The confidential tier — a room no one outside the enclave can read

In a confidential room every turn runs inside a measured AWS Nitro enclave, and the model that answers runs on confidential-compute inference. Your device checks the enclave before it trusts it with the room key; each link checks the next before it passes anything on; and every answer comes back signed with what produced it. "We cannot read your room" is a property you can check, not a promise.

Status: Production, always on. The app builder chooses the tier per room; the platform can run any room in it. The trade: open-weights models instead of a frontier vendor's.

One confidential turn, link by link

Your device checks the enclave. It fetches the enclave's attestation — a document signed by AWS Nitro hardware the operator cannot reach — with a fresh nonce, verifies it against the AWS root pinned in the app's source, and compares the measurements with the published ones (/enclave-claim.json). Anything else is refused before a byte is sent.
It seals the room key to the enclave. The enclave makes its keypair inside itself at boot and never exports it; the attestation binds its public half. Your device seals the room key to that key, so our servers carry it but cannot open it.
The turn runs inside. The enclave opens the room, runs the assistant and its tools, re-seals the result and writes ciphertext back to storage. The credentials the enclave itself needs are released to it only by a key policy that checks its measurement — an account administrator is refused.
The model call stays confidential. The enclave sends a prompt only to an attested no-log gateway into confidential-compute inference. Its measured code verifies the gateway's attestation; the gateway's measured code verifies the model's enclave (AMD SEV-SNP, or Intel TDX with NVIDIA GPU evidence) before forwarding. Every call — the turn and every helper call — must come back with the gateway's signed inference receipt, bound to a fresh nonce and to the exact request and response, stating that the upstream was verified. Anything else fails closed and the answer is discarded.
The answer carries its proof. Each reply is signed inside the enclave with the build that ran it, the verified model receipts and the tool calls it made. space.certificates() checks a room's whole history on the device (SDK).

What you can check yourself

Check	How
The attestation is genuine AWS hardware	The COSE signature and certificate chain, to the AWS Nitro root pinned in source — the root the document carries is discarded. Runs in the browser.
The image is the published source	Rebuild it: the measurement (PCR0) reproduces from published source, with every build input pinned. Every release is also rebuilt by a separate build enclave and logged in Rekor, with a published audit verdict.
It was signed by our signing certificate	PCR8 derived from the published certificate yourself; a stated value that contradicts its certificate is rejected.
It is live, not replayed	Send a nonce; it must come back inside the signed document. Without one the result says `fresh: false`.
This answer came from that build	The reply's turn certificate: its signature, its attestation, the audit verdict for its build.

The commands: Verify it yourself.

Always on, and updated without downtime

One measured enclave serves every confidential room, always on, so a first message never waits for a launch. If it stops answering with a valid attestation, an orchestrator replaces it from a signed template — the new instance pulls its measured image and opens its credentials through the measurement-gated key policy, with no operator step.

A new build runs beside the old one: the published claim names both measurements during the switch, so devices accept either, and the old one is retired after the cutover. Each new instance makes a fresh key, so every device re-verifies before it seals.

The trade: open-weights models

A model can run confidentially only where it can be measured: open-weights models (DeepSeek, Kimi, Qwen, GLM, gpt-oss and others), not a frontier vendor's. A room that needs a frontier model takes the standard tier, where the turn reaches that vendor (privacy tiers). The builder chooses per room.

What it does not hide

Some measured environment reads the turn to answer it. Attestation cannot make computation invisible to the thing computing it. What this tier guarantees is that every environment that reads the turn is measured and verified.
The chain is transitive. Your device checks the turn enclave; its measured code checks the gateway; the gateway's checks the model's enclave. You do not receive the model chip's own quote directly.
The weights are vouched, not measured. The machine, the serving stack and the workload are measured; that the weights are exactly the named model's rests on the attested stack. This is true of every confidential-inference offering today.
A measurement proves the code, not its behaviour. It proves the running image is the one you can rebuild. Whether that code does what we say is what reading it is for.
Metadata. Which room is active and when, and the sizes and timing of messages.
Availability. The host can refuse to forward a request; it cannot read it.