The questions, answered.

An open-weight frontier model whose weights are content-addressed and pinned at attestation time. Current target is a 1T-parameter open-weight model (Kimi K2.6 leading; we plan automatic fallback to DeepSeek V4 Pro and Qwen 3 Coder Next as tier alternates). Customers can verify the running weights match the published hash at session establishment.

Not from us. The architectural protections (Swiss legal home, Iceland hardware, our build pipeline) are part of what you're buying. The open-source dispatcher is fully self-hostable today under MIT.

Token counts, dispatch timestamps, and tenant id. Prompt and output contents stay inside the enclave. The threat-model page lists what is retained and for how long.

Metering is computed inside the enclave via signed accumulators over token counts. The enclave emits billing telemetry: usage counts, dispatch ids, cost. Nothing else. The ledger row contains exactly what is necessary to invoice, plus a customer-readable dispatch id you can quote back. Anything more would be a leak.

Hidden pricing signals the price is whatever the buyer will tolerate. A sovereignty product cannot ship that signal. We publish brackets on /cloud. Design partners lock their price through GA.

Your contractual relationship is with a Swiss legal entity (Stiftung) under Swiss law. Hardware lives in an Icelandic colocation. Your data never persists outside the enclave; jurisdiction over absent data is moot. Customer domicile is unrelated.

We are personally exposed to that risk. The Stiftung is structured to absorb it without compromising customer data. Article 271 SCC makes unauthorized assistance with foreign discovery a personal crime in Switzerland. That's the directors' shield. If the directors were compelled abroad, the architectural inability (§3 of the paper) means there's nothing produceable on the Swiss side anyway.

The dispatcher source is MIT and lives on GitHub forever. Confidential-cloud customers get a contractual right-to-bench-image so the enclave configuration can be re-stood-up by a successor party of the customer's choice on equivalent hardware. This is non-negotiable and shipped with the master services agreement.

Three things: (a) the code running is the published code (matched by reproducible build hash); (b) the hardware is a genuine NVIDIA confidential-compute GPU (matched by silicon root of trust); (c) the channel is bound to that specific GPU instance (so a MITM swap is cryptographically visible). The customer SDK refuses sessions where any of these fail.

Measured at 4 to 8 percent over comparable non-confidential inference at our target model size on Blackwell-class hardware. The buyer should not feel a difference at p50 latency. We will publish independent benchmarks alongside the public beta.

Iceland: geothermal power, sub-zero ambient cooling, EU-GDPR-equivalent data-protection law layered with Iceland's own. Switzerland: Article 271 SCC, constitutional privacy under Art. 13, no CLOUD Act, strong rule of law for the buyer segment. Hardware lives where it's economical and lawful; entity lives where the legal protections compound.

Zero-retention removes their database. Their ability to read in flight is unchanged. A US court can still compel anything they can read. We remove the operator's ability to read at all.

Self-hosting gives you full control and full operational cost. You become the operator and inherit your home jurisdiction's exposure. You build the attestation chain yourself. We are the build-it-once version. Same model class. The operating entity is forming where the legal protection compounds (Swiss Stiftung, in formation).

Private beta H2 2026, a small design-partner cohort onboarded as the first Iceland nodes attest. Public beta follows after the first transparency audit. The roadmap with concrete dates lives in the design-partner program brief shared after waitlist acceptance.

Email security@xanadu.run or read the full disclosure policy at /security. Reports are read by a human within 24 hours, acknowledged within 72, and patched on a published timeline.