Privacy model

SayGM’s gateway runs inside an Intel TDX trusted execution environment. This protects request handling from the gateway operator and host while data is being processed inside the enclave.

The complete privacy boundary depends on the model tier.

Read the catalog before you decide

The tier field in GET /v1/models — frontier, confidential, or open — determines the trust boundary. The confidential field is true only when inference runs in a TEE.

owned_by and gateway_provider identify the model’s maker. A model can be served by several providers: the maker’s own API, a cloud platform such as bedrock or azure, or an inference host such as chutes or deepinfra.

To choose which providers may process your requests, send X-GM-Providers with the providers you have reviewed. Your requests, including retries, then go only to those providers. Re-check the tier when you change models.

Frontier models

Frontier models are closed models reached through an upstream provider. SayGM protects the request through its gateway and keeps routing credentials inside the trusted environment, but the upstream provider receives the request and processes it under that provider’s terms.

Do not claim that a frontier request is hidden from the upstream provider, or that SayGM changes the provider’s retention or training policy.

Confidential models

Confidential models are open-weight models served inside a TEE. They are marked with tier: "confidential" in the model catalog and use a -tee model ID suffix. For these routes, inference remains inside the confidential serving environment.

Open models

Open models are marked with tier: "open". They are open-weight models, but unlike confidential models they carry no -tee suffix and are not served inside a TEE. Each one routes to one of possibly several upstream providers.

Treat an open model’s data handling the same way you treat a frontier model’s: the request leaves the gateway TEE and reaches a third party. Read that provider’s terms before sending sensitive data, and do not assume the tier name implies any additional protection.

Guardrails

Optional per-key guardrails run inside the gateway TEE before the request leaves it. Redaction can reduce what a frontier provider receives, but pattern-based processing does not guarantee detection of every sensitive value.

Your responsibilities

• Select a model tier appropriate for the data.
• Avoid sending secrets that are unnecessary for the task.
• Review the upstream providers’ terms for frontier and open models, and use X-GM-Providers to limit requests to the ones you accept.
• Keep SayGM keys out of client bundles, logs, and source control.
• Do not turn architectural properties into broader legal or compliance claims without your own assessment.

See TEE attestation for how the trusted environment is bound to a measured workload.