Privacy model

GM’s gateway runs inside an Intel TDX trusted execution environment. This protects request handling from the gateway operator and host while data is being processed inside the enclave.

The complete privacy boundary depends on the model tier.

Read the catalog before you decide

Two fields in GET /v1/models determine who can see a request:

• tier — frontier, confidential, or open.
• gateway_provider — the upstream service that receives the request when the route leaves the gateway TEE. Observed values include chutes, openai, anthropic, gemini, zai, and moonshot.

gateway_provider is not the same as owned_by. owned_by credits whoever built the model; gateway_provider names who handles your data. Check gateway_provider before you describe a route’s privacy properties to your own users, and re-check it when you change models.

Frontier models

Frontier models are closed models reached through an upstream provider. GM protects the request through its gateway and keeps routing credentials inside the trusted environment, but the provider named in gateway_provider receives the request and processes it under that provider’s terms.

Do not claim that a frontier request is hidden from the upstream provider, or that GM changes the provider’s retention or training policy.

Confidential models

Confidential models are open-weight models served inside a TEE. They are marked with tier: "confidential" in the model catalog and use a -TEE model ID suffix. For these routes, inference remains inside the confidential serving environment.

Open models

Open models are marked with tier: "open". They are open-weight models, but unlike confidential models they carry no -TEE suffix and are not served inside a TEE. Each one routes to an upstream provider named in gateway_provider.

Treat an open model’s data handling the same way you treat a frontier model’s: the request leaves the gateway TEE and reaches a third party. Read that provider’s terms before sending sensitive data, and do not assume the tier name implies any additional protection.

Guardrails

Optional per-key guardrails run inside the gateway TEE before the request leaves it. Redaction can reduce what a frontier provider receives, but pattern-based processing does not guarantee detection of every sensitive value.

Your responsibilities

• Select a model tier appropriate for the data.
• Avoid sending secrets that are unnecessary for the task.
• Review the upstream provider’s terms for frontier models.
• Keep GM keys out of client bundles, logs, and source control.
• Do not turn architectural properties into broader legal or compliance claims without your own assessment.

See TEE attestation for how the trusted environment is bound to a measured workload.