A frontier-grade open-weight model on confidential GPUs. Iceland hardware, Swiss legal home, customer-pinned weights. Nothing logged. Nothing persists.
The cluster is being stood up in a Reykjanesbær colocation. Geothermal power, sub-zero ambient cooling, Icelandic data-protection law on top of EU GDPR. The operating entity is forming as a Swiss Stiftung in Zürich. Helping a foreign government compel data will be a personal crime against the directors under Art. 271 SCC.
The customer SDK encrypts the prompt to the enclave's public key. The relay forwards opaque bytes. The TEE decrypts inside the GPU, runs inference, re-encrypts the output, zeros its memory. Plaintext exists only inside node 03.
SDK wraps your prompt with the GPU enclave's public attestation key. The key was issued by NVIDIA's silicon root of trust. We never see plaintext.
TLS to a forwarding endpoint that only relays opaque bytes onto the Iceland cluster. The endpoint has no decryption material. Its job is delivery.
Blackwell-class Confidential Computing: code + weights run inside a hardware boundary; cleartext never leaves the GPU. Reproducible enclave build, hash signed and published.
Output is re-encrypted to your key on the way out. Enclave memory is zeroed. There is no log to subpoena because there is no log.
Our buyers are lawyers and security leads. We write the limits down.
Hidden enterprise pricing signals distrust. Final numbers are negotiated per cohort, but the brackets are public.
The MCP-native sub-agent dispatcher will be self-hostable on your infrastructure when source publishes under MIT. Bring your own provider keys; bring your own enforcement.
We run the dispatcher; you keep your provider quota and ledger. Customers pay their provider directly plus our routing fee. Bench-tested today.
Annual contract for design partners. Bench access during build, locked pricing through GA, named-partner threat-model addendum.
Confidential-compute carries an honest 4 to 8% overhead vs. public-cloud inference, plus the cost of running the Iceland colocation. We price to that overhead at scale and to the design-partner economics below it. We will publish actual unit economics on the transparency report we commit to alongside the public beta.
What you get against the obvious comparables.
| Capability | OpenAI Enterprise | Anthropic Enterprise | Self-host open weights | Xanadu Cloud |
|---|---|---|---|---|
| Provider can read your prompts | Yes (zero-retention removes storage; access is unchanged) | Yes (zero-retention enterprise tier) | Yes (you are the provider) | No (operator holds no plaintext by design) |
| Provider can be subpoenaed for your data | Yes (US jurisdiction) | Yes (US jurisdiction) | Whoever runs the hardware | Architecturally cannot produce |
| Customer-verifiable that the published code is the code that ran | No | No | If you built it | Yes (reproducible enclave + GPU attestation) |
| Frontier-quality model available | Yes | Yes | Open weights, frontier-adjacent | Open weights inside the enclave |
| Onboarding latency | Days | Days | Weeks (you build it) | Cohort onboarding, weeks |
| Posture against state-level adversary | None claimed | None claimed | Whatever you build | Stated honestly. See /threat-model. |
An open-weight frontier model whose weights are content-addressed and pinned at attestation time. Current target is a 1T-parameter open-weight model on Blackwell-class confidential hardware. Customers can verify the running weights match the published hash at session establishment.
Metering happens via cryptographic accumulators inside the enclave. Prompt and output token counts are signed and emitted as billing telemetry. The prompts themselves never leave. The ledger row contains usage, cost, and dispatch ids. Nothing else.
No. You are a customer of a Swiss legal entity that operates infrastructure in Iceland. Your contractual relationship and dispute jurisdiction are spelled out in the master services agreement (drafted under Swiss law). Your data never leaves the enclave, regardless of the customer's domicile.
The dispatcher source will be MIT and published in 2026. Customers of the confidential cloud receive a contractual right-to-bench-image so the running enclave configuration can be re-stood-up by a successor party of the customer's choosing on equivalent hardware.
We are personally exposed to that risk. The Swiss Stiftung is being structured (incorporation in progress) to absorb it without compromising customer data. Article 271 of the Swiss Criminal Code will make unauthorized assistance with foreign discovery a personal crime against the directors once the entity is registered. That's the structural lever. If the directors are compelled to comply abroad, the architectural design (§3 of the paper) means there's nothing produceable on the Swiss side anyway.
Yes. Billing telemetry includes token counts and dispatch timestamps. The threat-model page enumerates exactly what metadata is retained and for how long.
We’re onboarding a small number of design-partner firms ahead of the cloud public beta. Each partner gets bench access, a co-authored threat-model addendum naming their use-case, and a price lock through GA.