Run AI
Confidentially
Your AI app, inside attested hardware. See it in Confidential Chat and Milo, then build your own.
Built on Solana Confidential Compute: a chat answered in confidential hardware, through Nito, and Milo, an agent that trades on its own.
An AI chat answered in confidential hardware
Ask anything. It’s answered in confidential hardware, our server keeps no prompts or replies, and your chats stay encrypted on your device.
Try nowAn agent that trades on its own
Milo is an autonomous trading agent that trades around the clock, on its own.
Try now
Confidential chatConfidentialMostly standard. The indemnity is one-sided, so push back before signing.
336.00- Confidential chatConfidentialIs this NDA clause normal?Is this NDA clause normal?Sent over TLSChecking the attestationAnswering in confidential hardwareRespondingFinished responding
Mostly standard. The indemnity is one-sided, so push back before signing.
ConfidentialCopyGPT-OSS 120BAsk anythingGPT-OSS 120BEncryptedConfidential chat
An AI chat answered in confidential hardware
Ask anything. It’s answered in confidential hardware, our server keeps no prompts or replies, and your chats stay encrypted on your device.
Try now - TradeBotRebalance SOL when volatility spikes2.42%2.61%2.50%2.84%3.03%2.96%3.18%3.27%3.22%3.39%3.47%3.86%2.40336.00Waiting for 3.5%SwappingSwapped
Milo
An agent that trades on its own
Milo is an autonomous trading agent that trades around the clock, on its own.
Try now
01
Approve your code
Put the code you trust on an approved list. Nothing else can sign for your app, and an old proof can’t be replayed.
oracle.eif
1fn tick(feed) {
2p = fetch(feed)
3s = key.sign(p)
4post(p, s)
5}
6
7
8
a2e7 4b15 f8c0 9e04 6a90 2c9e 71a0
52cd 9e04 b7a1 3f68 0d9c 13c7 e81b
e6b9 2a73 c18f 5d40 97e2 0b6c d3a8
02
Run it sealed
Your code runs in hardware the host can’t read. Its keys are made there and never leave, not even for whoever runs the machine.
03
Prove it on Solana
A Solana program checks the hardware’s proof once and writes a public record. After that, any program or agent can check it for at most 1,500 compute units.
Anything on Solana that should prove what it runs. In beta on devnet today; the audit is in progress, so it’s for development use only.
In the kit
- The verifier program, live on Solana devnet
- Rust and TypeScript SDKs
- Helpers to check the verifier’s record from your program
- A daemon that runs inside your enclave
- A command-line tool and a Docker image
~/my-app $ agent
✻ Confidential Compute v0.1
Nitro Enclaves
SEV-SNP
Confidential Space
Build on Solana Confidential Compute
About Confidential Compute, and about the chat: where your prompt goes and who can read it.
What hardware does Confidential Compute run on?
AMD SEV-SNP on Google Cloud’s Confidential VMs, AWS Nitro Enclaves and Google Confidential Space. A Solana program checks each one’s attestation.
Is it on mainnet?
Not yet. It’s in beta on Solana devnet, and mainnet follows the security audit.
Has it been audited?
Its security audit is in progress. Until it lands, it’s for development use only.
Can anyone check the hardware?
Yes. A Solana program checks the hardware’s attestation and writes a public record that any program or agent can look up. The Confidential chat demo doesn’t use that check yet: each reply links the build record and source code of Tinfoil’s router, the code that runs its model.
Is my chat end-to-end encrypted?
No. Your prompt goes to our server over an encrypted connection, then to Nito, which forwards it to a model running in confidential hardware. Our server and Nito see the text in transit.
Where does the model run?
In confidential hardware, through Tinfoil’s confidential router, which Nito forwards your prompt to.
Is the chat on this page real?
No, it’s a simulated demo: nothing you see in it leaves the page. The live chat is at solana.ai/chat.
Do I need a wallet?
No. The chat has no wallet connection yet.