Models

In privacy mode Solrouter answers with self-hosted, open-weight models only. It never calls a proprietary API. That choice is what makes the privacy claim hold.

Every model runs on its own Nosana GPU node. Your encrypted request travels from your device to an Intel TDX enclave (a TEE, a trusted execution environment: a hardware-isolated virtual machine). The enclave decrypts it and calls the model on the Nosana node (HTTPS per the documented node URL, not re-verified). No proprietary model API is in this path.

Available models

Each row is one model with its ids and its status on 2026-08-26.

gpt-oss:20b: default in the chat app and the SDK. Context 8192 tokens.

qwen3.8:27b: listed as "Uncensored" in the chat picker. In SDK 1.1.0 it needs a type cast (see below).

gemma4:31b: listed by GET /api/v1/models with a 262144-token context. The enclave has no endpoint for it yet, so the encrypted path is not confirmed.

qwen3:8b: retired node. The chat app folds this id to qwen3.8:27b.

The REST API returns catalog ids with a nosana: prefix, for example nosana:gpt-oss:20b. The backend accepts both forms.

All of these models are open-weight. Their weights are public, so anyone can inspect what runs on your prompt.

Choosing a model

Leave the model out and the SDK defaults to gpt-oss-20b. To pick one, pass model to client.chat():

const response = await client.chat('Your prompt here', {
  model: 'gpt-oss-20b', // the only typed live model in SDK 1.1.0
});

The SDK type lists gpt-oss-20b and qwen3-8b. The second maps to the retired qwen3:8b node, so do not use it. Any other string passes through unchanged, so nosana:qwen3.8:27b works with a type cast. A typed alias needs a new SDK release (Soon). The chat app lets you pick qwen3.8:27b today.

Node warm-up

A Nosana node goes idle when nobody uses it. The first request after idle time can fail with the error "Nosana GPU node is warming up". The error is retryable. Wait a short time and send the request again.

Why self-hosted models?

End-to-end privacy only holds if your prompt never reaches a proprietary API. If Solrouter handed your decrypted prompt to OpenAI or Anthropic, that provider would see your plaintext. Client-side encryption and TEE isolation would then buy you nothing.

Running only open-weight models on Nosana nodes closes that gap. It means:

• No proprietary model provider ever sees your query, your documents, or your reply.
• Solrouter's backend never sees your plaintext. It relays ciphertext only.
• The model weights are public, so anyone can inspect what runs on your prompt.

Where plaintext exists

The enclave decrypts your prompt and then calls the model on a Nosana GPU node (HTTPS per the documented node URL, not re-verified) with POST /v1/chat/completions on that node. The node runs Ollama outside the TDX enclave. So your prompt and the reply exist in plaintext in that node's memory during inference. The node operator could read the prompt during inference. Solrouter does not control that hardware. What holds: Solrouter's backend never sees plaintext, and the request is not linked to your identity on the node.