an LLM," this is the tool for that exact objection. The blocker is rarely the model's quality — it's that with a normal hosted API you can only promise the provider never reads the prompt. Tinfoil runs open-weight models inside a hardware secure enclave and hands your client a cryptographic proof of what's running, so "the host can't see your data" becomes something you verify rather than something you sign a contract about.
What it is#
Tinfoil is a confidential-inference platform. Your prompt travels encrypted into a secure enclave — an isolated, memory-encrypted region spanning a Confidential Computing GPU (NVIDIA Hopper/Blackwell) and a trusted CPU VM — where it's decrypted only for the moment of computation. Outside that enclave, the plaintext doesn't exist in readable form: not to Tinfoil, not to the underlying cloud, not to an insider with root on the box (Tinfoil — Technology). It's the same shape as end-to-end encrypted messaging, applied to model inference.
That idea isn't new; NVIDIA shipped Confidential Computing on H100 and Anthropic has published on the confidential-inference threat model. What Tinfoil packages is the annoying part: making it usable behind a normal API, with the verification wired in for you.
The one thing that matters: attestation#
Encryption in the enclave is table stakes. The reason this is verifiable privacy and not another promise is remote attestation.
Every enclave emits a hardware-signed report — an "attestation" — that measures the exact code and model image running inside it, chained to NVIDIA's and AMD's roots of trust. Tinfoil's client SDK checks that report before it sends your data: it verifies the hardware signature and compares the code measurement against Tinfoil's published, open-source build. If anyone slipped in logging, swapped the model, or stood up a look-alike endpoint, the measurement wouldn't match and the client refuses to talk. That check — not the marketing word "private" — is the product. The verification libraries are open source (github.com/tinfoilsh), so you can audit or run them yourself.
This is the difference founders should internalize: a standard provider's privacy rests on policy (a DPA, a "we don't train on your data" line, and their good behavior). Tinfoil's rests on proof. For an auditor or a security-questionnaire reviewer, "here is the attestation" is a categorically stronger answer than "here is our contract" — the same reason we argued that SOC 2 is table stakes for your first enterprise customer.
How to start#
It's OpenAI-compatible, which is the whole onboarding story: keep your existing client, change two things.
from openai import OpenAI
client = OpenAI(
base_url="https://inference.tinfoil.sh/v1/", # copy the exact URL from your dashboard
api_key="tinfoil_...", # your Tinfoil key
)
resp = client.chat.completions.create(
model="<an open-weight model from their catalog>",
messages=[{"role": "user", "content": "Summarize this patient intake note …"}],
)
print(resp.choices[0].message.content)chat/completions and embeddings work as they do against OpenAI. If you want to assert the privacy guarantee inside your own code — say, fail a request or a CI check when attestation doesn't verify — use Tinfoil's verifier library directly instead of the drop-in client. That's the move if you're going to tell a customer "we can prove the host never saw it," because then your system is doing the checking.
What it costs#
Two products, two prices. Tinfoil Chat — a private ChatGPT-style app — runs about $20/month with a free trial. The inference API starts with $5 in free credits, then bills per token like any hosted model. Check the site for the current per-model rates and catalog; the point is that pricing looks like normal usage-based inference, not a bespoke security appliance.
Who's behind it#
Tinfoil was founded in 2024 and is backed by Y Combinator and Pioneer Fund. The founding team's résumé is the reason to take the crypto seriously: PhDs in trusted hardware and privacy-preserving cryptography out of MIT, plus time on Cloudflare's cryptography team and privacy projects like Tor (YC profile). This is a domain where "who built it" is a real signal, because the guarantee is only as good as the attestation design.
Where it fits — and where it doesn't#
The clean win: cloud economics with an on-prem privacy proof. If the thing standing between you and a regulated customer is that their data can't be exposed to a third party, confidential inference collapses that objection without you buying GPUs.
The trade-offs are honest and worth pricing in:
- You're on open weights. Tinfoil serves open-weight models (Llama-, Qwen-, DeepSeek-class, plus embedding and speech models), not closed frontier models like Opus or GPT. For most regulated workloads — extraction, classification, drafting over sensitive text — that's the correct trade, but benchmark quality on your task before you commit.
- It's a young company. Treat it as a strategic bet on the specific workload where data sensitivity is the blocker, not a blanket default for all your traffic. Keep a fallback, and verify the attestation flow end to end yourself before you make the "we can prove it" claim to anyone.
If you can't currently answer "could your inference provider read this prompt if they wanted to?" with a hard no you can verify — and that gap is costing you a deal — Tinfoil is the one to trial this week. It sits in the same founder toolkit as the rest of the agent-security stack: scoped credentials, action logs, and now, a model that runs where no one can watch.
