> ## Documentation Index
> Fetch the complete documentation index at: https://docs.redpill.ai/llms.txt
> Use this file to discover all available pages before exploring further.

# Confidential Models

> Confidential responses are served by a verified upstream TEE provider. Confirm a confidential response from its receipt.

A response is **confidential** when the gateway served it from a verified upstream TEE provider: the
gateway verifies the provider and binds the channel before forwarding your prompt, fail-closed. A
**routed** response goes to a third-party provider that is not attested. The difference is explained
in [How it works](/confidential-ai/how-it-works).

Confidentiality is a property of the **upstream provider that serves a request**, not of the model id.
The same model may be offered under more than one id, so the id alone does not tell you whether a
response was confidential.

## Confirm a confidential response

The [receipt](/api-reference/receipts) is the source of truth. After a call, read the `x-receipt-id`
header and inspect the `upstream.verified` event:

```bash theme={null}
curl -s "https://api.redpill.ai/v1/aci/receipts/$RECEIPT_ID" \
  -H "Authorization: Bearer $API_KEY" \
  | jq '.event_log[] | select(.type=="upstream.verified") | {provider, result, required, session_id}'
```

|                              | Confidential         | Routed   |
| ---------------------------- | -------------------- | -------- |
| `upstream.verified.result`   | `verified`           | `failed` |
| `upstream.verified.required` | `true` (fail-closed) | `false`  |
| `session_id`                 | present (`as_…`)     | absent   |

For the full check, see [Verify a response](/guides/verify-a-response).

## Which providers serve confidential models

Confidential models run on the verified providers RedPill supports: Tinfoil, NEAR AI, Chutes, and
Phala. The receipt's `upstream.verified.provider` records which one served a given request. See
[Providers](/confidential-ai/providers) for what each attests.

## Find confidential models in the catalog

Each model in [`GET /v1/models`](/api-reference/models) has an `is_tee` boolean. `is_tee: true` means
the model can be served confidentially, on a verified TEE provider. List them:

```bash theme={null}
curl -s https://api.redpill.ai/v1/models \
  -H "Authorization: Bearer $API_KEY" \
  | jq -r '.data[] | select(.is_tee == true) | .id'
```

`is_tee` tells you a model can be served confidentially. The receipt remains the per-response proof
that a specific response was.

## Confidentiality is not retention

`is_tee` constrains who can read memory while the model runs. It says nothing about whether the
upstream provider stores the prompt after serving it. A provider could run a model inside an enclave
and still write request logs to disk.

If you need the retention property, select it explicitly with
[`GET /v1/models?zdr=true`](/api-reference/models#query-parameters) and
`provider: {"zdr": true}`, rather than reading it off `is_tee`. See
[Zero data retention](/guides/zero-data-retention).

## Related

<CardGroup cols={2}>
  <Card title="Providers" icon="server" href="/confidential-ai/providers">
    What each confidential provider attests.
  </Card>

  <Card title="Verify a response" icon="circle-check" href="/guides/verify-a-response">
    Prove a response was served from an attested enclave.
  </Card>
</CardGroup>